This is an informational English translation. The Norwegian (Bokmål) version is legally authoritative; in case of any discrepancy, the Norwegian text controls.
This privacy policy explains how AI-Flow processes personal data when you visit ai-flow.no, send an enquiry or otherwise contact us.
1. Data controller
AI-Flow is the trading name used in day-to-day business by the registered Norwegian sole proprietorship AI-Flow Nowak, organisation number 937 399 359 (Enhetsregisteret), VAT-registered since 2026-05-18. Owner: Toni Nowak.
- Place of business: Lundamo, 7232 Melhus kommune, Trøndelag, Norway
- Email: [email protected]
- Phone: +47 458 66 499
As a sole proprietorship, AI-Flow is not required to appoint a Data Protection Officer under GDPR art. 37. Privacy inquiries can be sent directly to the contact points above.
2. What we process
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Website visit data | Anonymised visit statistics from Matomo — see Cookies for details | Understand site usage, improve content | 90 days (raw data), 24 months (aggregated reports) |
| Correspondence | Content of emails and messages you send us | Respond to inquiries, prepare proposals | Up to 12 months after the dialogue ends, or for as long as a client/contractual relationship lasts |
| Client data | Contact person, company details, contract details | Deliver agreed services, invoicing, bookkeeping | Per the Norwegian Bookkeeping Act — normally 5 years after the end of the accounting year for vouchers |
We do not collect special categories of personal data (health, religion, trade union membership, etc.) through the website.
3. Legal basis for processing
- Performance of or steps to enter into a contract (GDPR art. 6(1)(b)) — responding to a project enquiry, carrying out an engagement, invoicing.
- Legitimate interest (art. 6(1)(f)) — using anonymised, cookieless visit statistics to understand and improve the site, and responding to inquiries sent to us. We assess this as not overriding your fundamental rights, in part because no cookies are used for this purpose (see section 6).
- Legal obligation (art. 6(1)(c)) — retaining accounting vouchers under the Bookkeeping Act.
4. Who we share data with
| Recipient | Role | Purpose | Where |
|---|---|---|---|
| Cloudflare, Inc. | Processor | Hosting and technical operation of the site (Cloudflare Pages) | EU/EEA regions are selected where technically possible; Cloudflare is a US company — see section 5 on transfers |
| Matomo (analytics) | Own infrastructure | Anonymised, cookieless visit statistics, self-hosted at analytics.ai-flow.no | Norway |
Matomo run on AI-Flow’s own infrastructure and are not treated as independent processors for the purposes of this site — they are tools AI-Flow operates directly. If AI-Flow starts using AI-based services (e.g. Anthropic) directly on the website in the future, this policy will be updated before such functionality is activated. Where AI-Flow processes a client’s data as part of a delivered service, sub-processors are governed separately under the Data Processing Agreement (DPA).
5. Transfers outside the EEA
Some of the providers above may involve transfers of data outside the EEA, in practice primarily to the US. Such transfers rely on:
- the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and/or
- the EU-US Data Privacy Framework, where the recipient is certified.
As of the date of this policy, the Norwegian Data Protection Authority (Datatilsynet, last updated 2026-07-01) has not changed its assessment that the US adequacy decision remains valid, while noting the framework could face further legal challenge. AI-Flow monitors this and will update the transfer basis if the situation changes.
6. Cookies
The site is built to avoid storing or reading information on your device for analytics purposes. See the separate Cookies page for a full breakdown of what is actually stored.
7. Your rights
Under GDPR Chapter III you have the right to:
- access the data we hold about you (art. 15)
- have inaccurate data corrected (art. 16)
- have data erased (“right to be forgotten”, art. 17)
- restrict processing in certain cases (art. 18)
- receive your data in a structured format (data portability, art. 20)
- object to processing based on legitimate interest (art. 21)
- lodge a complaint with Datatilsynet, see datatilsynet.no
To exercise these rights, contact us at [email protected]. We normally respond within 30 days.
We do not base any decisions on fully automated processing or profiling that produces legal effects or similarly significantly affects you.
8. Children
The site is aimed at businesses and is not directed at children. Should consent from a person under 13 exceptionally become relevant for an information society service (Personal Data Act § 5), consent from a parent or guardian is required.
9. Changes to this policy
For material changes to how we process personal data, we will inform you on the website well before the change takes effect and clearly highlight what is new. Changes are kept separate from marketing content. The current version and date are shown at the top of this page.
10. Contact and complaints
Questions about this policy: [email protected]. You may also complain to the supervisory authority:
Datatilsynet (Norwegian Data Protection Authority) datatilsynet.no · [email protected] · +47 22 39 69 00
Contact form delivery
Contact enquiries (name, email, optional company and message) are sent through Gmail SMTP, operated by Google, to [email protected]. The sender is [email protected], an authorized Gmail alias. Google processes the email data as part of providing its email service; processing is not represented as limited to Norway or the EU. Do not submit sensitive information through this form. Browser Do Not Track is respected by website analytics.