Privacy Policy

Data controller

Apier is operated by Grov Digital (organisation number 833 397 982), registered in the Brønnøysund Register Centre, Norway. Grov Digital is the data controller for the personal data described here.

Privacy enquiries can be sent to support@apier.no.

Apier as a tool for businesses

Apier is a tool for businesses. When you use Apier to perform actions against government systems on behalf of a business, your requests may contain personal data, for example an organisation number, a national identity number or a name, about the people or businesses the action concerns.

For that data, Apier acts as a data processor on behalf of the customer, who is the controller. This policy primarily covers the data we process as a controller.

What personal data we process

As a controller, we process:

• Account data: your email address, used for sign-in via magic link. We do not store passwords.
• Business details you provide, for example an organisation number and contact details linked to your account.
• Usage and technical data: IP address, timestamps, request metadata and logs generated when you use the service.
• Audit and traceability data: Apier keeps an append-only audit log of actions performed against government systems. These records may contain identifiers such as an organisation number and, where relevant, a national identity number, along with the time, the outcome and the capacity in which the action was performed.
• Error and operational data: technical error reports that help us run and secure the service.
• Role holders from Brønnøysundregistrene: the names of people registered with roles in Norwegian businesses (board, general manager, signing authority, procuration, auditor and proprietor), as the Central Coordinating Register for Legal Entities and the Fullmakttjenesten publish them under the Norwegian Licence for Open Government Data (NLOD). The register's answers also carry dates of birth, but Apier does not store them: dates of birth, national identity numbers and addresses of role holders are removed before anything is stored, and only the name and the role code are kept.
• Sole-proprietorship names from the Central Coordinating Register for Legal Entities: the name of a sole proprietorship (enkeltpersonforetak, ENK) contains its proprietor's name and is therefore personal data about the proprietor, also where the proprietor is not listed with a role. Apier retrieves and shows the name, the organisation number and the other register fields as Enhetsregisteret publishes them under NLOD, to answer which business an organisation number belongs to.
• History of register data: Apier keeps what Enhetsregisteret and the Fullmakttjenesten showed about a business at a given point in time, as daily snapshots and change events, with the same role-holder data as above (name and role code) and the names of sole proprietorships. The history starts on 30 July 2026 and covers only the businesses Apier mirrors. No answer is served from the history yet. When one is, every answer built on it states the period it covers. The snapshots and change events are never rewritten. The change log, which holds the same values before and after a change, is anonymised after 12 months.
• Demand for businesses: a daily count of how many times an organisation number was looked up, per day and per channel, with the caller class (pricing tier or keyless) but no information about who asked (no account, API key, IP address or query text). For a sole proprietorship the organisation number is personal data about the proprietor, which is why the count is listed here. The count is used internally to find gaps in our coverage and is not served through the service.

Purposes and legal bases

We process personal data for the following purposes:

• To provide the service you have requested — creating and managing your account, authenticating sign-in and carrying out requests against government systems. Legal basis: performance of a contract (GDPR Article 6(1)(b)).
• To maintain a traceable, append-only audit log so that actions can be documented and verified. Legal basis: our legitimate interest in being able to document use of the service, and legal obligation where documentation requirements follow from law (Article 6(1)(f) and (c)).
• For security, operations, troubleshooting and abuse prevention. Legal basis: our legitimate interest in a secure and reliable service (Article 6(1)(f)).
• To answer who may bind a Norwegian business, with the names of its registered role holders. Legal basis: legitimate interest (Article 6(1)(f)). The data is already public in the Central Coordinating Register for Legal Entities, and our legitimate interest assessment is published at https://www.apier.no/legal/legitimate-interest-assessment.md. Apier never produces a person-centric overview of one person's roles across businesses, and never mixes roles in voluntary organisations with roles in business activity (enhetsregisterloven section 9-1, third paragraph).
• To document what the register showed at a given point in time, so that a customer or an AI agent can later show which registered signing rule they relied on, and to count which businesses are asked about in order to find gaps in our coverage. Legal basis: legitimate interest (Article 6(1)(f)). Our assessment of these two processing activities is published at https://www.apier.no/legal/legitimate-interest-moats.md and builds on the legitimate interest assessment above.

Data we did not obtain from you (Article 14)

Role-holder data and sole-proprietorship names come from Brønnøysundregistrene, not from you. GDPR Article 14 would normally require us to inform each individual. We rely on the exemption in Article 14(5)(b) (disproportionate effort): the register covers many hundreds of thousands of role holders we have no channel to, and the data is already public in the register. As the alternative measures, we publish this policy, the legitimate interest assessment (https://www.apier.no/legal/legitimate-interest-assessment.md) and the disproportionate-effort assessment (https://www.apier.no/legal/disproportionate-effort.md), and we accept access, rectification, erasure and objection requests without an account via POST /api/v1/privacy/dsr and support@apier.no.

If Brønnøysundregistrene removes a business from its open data (a 410 Gone answer or the update type «Fjernet»), Apier stops serving it at once and then purges its copy from the archive. After the purge Apier keeps a tombstone with the organisation number, the date and the reason, and the hashes of the purged snapshots (no content) so that earlier daily anchors can still be verified. Request and audit logs follow their normal retention. Two of them keep fields taken from the register after the purge: the answer an MCP tool gave to a company lookup (the MCP query log), and whether the business has filed annual accounts and for which year (the audit log of annual-accounts lookups).

Data processors and subprocessors

To provide the service we use certain subprocessors that process personal data on our behalf; with those we have a data processing agreement in place. For transparency, the list below also includes certain third parties that are not data processors for us — public authorities and embedded third-party scripts — as noted on the individual line. These are currently:

• Supabase — primary database and storage (stored in the EU, eu-north-1 Stockholm).
• Vercel — build and edge hosting of the application (pre-launch; European region, planned migration to dedicated EU infrastructure).
• Sentry — error tracking (no PII per scrubber config).
• Plausible — privacy-first analytics (cookieless, no PII).
• Betterstack — uptime monitoring and hosted status page.
• Maskinporten (Digdir) — Norwegian government auth broker.
• Lovdata — read-only legal-text reference (no data sent).
• Resend — transactional email (welcome, magic link).
• Stripe — payment processing and subscription billing (EU entity, Stripe Payments Europe Ltd, Ireland; transfers safeguarded by SCCs / EU–US Data Privacy Framework).
• Google — Preferred Sources button on guide pages (the script and the button's iframe load from news.google.com directly in your browser; the script loads only on the guide pages, but once loaded it remains part of your browsing session until you close the tab or fully reload a page; Apier's servers send Google nothing, and Google acts as an independent controller — not a data processor for Apier — for what its script processes in your browser).

Where data is stored and transfers outside the EU/EEA

Personal data is stored in the EU (eu-north-1, Stockholm). Some of our subprocessors are established outside the EU/EEA or have a US parent company.

Where personal data is transferred outside the EU/EEA, this is done on the basis of the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, together with appropriate technical and organisational measures.

The sentence above covers transfers Apier itself makes through its subprocessors. One exception happens in your browser: on the guide pages your browser loads Google's Preferred Sources script directly from news.google.com (Google LLC, United States). The script loads only on the guide pages, but once loaded it remains part of your browsing session until you close the tab or fully reload a page — including after you navigate on to other pages without a full reload. For that browser-side processing Google acts as an independent controller, and no transfer mechanism is asserted here — see the Google line in the subprocessor list.

Retention

We keep account data for as long as you have an active account, and delete or anonymise it within a reasonable time after the account is closed, unless we are legally required to keep it longer.

The audit log is append-only and is kept for as long as necessary to meet documentation, accounting and control requirements. Technical logs and error data are kept for a shorter period.

The history of register data is not deleted after a fixed period: it is kept for as long as the business exists in Brønnøysundregistrene's open data, and is removed as the Article 14 section describes when the register removes the business. The change log is anonymised after 12 months. The MCP tool query log is deleted after 24 months, and the API request logs after 30 days. The daily lookup count is kept as numbers, with no information about who asked.

Your rights

Under the GDPR you have the right to access, rectify and erase personal data about you, and to request restriction of or object to processing, as well as the right to data portability (Articles 15 to 22).

Please note that the audit log is append-only for traceability and documentation. We may therefore not always be able to change or delete records in that log while we have a legal obligation or legitimate interest in keeping them. We explain the reason in such cases.

You can delete your account and its associated account data yourself via the self-service API (DELETE /api/v1/account) while signed in. To exercise your other rights, or if you can no longer sign in, contact us at support@apier.no.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) if you believe we process personal data unlawfully (Article 77).

Role holders and sole proprietors can request access, rectification and erasure, and object to the processing, without an account, via POST /api/v1/privacy/dsr or support@apier.no. A correction of register data is made at Brønnøysundregistrene. Apier picks up the corrected value, and the earlier value remains in the history as what the register showed at the time. If we uphold an objection, we stop showing the data in our answers. That is done manually today. An automatic guard that keeps later register updates from bringing the data back does not exist yet, and until it does we follow up each objection by hand. A procedure for removing one person's entries from a business's stored history does not exist yet. Until it does, we decide case by case how an upheld objection is applied to the history, if necessary by removing the content for the whole business as we do when the register removes it, keeping a tombstone without content, and we tell you what was done.

Cookies

We use a strictly necessary session cookie to keep you signed in after you authenticate with a magic link. We do not use cookies for advertising or cross-site tracking. Our visit statistics (Plausible) do not use cookies.

On the guide pages your browser loads Google's Preferred Sources script and the button's iframe directly from news.google.com. The script loads only on the guide pages, but once loaded it remains part of your browsing session until you close the tab or fully reload a page — including after you navigate on to other pages without a full reload. Whether that embedded Google surface sets cookies in its own third-party context has not been verified by us and is governed by Google's own terms. Apier itself sets no non-essential cookies either way.

Security

We protect personal data with technical and organisational measures, including encrypted transfer (TLS/HTTPS), data storage in the EU, password-free sign-in (magic link) and an append-only audit log. Vulnerabilities can be reported to security@apier.no.

Changes to this policy

We may update this policy. For material changes we will give notice in an appropriate way. The date at the top shows when the policy was last changed.

Contact

Grov Digital. Privacy and general enquiries: support@apier.no. Security: security@apier.no.