Privacy Policy.

Data controller

Black Table is the data controller for personal data processed via blacktable.no. We're based in Færder, Vestfold, Norway. Our company registration is pending. Contact: post@blacktable.no.

What we collect

We only collect data you give us yourself, plus what's necessary to run the service safely.

• Booking flow (/book). Your name, email address, chosen time slot and an optional short project note.
• Contact form (/contact). Your name, email address, optional company, optional project type, and message.
• Get started form (/kom-i-gang). Project details: desired project type, budget range, existing website/domain/hosting, content status, desired structure, references, and contact information (name, email, optional phone).
• Technical data. IP address and user-agent, used briefly for rate-limiting and standard request logging at our hosting provider.
• Bot check. Cloudflare Turnstile processes browser signals to distinguish humans from bots on the booking and contact forms.
• Usage statistics. Vercel Analytics collects aggregated page views and performance data (Web Vitals) to understand which pages are used and how fast the site loads. Cookie-free, no cross-site tracking, and no identifying information about visitors.

Purpose and legal basis

We process personal data to respond to inquiries, run the booking flow, and protect the service from abuse. The legal basis is contract performance and legitimate interest (GDPR art. 6(1)(b) and (f)).

Retention

Form submissions (booking, contact, get started) are kept while the project relationship is active, then deleted on request or when accounting obligations expire (5 years after the last transaction). If a submission doesn't result in an engagement, it is deleted no later than 12 months after receipt. Rate-limit data is deleted automatically within 1–24 hours. Aggregated usage statistics from Vercel Analytics contain no personal data and follow Vercel's standard retention policy. Our hosting provider retains request logs per their standard policy (about 30 days).

Third-party services (sub-processors)

We use the following services to run blacktable.no. Each processes data on our behalf under a data-processing agreement or standard EU contractual clauses.

• Supabase. Database for booking data and project records. EU region.
• Vercel. Hosting, request logs, and cookieless usage analytics (Vercel Analytics).
• Google Workspace. Calendar integration for booking; sends the customer the invitation email with the Meet link.
• Cloudflare. Turnstile bot check on forms.
• Upstash. Short-lived cache for rate-limiting (EU region).

Transfers outside the EEA

Some of the third-party services we use (Google Workspace, Cloudflare, Upstash, Vercel) may transfer data to the United States. These providers comply with the EU Commission's Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework. You have the right to receive information about the safeguards used. Contact us at post@blacktable.no for details.

Cookies and browser storage

We use no tracking cookies and no third-party analytics. Browser storage is limited to:

• bt-cookie-consent. A flag in localStorage that remembers you've read this banner. Contains no personal data.
• cf_chl_*. Strictly necessary cookies set by Cloudflare Turnstile during the bot check on the booking form.

Your rights

You have the right to:

• Access the personal data we hold about you
• Correction of inaccurate data
• Deletion of your data
• Restriction of processing
• Data portability: delivery in a common format
• Object to processing
• Lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no)

To exercise these rights, email post@blacktable.no. We will respond within 30 days. You can also lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no).

Changes to this policy

We update this policy as needed. The date at the top shows when it was last changed.