Privacy Policy

Gadder AS is the data controller for the processing described here. This means that we determine the purposes and means of the processing. Our contact details appear at the bottom of this page.

If a business customer uses Proff under a separate agreement, the agreement and any applicable data processing agreement may define how the roles are divided between the customer and Gadder.

The personal data we process depends on how you use Gadder. For standard registration in Privat, first name, last name, email address, phone number, password, and acceptance of the Terms of Use are required. We cannot create a standard account without this information. Signing in with Vipps or Google is optional. In the contact form, your name, email address, and message are required so that we can respond; company and phone number are optional. Marketing preferences are optional wherever they appear.

You must provide an address and the building information marked as required in the analysis flow so that we can calculate an energy plan. Connecting Elhub, uploading documents, using AI chat, sharing a plan, and selecting a supplier or bank are optional features. If you choose not to use one of these features, you lose only that specific additional feature.

Do not enter health data, political or religious beliefs, trade union membership, biometric or genetic data, data concerning your sex life, or other special categories of personal data in free-text fields, AI chat, drawings, or documents. Gadder does not need this information to provide its services.

We receive most data directly from you. When you ask us to build an energy or building model, we may also retrieve data from public registers, such as Kartverket and Elhub, and from Norwegian and international providers of map, property, building, and solar irradiance data, depending on the feature you select. You can ask us which sources were used for your home.

Address searches on the Privat page on gadder.no are sent directly from your browser to the Norwegian Mapping Authority's address service. In Privat, address searches go through Gadder's servers to the same service. The Proff address search and 3D demo send requests through Gadder's servers to services that provide address data and building geometry. These providers may receive your IP address and technical request data.

We associate each processing activity with a specific purpose and a valid legal basis under the General Data Protection Regulation (GDPR).

When you use AI chat, document analysis, floor plan analysis, or image generation, the content you choose to use is sent, together with the necessary home or building context, to our AI service. It runs in our own, isolated environment with our cloud provider. We control what is sent there. It only happens when you use the feature, and only with what the feature needs. Files you share with us are sent to the same environment.

Our AI service and file storage are located in data centers in Norway. What is stored there, such as uploaded files, is encrypted, and we can delete it at any time. The language models are operated by the cloud provider under a data processing agreement. The company that developed the models has no access to prompts, responses, or files, and they are not used to train or improve the models.

Some models use the cloud provider's global capacity. In that case, the response itself may be computed in a data center outside Norway, while stored data stays in Norway. AI chat conversation history is stored in Gadder's own systems, not in the AI service. To detect abuse, the cloud provider checks requests automatically. Flagged requests may be stored in Norway and reviewed by authorized employees of the provider in the EEA.

The purpose is to provide the analysis or response you request. The legal basis is performance of a contract under Article 6(1)(b), or Gadder's legitimate interest in providing a feature to a business customer under Article 6(1)(f). AI outputs are suggestions and decision support; they are not used on their own to make decisions that produce legal effects or similarly significantly affect you.

We do not allow Gadder's own data to be used to train a provider's general-purpose models without a separate assessment and notice to the affected data subjects. Only upload documents that you have the right to use, and remove names, contact details, and other personal data that is not necessary for the analysis.

We do not sell personal data. We may give limited access to service providers that support our operations, email, customer support, payments, data storage, analytics, and security. They may process personal data only on our instructions and under a data processing agreement where required.

Potential recipients are providers of cloud services and data storage, AI services, email delivery, website analytics, payments and login, and providers of map, address, property, building, and energy data. If you log in or pay with Vipps, or log in with Google, they receive the information needed for that. Data is shared only with the providers required for the feature you select. Contact us if you would like an up-to-date list of our providers.

We share information about you and your home with energy advisors, suppliers, or banks only when you actively request it or when sharing is necessary to perform a contract you have entered into. We may also disclose data when required by law or a valid order from a public authority.

Our files and AI service are located in data centers in Norway. Some providers may still process data outside the EU/EEA, for example when an AI model with global capacity computes a response in another country, or when a feature uses a provider with servers outside the EEA. For these transfers, we use a valid transfer mechanism, such as the EU Standard Contractual Clauses, an adequacy decision, or the EU–U.S. Data Privacy Framework where the recipient is certified. Contact us for more information about the safeguards that apply.

We retain data for as long as necessary for its purpose and then delete or anonymize it. A deletion request in Privat is processed automatically unless handled manually. Identifying home and account data is anonymized or deleted, while certain non-identifying statistical data may be retained. Backups are overwritten according to the normal rotation schedule and are not used for other purposes in the meantime.

Legal requirements, disputes, security needs, and documentation of contracts and consent may require us to retain certain data longer. The periods below apply to production data; provider backups may have a short, separate overwrite period.

The gadder.no marketing website, default without consent: Your visit is counted, including when you choose “Necessary only”. The counting stores nothing in your browser: no cookies, no local storage, no session storage. Instead our analytics provider derives an identifier on its own server as an irreversible hash of a daily salt, your IP address, your browser string and the hostname. The salt is deleted each day, after which the figures cannot be linked back to you. The price of that anonymity is that the same visitor is counted again the next day. Before transmission a page view is limited to the site address without query parameters or fragment, the path, the host and the referring domain. GeoIP enrichment, person profiles, session recording, automatic click events and custom events for forms, address selection or demos are all disabled. The IP address is used only in the hash computation and is not stored as an event property.

The gadder.no marketing website, if you choose “Accept analytics”: our analytics provider additionally sets a cookie that recognises your browser between visits, so we can see how many people return rather than only how many came by each day. You can return to the storage-free counting at any time by choosing “Necessary only” under “Privacy choices” in the footer. The cookie is then removed.

The product applications (Privat and Proff) are a separate setup, distinct from the marketing website. The product applications may use necessary storage for login and security. If analytics tools use cookies or similar technology, they are activated only after valid consent. See the separate Cookie Policy.

Energy calculations and recommendations are generated automatically from available data and technical models. They provide decision support and do not constitute a solely automated decision that produces legal effects or similarly significantly affects you. Banks, suppliers, and advisors make their own assessments.

Contact us to exercise your rights. We may request information needed to verify your identity. Statutory exceptions may apply.

We use technical and organizational measures to protect personal data against unauthorized access, alteration, loss, and misuse. Access is limited to people and service providers that need it.

The services are not intended for children under 16. Contact us if you believe that a child has provided personal data without a valid legal basis.

We update this policy when our processing activities or applicable rules change. The date at the top shows the latest update. If material changes affect you, we will provide appropriate notice before they take effect.