Privacy

1. Data controller

ProTilbud.no is the data controller for personal data stored in the service in connection with user accounts, organizations, and quote work.

2. What data we process

• • User account and roles: name, email, password hash (not plain-text passwords), organization membership, and role (e.g. owner/admin/member).
• • Company details: company name, contact data, org. number, payment terms, logo.
• • Customer data: name, address, email, phone, and related notes in quote input.
• • Inquiries: public intake form content, including optional photo attachments stored privately.
• • Quote data: job descriptions, structured pricing, terms, generated text, revisions, publication, and customer responses (accept/decline/change request).
• • Projects and change orders: lightweight status and accepted additions linked to an accepted quote.
• • Notifications: email outbox and send log (no SMS). Optional customer reminders with opt-out.
• • Export files: JSON backup and accounting export (CSV/JSON) that you download — not a live accounting integration.
• • Technical operations data: limited error logging and health checks without unnecessary customer content.

3. Purpose and legal basis

• • Provide the service (login, storage, editing, publication, and export).
• • Send operational and follow-up emails.
• • Ensure stable operation, error correction, and abuse prevention.
• • Fulfil our agreement with you as a user (GDPR Art. 6(1)(b)).

4. Storage and security

• • Data is stored server-side in a database linked to your organization/account.
• • Passwords are stored as hashes using modern cryptographic methods.
• • Access is controlled via login, HttpOnly session cookies, and organization roles.
• • Private intake attachments are not intended for public indexing.

5. Sharing with third parties

When generating quotes, relevant input is sent to our AI provider (Vertex AI) to produce text. Email is sent via our email provider (Mailgun) when notifications are enabled. Data is otherwise not shared with third parties beyond what is necessary to operate the service. The product does not offer SMS alerts or a payment gateway.

6. Retention

Information is stored while your account/organization is active, or until you request deletion. Send logs and outbox data are kept for operations and troubleshooting, and may be deleted or anonymized when no longer needed. You can download a backup and accounting export from Settings. See also the operations retention note.

7. Your rights

• • Access to stored personal data.
• • Correction of inaccurate data.
• • Deletion of account and data (subject to legal requirements).
• • Data portability via export (JSON backup / accounting export).