This policy explains how Sapply AS (Norway, org. no. 935 038 278) handles personal data in naits. Questions: privacy@sapply.io.

Two roles

  • For naits users (sellers and their team) and for people who use our website, the checker or the waiting list, we are the controller.
  • For sellers' clients (the people who receive, sign and pay agreements), the seller is the controller and we are the processor. We follow the seller's instructions under our data processing agreement (/dpa). If you are a seller's client, you can also contact the seller directly.

What we store

naits users:

  • Name, e-mail address, password (stored only as a secure hash, or handled by Google if you sign in with Google), language choice.
  • Company details: company name, org. number, VAT number, address, bank account, Peppol ID, logo.
  • What you create: agreements, payment plans, invoices, reminder settings, and a log of events (sent, signed, paid).
  • Technical data needed to keep you signed in and the service secure.

Sellers' clients:

  • Name, e-mail address, company name and org. number, address and title if the seller adds them.
  • At signing: the name typed as signature, the time, time zone, IP address and device / browser information, and a fingerprint (SHA-256) of the signed document. These go into the signing certificate.
  • Signing codes, stored only as secure hashes and valid for 10 minutes.
  • Payment status for each payment in the plan. Card details are handled by Stripe — we never see or store them.

Website, checker and waiting list:

  • E-mail address, company and country if you join the waiting list or ask for checker results by e-mail (confirmed by double opt-in).
  • A hashed version of your IP address, used to limit how many lookups can be made per hour.

Why we use it

  • To provide naits under our terms (contract).
  • To keep bookkeeping records we are required to keep (legal obligation).
  • To keep the service secure, stop abuse and prove what was signed (legitimate interest).
  • To send checker results and waiting-list e-mails you asked for (consent — you can withdraw it at any time).

We don't sell personal data and we don't use it for advertising.

How long we keep it

  • Account data: while your account is open, then deleted within 90 days after it closes.
  • Agreements, signatures, signing certificates and invoices: while the seller's account is open, as they are the seller's records. Accounting documents are kept for as long as Norwegian bookkeeping law requires (generally 5 years after the end of the financial year).
  • Signing codes: expire after 10 minutes and are kept only as hashes.
  • Waiting list and checker e-mails: until you are invited, you unsubscribe, or 12 months have passed.
  • Security logs: kept for a short period, then deleted.

Who helps us (sub-processors)

  • Lovable — runs the naits application and its server functions (on Cloudflare's global network) and sends our e-mails (sign-in, agreements, signing codes, invoices, reminders).
  • Supabase — database, sign-in and file storage (agreements, signed PDFs, invoices). Hosted in the EU (Ireland).
  • Stripe — card and bank payments into the seller's own Stripe account, and payments for naits subscriptions.
  • Paddle — may be used to bill naits subscriptions.
  • Storecove — Peppol access point that delivers EHF / Peppol e-invoices.
  • Anthropic (through Lovable's AI gateway) — the optional AI agreement check and AI writing help. The agreement text you send for a check can include names and company details.

Where the data is

Our database and files are hosted in the EU (Ireland). Some sub-processors (for example Lovable, Cloudflare, Stripe and Anthropic) may process data outside the EU/EEA. When they do, we rely on the EU Commission's adequacy decisions or the EU standard contractual clauses.

Cookies and local storage

We store your sign-in session and language choice in your browser so the site works. We don't use advertising cookies.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest. Write to privacy@sapply.io. If you are a seller's client, we will pass your request to the seller and help them answer it.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no.

Changes

We'll update this page when we change how we handle personal data, and tell users by e-mail about important changes.