Privacy Policy

Last updated: [date]

Draft — pending legal review. This page is a placeholder scaffold and has not been reviewed by a lawyer. Bracketed fields (e.g. [Company Legal Name]) must be filled in before this page is published or relied upon.

1. Who we are

The Marches of Napoleon is operated by [Company Legal Name] (org. [Norwegian org. number]), [Registered address, Norway], a company registered in Norway. We are the data controller for personal data collected through this site, within the meaning of the GDPR as applied in Norway under the EEA Agreement.

2. What data we collect

Account data: email address and authentication credentials (managed via our identity provider, Hanko), if you create an account.
Subscription/billing data: information necessary to process payments, handled by our payment processors and not stored on our own servers beyond what is needed to identify your subscription status.
Usage analytics: aggregated, cookieless page-view analytics via Plausible Analytics — no personal identifiers or cross-site tracking.
Correspondence: information you send us directly, e.g. via email or a contact form.

3. Legal basis for processing

We process personal data on the basis of: performance of a contract (providing the service you sign up for), legitimate interest (basic security and service analytics), and consent (e.g. for the newsletter, where applicable).

4. Processors and where data is hosted

All infrastructure and processors used by this service are based within the EU/EEA. We do not use any processor subject to the US CLOUD Act. Current processors:

Hetzner Online GmbH (Germany) — application hosting
Self-hosted PostgreSQL, running on our own Hetzner server (Germany) — primary database, not a third-party processor
Hanko (Germany) — authentication (passkeys, email/password)
Mollie (Netherlands) — EU subscription payments
Vipps (Norway) — Norwegian payments
Bunny.net (Slovenia) — content delivery network
Plausible Analytics (Estonia) — privacy-friendly, cookieless analytics
Ahasend (Netherlands) — transactional email
MailerLite (Lithuania) — newsletter, if subscribed

Data processing agreement references for each processor are published at /docs/dpa (internal reference, forthcoming).

5. Data retention

We retain personal data only for as long as necessary to provide the service and meet legal obligations. Retention periods per data category, and how deletion requests are fulfilled, are documented in full at /docs/dpa/data-retention-policy.md (internal reference).

6. Your rights

Under the GDPR you have the right to access, rectify, erase, or export your personal data, and to object to or restrict certain processing. You can request an export or deletion of your data from your account settings, or by contacting us at hello@[yourdomain]. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

7. Cookies

See our Cookie Policy for details on the limited cookies used by this site.

8. Contact

Questions about this policy or your data can be sent to hello@[yourdomain].