Who is responsible
Nordkove AS (org. no. 837 347 122), Røsslyngveien 17, 9514 Alta, is the data controller for personal data on Nordkove's website and in the app. Privacy contact: privacy@nordkove.com.
What we collect
- Account: name, email, phone number (verified by SMS), profile picture and selected language.
- Bookings: dates, number of guests, prices, discounts, cancellations and refunds.
- Messages and reviews between guest and host.
- Listings: address, map location, photos, description, prices, calendar and private check-in information (shown only to guests with a confirmed booking).
- Payment: handled by Stripe. We do not store card numbers. Hosts provide payout details directly to Stripe.
- Support: conversations with the help assistant and enquiries to customer service.
- Technical: login session and necessary settings stored in the browser (see Cookies).
Why and on what legal basis
- To fulfil our contract with you (GDPR Art. 6(1)(b)): account, booking, payment, payout, messages and support.
- Legal requirements (Art. 6(1)(c)): accounting and bookkeeping.
- Legitimate interest (Art. 6(1)(f)): preventing fraud and misuse, security and improving the service.
Who we share data with
- Guest and host in the same booking: name, profile picture and necessary booking details. Phone numbers are shared only with the other party to a confirmed booking.
- Stripe: payments and payouts.
- Hosting and storage provider: database, files and login.
- Google and Apple: if you choose to log in with them.
- Email provider (Resend): receipts and notifications.
- OpenStreetMap: address searches and maps. The search is sent without a name or account.
- AI service: translation of listings, messages and reviews, and responses in the help assistant. The assistant never makes changes to bookings or payments.
- SMS provider for phone verification: Twilio Inc. (USA).
We never sell personal data.
Transfers outside the EU/EEA
Some providers may process data outside the EU/EEA. When this happens, it is done under the EU's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep data
- Account: until you delete it.
- Bookings and payments: for as long as the Bookkeeping Act requires (normally 5 years).
- Messages and support conversations: for 3 years after the last booking or the closure of a case, which is the general limitation period for claims (Limitation Act § 2).
- Closed chats with the assistant are retained for support and statistics for 12 months.
Your rights
You can request access, rectification, erasure, restriction and data portability, and object to processing. You can delete your account yourself in the account settings. Information we are legally required to retain is deleted when the retention period expires. You can lodge a complaint with Datatilsynet (datatilsynet.no).
Changes
We notify you of significant changes before they take effect.