This policy describes what we actually store, why, for how long, and who else sees it. It describes the system as built, not as we would like it to sound.
LYT AS, organisation number 932 759 942, Sikveien 2, 1481 Hagan, Norway. Written questions and all requests under this policy: node@lyt.no.
We are established in Norway, so the General Data Protection Regulation (GDPR) applies to us as it is incorporated into Norwegian law through the EEA Agreement, together with the Norwegian Personal Data Act.
This document is published in English only. The English text is the authoritative version.
Three situations cause us to store anything about you. Nothing else on this site does.
| When | What we store | Why | Legal basis |
|---|---|---|---|
| You join the waiting list | Your email address, the language the page was in, and which form you used | So we can send you an invitation when there is capacity | Consent (Art. 6(1)(a)) — you asked to be told |
| You send someone an invitation | Your email address, the recipient's email address, the code, and whether it was used | So the invitation reaches them and is not spent twice | Consent, and our legitimate interest in preventing abuse of the codes (Art. 6(1)(f)) |
| You create an account | Your email address, a hash of your password, your language, and the organisation you belong to | So you can sign in, and so we can support the machines you rent | Performance of a contract (Art. 6(1)(b)) |
We count visits with Umami, and only if you allow it in the banner. Umami runs on our own server, so the counts never leave it. It sets no cookies and stores no IP address. Per visit it keeps the page, the browser, operating system, device type, screen size, language, and the country, region and city derived from the address at the moment of the visit. It cannot tell us who you are. The legal basis is your consent (Art. 6(1)(a)), and you can withdraw it on the cookies page.
Beyond that: no tracking pixels, no advertising network and no third-party scripts. There is no profiling and no automated decision-making. We do not buy data about you, and we do not sell or rent yours.
When you join the waiting list, the page does not tell you your position in the queue. That is deliberate: a position number would let anyone submit someone else's address and, by comparing the answer against a fresh address of their own, learn whether that person had signed up. The form would become a way to ask questions about named people.
This is the part of our design that matters most for your privacy, and it is a technical arrangement rather than a promise.
Everything we need to do to a machine is done before it is handed over. At handover the machine joins your own private network, and we are no longer on the network it sits in. After that we reach it only through what it chooses to send us: its lifetime, its state, and the billing record. We do not hold credentials to it, and regaining access is an action you take, never one we take.
We therefore do not see what you run, what you build, or what data you put on the machine. If you place personal data on a machine you rent from us, you are the controller of it and we are not a processor of it, because we have no access to process.
Two of these are different in kind, and lumping them together would misrepresent both.
A supplier we SEND something to receives it because the job cannot be done otherwise: an email cannot be delivered without an address. A supplier who HOSTS something has been sent nothing at all — they operate the machine our records sit on, the way a landlord owns the building without reading the post that arrives in it.
| Supplier | Their role | What that means in practice | Where |
|---|---|---|---|
| Resend | We send them something | The address we are writing to, and the message itself. That is the whole of it, and an email cannot be sent without it. | Primarily the United States, under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Hetzner Online GmbH | They host | Nothing is handed to them. They run the server our database sits on. Under our agreement they may not access the content, and a hosting provider that did would be in breach of it. | Germany and Finland. We keep this service in Hetzner's European data centres, so nothing leaves the EEA |
None of these suppliers may use your data for their own purposes. They act on our instructions and nothing else, under written agreements that say so. We do not sell your data, we do not share it for advertising, and we have no arrangement with anyone not named on this page.
This is the complete list as the service stands today. Stripe will join it when payment opens, and this page will say so before it does.
Nobody can pay us through this site today. There is no payment integration, and we hold no card details, no billing addresses and no payment history, because none has ever been collected.
When payment opens it will be handled by Stripe: the card number is entered into their form rather than ours, so it does not pass through our servers and we cannot store it. We will see that a payment succeeded, the amount, and the last four digits. This page will be updated on the day that becomes true, and not before.
One thing about Stripe is worth stating in advance, because it is often left out. A Norwegian company contracts with Stripe Payments Europe Limited in Ireland, and Stripe is our processor for taking the payment. But for fraud prevention, anti-money-laundering screening and know-your-customer checks, Stripe acts as an INDEPENDENT CONTROLLER under its own terms, not on our instructions. For that part we cannot answer for what they do, and their own privacy policy governs it.
| Data | Kept for |
|---|---|
| Waiting-list entries | 90 days from signup. The deletion date is written into the record when you sign up, not decided later. |
| Invitations you sent | Until the invitation is used or expires, and then as part of the account record if it led to one. |
| Account records | For as long as the account exists, and then for as long as Norwegian bookkeeping law requires us to keep the billing record — currently five years. |
| Machine and billing records | Five years, for the same reason. |
Under the GDPR you may ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing we base on legitimate interest, and ask for your data in a portable form. Where we rely on your consent, you may withdraw it at any time; withdrawing it does not undo what was lawful before.
Write to node@lyt.no. We answer within 30 days. We will not charge you for a first request, and we will not ask you to explain why.
If you think we have handled your data wrongly, you may complain to the Norwegian Data Protection Authority (Datatilsynet), Postboks 458 Sentrum, 0105 Oslo — datatilsynet.no.
Passwords are stored as hashes, never as passwords. Traffic to this site is encrypted in transit. Access to the database is limited to the people who operate the service, over an authenticated connection, and is not exposed to the public internet.
We do not claim to be unbreakable. If we discover a breach that is likely to put your rights at risk, we will tell the Norwegian Data Protection Authority within 72 hours and tell you without undue delay.
If we change this policy in a way that affects you, we will change the date at the top and, where the change is significant, tell the people it affects by email rather than relying on you to re-read the page.