The Key

Privacy Policy

Last updated: 21 October 2026

This is a translation. The Norwegian (Bokmål) version applies in case of any conflict.

This policy explains how we process personal data when you use the-key.no, buy books or art posters, get the free first chapter or use an account in the Live Art gallery.

"We" means the seller and controller described below.

1. Controller and contact

  • Website: the-key.no
  • Email for privacy and customer service: [email protected]
  • Seller and controller: Amund Mortensen, a private individual. No organisation number is registered.

We have not appointed a data protection officer.

2. What data we process, why, and on what legal basis

2.1 Purchases (e-book, hardcover and art posters)

  • Data: name, email address, country and possibly postcode of your payment card, shipping address (physical goods only), what you bought, price, currency, time, and order and payment references from Stripe. For e-book purchases we also record the time of your consent to immediate delivery. We do not receive your card number – Stripe handles it.
  • Purpose: to complete the purchase, deliver the e-book (download link and receipt by email), ship physical goods, and handle customer service, complaints and withdrawals.
  • Legal basis: contract, GDPR Article 6(1)(b).
  • Bookkeeping: Sales documentation must be kept under the Norwegian Bookkeeping Act. Basis: legal obligation, Article 6(1)(c).
  • Retention: Order data that forms part of the accounting records is kept for 5 years after the end of the financial year (Bookkeeping Act section 13). Data not needed for bookkeeping (e.g. shipping address and correspondence) is deleted no later than 2 years after delivery, when the complaint period has expired.

2.2 Free first chapter and news about the book

  • Data: email address, time of your consent, language, personal download link and number of downloads.
  • Purpose: to send you the first chapter and occasionally send news about the book. The consent in the form covers both.
  • Legal basis: consent, Article 6(1)(a). You can withdraw consent at any time using the unsubscribe link in every email or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.
  • Retention: The download link is valid for 30 days and for a maximum of 5 downloads. Your email address is kept until you unsubscribe or withdraw consent. After you unsubscribe we keep only the address marked as unsubscribed, with the times of consent and unsubscription, for up to 3 years, so that we do not email you again and can document the consent. You can ask us to delete it sooner.
  • The data is stored in a database (Supabase) that we run ourselves on our own server in Norway. Emails are sent from our own mail server (notify.the-key.no).

2.2 Live Art gallery account

  • Data: email address and password (stored only in hashed form), or – if you sign in with Google – name, email address and profile picture from your Google account. If you have a subscription, also subscription status and payment references from Stripe.
  • Purpose: to create and operate your account and give you access to the gallery.
  • Legal basis: contract, Article 6(1)(b).
  • Retention: as long as you have an account. When you ask for deletion, the data is deleted within 30 days, except copies in backups, which are deleted at the next rotation (see 2.5), and data we must keep under the Bookkeeping Act. Accounts are not deleted automatically for inactivity; you can ask for deletion at any time.

Data from Google: We use the data we receive from Google (name, email, profile picture) only to sign you in and display your account. We do not use it for advertising, do not sell it and do not transfer it to others, unless necessary to provide the service, required by law or you have consented. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.2 "Create your vision" in the gallery

The text you write to find works matching your vision of the future is processed by an AI model running on our own server in Norway. The text and the matches are stored in our database to improve the selection, but without your name, email, account or IP address. Please do not enter personal data in the field. Basis: legitimate interest (Article 6(1)(f)).

2.2 Security, operations, logs and backups

  • Data: IP address, time, requested pages, browser type and similar technical data in server logs and at Cloudflare, as well as backups of the databases.
  • Purpose: to keep the website available and secure, monitor operations, detect and prevent abuse and fraud, and restore data after failures.
  • Legal basis: legitimate interest, Article 6(1)(f). Our interest is a secure and stable service. We have concluded that this does not override your privacy, because the data is limited, used only for this purpose and kept for a short time.
  • Retention: server logs for up to 30 days; nightly backups for 30 days before they are deleted. Monitoring and backups run on our own infrastructure in Norway.

2.2 Customer service and enquiries

  • Data: what you write to us and your contact details.
  • Purpose and basis: to answer your enquiry – contract (point (b)) when it concerns a purchase, otherwise legitimate interest (point (f)).
  • Retention: 12 months after the matter is closed, unless it forms part of the accounts or a complaint case.

3. Who we share data with

We never sell personal data. We share data only with:

  • Stripe (payments and Stripe Checkout): processes payment and buyer data. Stripe acts partly as our processor and partly as an independent controller, including for fraud prevention and its own legal obligations. See Stripe's privacy policy.
  • Cloudflare (CDN, DNS, security and tunnel in front of the website): processes traffic data such as IP addresses as our processor.
  • Google (only if you choose "Sign in with Google"): Google handles the sign-in under its own terms and sends us your name, email and profile picture.
  • Google Fonts: The website loads fonts from Google. Your browser then sends your IP address to Google. Google Fonts does not set cookies.
  • Gelato (printing and delivery of art posters): receives your name and shipping address to print and ship the poster.
  • Shipping provider (hardcover only): receives your name and shipping address to deliver the parcel.
  • Accountant and public authorities, where necessary for the accounts or required by law.

The website, the databases (including Supabase) and the mail server run on our own server in Norway.

4. Transfers outside the EU/EEA

Stripe, Cloudflare and Google may process data outside the EU/EEA, including in the USA. These providers are certified under the EU–US Data Privacy Framework, and their data processing terms also include the European Commission's standard contractual clauses. Contact us if you would like to know more.

5. Your rights

You have the right to:

  • access the data we hold about you,
  • have inaccurate data rectified,
  • have data erased when we no longer need it or have no basis for keeping it,
  • request restriction of processing,
  • receive data you have given us in a machine-readable format (data portability),
  • object to processing based on legitimate interest,
  • withdraw consent at any time.

Send your request to [email protected]. We reply within one month. We may ask you to verify your identity. Please note that we cannot delete data we are required to keep under the Bookkeeping Act.

6. Complaints

You can complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe we process data in breach of the rules. See datatilsynet.no. We appreciate it if you contact us first.

7. Cookies and local storage

We use only necessary cookies and local storage:

  • Login/session in the Live Art gallery,
  • Language choice (stored in your browser),
  • Stripe Checkout, to complete payment securely and prevent fraud,
  • Cloudflare, for security and protection against attacks.

We do not use cookies for advertising or analytics, and we do not use analytics tools. Necessary cookies do not require consent.

8. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling. (Stripe may use automated fraud checks during payment; see Stripe's privacy policy.)

9. Children

The service is not directed at children under 13. Children under 13 should not create a Live Art account or sign up for emails. If we learn that we hold data about a child under 13, we will delete it.

10. Security

We use encrypted connections (HTTPS), store passwords only in hashed form, restrict access to the data and take nightly backups. No solution is completely risk-free, but we will notify you and Datatilsynet of serious breaches where required by law.

11. Language

The website is available in several languages. In case of conflict between language versions of this policy, the Norwegian (Bokmål) version applies.

12. Changes

We may update this policy. The date at the top shows when it was last changed. For material changes we will notify you on the website or by email if we have your address.