LEGAL
Privacy Policy
Last updated: April 2026
This privacy policy describes how Streamline Marketing AS (org.nr. 935 880 742) collects, uses, stores, and shares your personal data. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven).
1. Data Controller
Streamline Marketing AS (org.nr. 935 880 742) is the data controller for personal data processed through our services and website. We have not appointed a Data Protection Officer (DPO). Questions about privacy can be directed to us at [email protected].
2. Data We Collect
We collect different categories of personal data depending on whether you use the platform as a content creator or a brand. For content creators, we collect: name, email address, phone number, date of birth, national identity number (personnummer for tax card registration, stored encrypted), bank account number, social media profiles and links, content (video and photo) submitted through the platform, device and usage data (IP address, login timestamps, usage patterns), and precise GPS location when you use the app and have provided explicit consent. For brands, we collect: company name, contact person's name, email address and phone number, billing address, company registration number, payment method, and campaign data (briefs, budgets, and performance reports).
3. Purpose and Legal Basis
We process personal data for the following purposes. On the basis of contract (GDPR Art. 6(1)(b)): to deliver platform services, manage campaigns, process payments, and provide dashboard access. On the basis of legal obligation (GDPR Art. 6(1)(c)): to comply with advance tax withholding (forskuddstrekk) and employer's national insurance (arbeidsgiveravgift) obligations under Norwegian tax law, and to maintain accounting records under the Norwegian Bookkeeping Act (bokføringsloven). On the basis of legitimate interest (GDPR Art. 6(1)(f)): for fraud prevention, security, and platform improvement. On the basis of consent (GDPR Art. 6(1)(a)): to process precise GPS location to show relevant campaigns based on geographic proximity.
4. Location Data
The app uses precise GPS positioning, including in the background, to show you relevant campaigns based on geographic proximity (geofencing). This only occurs if you have provided explicit consent to location sharing in your device settings. Location data is processed in real-time to filter campaigns and is not stored — we retain no history of your movements or previous locations. You may withdraw consent at any time by disabling location access for the app in your device settings. Disabling location access does not affect your access to the platform, but you will no longer see location-specific campaigns.
5. Minors
The platform is open to users from the age of 15. We are aware that GDPR and Norwegian data protection law afford minors special protection. We do not collect more information from minors than is necessary to deliver the service and fulfil statutory obligations. National identity numbers collected from minors for tax purposes are processed with the same encryption and protection as for adult users. Parents or guardians may contact us at [email protected] to request access to or deletion of data relating to a minor user.
6. Cookies
We use only technically necessary cookies and authentication tokens to operate the platform. These are used to keep you logged in, secure transactions, and protect against unauthorised access. We do not use analytics tools, third-party pixels, remarketing cookies, or any other tracking technologies. Necessary cookies do not require consent under the Norwegian Electronic Communications Act (ekomloven) and GDPR.
7. Data Processors and Third Parties
We use the following data processors who process personal data on behalf of Streamline: Digital Ocean, Inc. (cloud infrastructure and server operations) and Google LLC via Firebase (authentication, database, and file storage). All data processors are bound by data processing agreements requiring them to process personal data solely on our instructions and in compliance with GDPR. We do not share personal data with other third parties, except as required to fulfil statutory obligations, for example to Skatteetaten (the Norwegian Tax Administration).
8. International Transfers
Google LLC is a US company. The transfer of personal data to Google LLC via Firebase constitutes a transfer to a third country outside the EEA. This transfer is safeguarded through the EU Standard Contractual Clauses (SCCs) under GDPR Art. 46(2), which ensure an adequate level of protection for your personal data. Digital Ocean, Inc. is a US company, but we use infrastructure in the EEA region where possible. Where data is processed on servers outside the EEA, this is similarly safeguarded through Standard Contractual Clauses.
9. Retention Periods
We retain personal data no longer than necessary for the purposes for which it was collected, or as required by law. Accounting and tax data — including national identity numbers used for tax purposes and payment documentation — is retained for 5 years in accordance with the Norwegian Bookkeeping Act (bokføringsloven). Location data is processed in real-time and not stored. All other personal data, including profile data, submitted content, and campaign history, is deleted upon account closure. Data related to active disputes or legal claims may be retained until the matter is finally resolved.
10. Security
We implement technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Sensitive information — including national identity numbers, passwords, and authentication tokens — is stored in encrypted form. Access to personal data is restricted to personnel with a legitimate need. We regularly review and update our security measures. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours and affected users without undue delay, in accordance with GDPR Art. 33 and 34.
11. Your Rights
As a data subject, you have the following rights under GDPR: right of access (Art. 15) — you may request information about the data we hold about you; right to rectification (Art. 16) — you may request correction of inaccurate data; right to erasure (Art. 17) — you may request deletion, subject to the caveat that legally required data cannot be deleted before the retention period expires; right to restriction of processing (Art. 18); right to data portability (Art. 20) — you may request your data in a structured, machine-readable format; right to object (Art. 21) — particularly against processing based on legitimate interest; and right to withdraw consent (Art. 7) at any time, without affecting the lawfulness of prior processing. To exercise your rights, contact us at [email protected]. We will respond within 30 days.
12. Automated Decision-Making
Streamline's platform uses an automated quality assessment process to evaluate submitted content against the campaign brief. This process may affect payment decisions. The automated process is always supplemented by human review in accordance with GDPR Art. 22. If you wish to contest a quality assessment decision, you may do so through the appeal mechanism described in the Terms of Use.
13. Changes
We may update this privacy policy from time to time. Material changes will be communicated via the email address associated with your account at least 30 days before the changes take effect. Non-material changes take effect upon publication. The date of the most recent update is shown at the top of this policy.
14. Contact and Right to Complain
For privacy questions, to exercise your rights, or to raise concerns about our processing of personal data, contact us at [email protected]. Streamline Marketing AS, org.nr. 935 880 742, Norway. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) if you believe our processing violates GDPR or the Norwegian Personal Data Act.