1. Data Controller
Norbites AS ("Scoutr") is the data controller for personal data processed in connection with use of the Scoutr platform and the website scoutr.no.
Contact: personvern@scoutr.no or hello@scoutr.no
2. Personal Data We Collect
2.1 Account Information
Name, email address, company name, and organization number when you register.
2.2 Usage Data
Information about how you use the platform, including login time, page views, features used, and actions performed. We use this for operations, security, abuse prevention, and product improvement.
2.3 Business Data
Company data from public registers such as the Norwegian Register of Business Enterprises, contact information for business contacts, public role information, and the content of emails and messages sent through the platform. This data is processed on behalf of the customer. See our Data Processing Agreement.
2.4 Google Gmail and Calendar
If you connect your Google account, Scoutr uses Gmail access to understand the status of relevant business conversations, detect replies, show thread context, and send follow-ups from the connected mailbox. Google Calendar access is used to read availability and create or update meetings when a conversation leads to a scheduled meeting.
Google data is used only for Scoutr's autonomous sales execution, including conversations, follow-up, and meeting coordination. We do not sell Google user data, use Google data for advertising, or use Google data to train general models. You can disconnect your Google account in Scoutr at any time, or revoke access in your Google account.
Scoutr's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Google data is shared only with subprocessors when necessary to provide visible user-facing Scoutr features, such as conversation history, follow-up, email sending, and meeting coordination.
Scoutr employees or contractors do not read Gmail content or calendar data unless this is necessary for assistance you explicitly request, troubleshooting, security, abuse prevention, or legal obligations.
2.5 Microsoft Outlook and Calendar
If you connect your Microsoft account, Scoutr uses email and calendar access for similar purposes as the Google integration: sending and reading relevant business messages, detecting replies, showing thread context, reading availability, and creating or updating meetings when a conversation leads to a scheduled meeting.
Microsoft data is used only for user-facing Scoutr features, such as conversations, follow-up, and meeting coordination. You can disconnect your Microsoft account in Scoutr at any time, or revoke access in your Microsoft account.
Scoutr employees or contractors do not read Microsoft email content or calendar data unless this is necessary for assistance you explicitly request, troubleshooting, security, abuse prevention, or legal obligations.
2.6 LinkedIn
If you connect LinkedIn through Scoutr, Scoutr uses the access to read relevant conversations and send LinkedIn messages on behalf of you or your company within the playbooks you have activated. This is used to understand conversation status, detect replies, show thread context, and follow up with prospects.
LinkedIn data is used only for user-facing sales and conversation features in Scoutr. We do not use LinkedIn data for advertising, sell LinkedIn data, or use LinkedIn data to train general models. You can disconnect the LinkedIn integration in Scoutr at any time.
Scoutr employees or contractors do not read LinkedIn conversations unless this is necessary for assistance you explicitly request, troubleshooting, security, abuse prevention, or legal obligations.
2.7 Payment Information
Payment information is handled by Stripe and is never stored on our servers. We store only the Stripe customer ID and subscription status.
3. Purposes of Processing
- Provide and operate the Scoutr platform
- Administer user accounts and subscriptions
- Improve the product using usage data and aggregated analytics
- Prevent abuse, spam, security incidents, and channel policy violations
- Communicate with you about the service, including operations and billing
- Comply with legal obligations, such as accounting and tax requirements
4. Legal Basis
- Contract (GDPR art. 6(1)(b)): Processing necessary to perform our agreement with you and provide the service.
- Legitimate interest (GDPR art. 6(1)(f)): Operational reliability, abuse prevention, product improvement, and processing publicly available B2B information where the privacy impact is assessed as limited.
- Legal obligation (GDPR art. 6(1)(c)): Accounting and tax requirements.
- Consent (GDPR art. 6(1)(a)): Email marketing and non-essential analytics or tracking where consent is required.
5. Sharing of Data
We share personal data only with:
- Supabase (database): EU hosting. Data Processing Agreement in place.
- Stripe (payments): PCI-DSS certified. Processes payment data only.
- OpenAI (AI processing): Data is not used for model training. Data Processing Agreement in place.
- Google (Gmail/Calendar): Used only when you connect your Google account for conversations, follow-up, and meeting booking.
- Microsoft (email/Calendar): Used only when you connect your Microsoft account for corresponding email and calendar features.
- Unipile (LinkedIn/email): Provides message delivery infrastructure. Data Processing Agreement in place.
- Resend (email notifications): Sends product notifications and Scoutr Pulse on our behalf.
- Firecrawl (website fetching): Used when you ask Scoutr to fetch text from websites to build a knowledge base.
- Google Analytics: Used for high-level website traffic analytics where enabled and where a legal basis exists.
- Railway (hosting): Infrastructure in the EU region.
We never sell personal data to third parties.
6. Retention and Deletion
Account data is stored as long as you have an active account. When an account is deleted, personal data is removed within 30 days, except data we are legally required to retain, such as invoice data retained for accounting purposes.
Business data, including leads and conversations, is deleted together with the account or upon request.
When you disconnect your Google account, new access to Gmail and Calendar stops. Conversation data, thread context, and meeting information already synchronized into Scoutr is deleted together with the account or upon request within 30 days, unless we are legally required to retain certain information for longer.
7. Your Rights
Under the GDPR, you have the right to:
- Access: Receive an overview of data we process about you.
- Rectification: Correct inaccurate information.
- Erasure: Request deletion of your data.
- Data portability: Receive data in a machine-readable format.
- Objection: Object to processing based on legitimate interest.
- Complaint: Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
Contact us at personvern@scoutr.no or hello@scoutr.no to exercise your rights.
8. Cookies
We use technically necessary cookies for login, security, and session management. We may also use analytics tools, such as Google Analytics, to understand traffic and improve the website. Non-essential cookies and similar tracking are used only where we have a valid legal basis, including consent where required.
We do not use advertising cookies to sell personal data or build advertising profiles.
9. Changes
We may update this Privacy Policy. Material changes will be notified by email or in the platform.