Privacy policy

Data controller

Avent Digital AS (org. no. 915 920 934) is the data controller for personal data processed via avently.no. Contact us at kontakt@avent.no or +47 47 28 30 01.

What personal data we process

When you submit the contact form, we process your name, company (optional), email address, phone number (optional) and the content of your message. For ordinary visits, IP address and technical data are processed briefly in our hosting provider's operational logs. We use no third-party analytics or tracking tools; we count page views and steps ourselves, without cookies and without identifiers that follow you between visits (see “Visitor statistics and measurement”).

If you build a website on /start without an account, we look up the business in the Norwegian Central Coordinating Register for Legal Entities and use the public information from there, together with what you write about the business yourself, to create the draft. We only ask for your email address once you choose to keep the website.

Purpose and legal basis

The data is used to answer and follow up your enquiry. The legal basis is GDPR Article 6(1)(b) (steps prior to entering into a contract) and 6(1)(f) (legitimate interest in answering enquiries). We do not send newsletters or marketing without separate consent.

Newsletter

If you subscribe to our newsletter, we process your email address to send you articles and insights from Avent Digital. The legal basis is consent (GDPR Article 6(1)(a)), given through double opt-in — you must confirm your subscription by email before anything is sent. Delivery is handled by our data processor Resend. Every newsletter contains an unsubscribe link that takes effect immediately, and once unsubscribed you receive no further emails. Unconfirmed sign-ups are deleted in periodic reviews.

Customer account on the platform

If you are a customer, we process your contact details (name, email, phone, company, organisation number and billing address) to deliver the service, give you access to your website and invoice you. The legal basis is contract (GDPR Article 6(1)(b)), and for accounting data a legal obligation. If you pay by card, the card transaction itself is handled by Stripe — we never see the card number, only status, amount and invoice. If you pay by invoice, the data is processed in our accounting system. We also store sign-in and security events (time, sign-in method and the IP address only in pseudonymised form) and a log of emails sent, for security and troubleshooting. Our sign-in service (Supabase Auth) also keeps a technical log of sign-ins with email and IP address; it is deleted after the same 90 days, and when the account is deleted. The legal basis for this is legitimate interest in securing the service (GDPR Article 6(1)(f)).

If you edit a website at the same time as others who have access to it, the editor shows your name and email address to them while you are active, so you do not overwrite each other. This indicator is deleted automatically within a day after you finish.

Enquiries on customers' websites (we are the processor)

If you submit a contact form on a website built with Avently, the business owning that website is the data controller — not us. We store and forward the enquiry on their behalf as a data processor, governed by a data processing agreement. Such enquiries are never used for our own purposes and are not part of our customer records. For access or erasure, contact the business in question — we assist them.

Customer records and follow-up

We keep an internal contact register for our own enquiries: the contact form on avent.no, the free visibility check, guide downloads, waiting list, newsletter and customer accounts. It gathers the dialogue in one place, with notes and status, so we can follow up. The legal basis is legitimate interest (GDPR Article 6(1)(f)). You may request access or erasure at any time.

The AI check

If you use the AI check at avently.no/ai-sjekk, we store the address you checked (without query string and fragment), the domain and the result, and, if we find the business, its organisation number and name from the Central Coordinating Register for Legal Entities. We do not store IP address, email or browser information (User-Agent) with the check, and we do not ask for your email. The result gets a random address that is not listed anywhere public, is marked so that search engines should not index it, and is deleted automatically after 30 days. To prevent abuse, we count how many checks come from the same IP address, only in hashed form and only for a short time window (see Upstash under “Data processors and sharing”).

The check is fetched by our crawler, AventlyBot, which reads robots.txt first and respects it. It only fetches the address being checked, robots.txt, llms.txt and the sitemap, and sends no cookies. Our measurement gets its own steps for the check (started, completed or failed, and on to preview) with the outcome (scored, stopped or which error), but never the domain, the address or the score itself. The legal basis is legitimate interest in offering and improving the tool (GDPR Article 6(1)(f)). If it is your website that has been checked, you can ask for the result to be deleted sooner: email kontakt@avent.no with the link.

Artificial intelligence (AI)

The platform uses AI from Anthropic to generate and edit website content, translate between Norwegian and English, and suggest SEO improvements. When a website is created, the business information you provide — including contact person, phone, email and address — is sent to Anthropic to produce the content. Content is not used to train AI models. We never send contact form enquiries or our customer register to AI services.

Data processors and sharing

We do not sell or share your data. We use these processors: Vercel (hosting and operations), Supabase (database and sign-in), Resend (email delivery), Anthropic (AI processing of content), Stripe (payments, when card payment is enabled), Upstash (limiting the number of requests to prevent abuse — IP addresses are only processed in hashed form, in the EU/Ireland) and a dedicated server within the EEA for backups. On customer websites, Microsoft Clarity may additionally be used for visitor analytics, but only where the site owner has enabled it and the visitor has consented. Data processing agreements are in place. Data is otherwise only disclosed where required by law.

Where is the data stored?

Our database is hosted by Supabase in the EU (Ireland). The platform runs on Vercel in the EU: functions in Dublin, with a delivery point (CDN) in Stockholm. Backups are stored on a dedicated server within the EEA. Core operations therefore take place within the EEA. Some providers — in particular Anthropic and Resend — may process data in the United States. Such transfers rely on a valid mechanism: the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (SCC).

Retention

Deletion is automated, not just periodic: enquiries and visibility checks are deleted after 24 months, results from the AI check after 30 days, sign-in and security events after 90 days, the email log and measurement data points after 12 months, sign-ups never confirmed after 30 days, and drafts from /start that nobody keeps after 7 days. If the dialogue leads to a customer relationship, necessary information is kept for its duration. Accounting records are retained per the Norwegian Bookkeeping Act (5 years), and unsubscribed addresses are kept on a suppression list so we do not email them again.

Visitor statistics and measurement

Customers on a paid plan see visitor numbers for their own website in the customer panel. The figures are pure aggregates: views per day, language and referring domain. No IP address, cookie, device ID or other identifier is stored, so the statistics cannot be traced back to individuals. This is also why the websites need no consent banner.

On avently.no we count, ourselves and without cookies or identifiers that follow you between visits, views of the marketing pages and which steps are reached when a website is built on /start. For each data point we store only the step and time, the page type and language of the marketing page, the campaign source from the link (utm parameters or partner code), the domain that linked here (never the full address) and, once you have chosen a business, a broad industry category derived from its industry code. When a website is built, we also store which template was chosen and how long the build took, and when you keep it, whether the email address already had an account and whether the step was carried out by us. We do not store IP address, search text, organisation number, name or email in this measurement. To see how many move on from one step to the next, a random journey ID is used that exists only in the memory of the browser tab and disappears when you close it. Signed-in visitors are not counted.

If you keep a website, later steps — for example setting the website live — are linked to that website, so we can see which channels actually bring customers. The legal basis for this measurement is legitimate interest in improving our service and marketing (GDPR Article 6(1)(f)). Data points are deleted automatically after 12 months, and the link to the website is removed when the website is permanently deleted.

Cookies

avently.no sets no cookies for tracking or analytics, and the measurement above uses none. Only strictly necessary cookies are set: login cookies when you sign in to the administration tool (including one that remembers that the browser has signed in to the account before, so the protection against password guessing does not lock you out), and the cookie “av-utkast” when you have built a website on /start without an account. “av-utkast” gives your browser access to exactly your draft for up to 7 days, is removed when you keep the website, and is not used for measurement. The Norwegian Electronic Communications Act § 3-15 requires consent for storing or accessing information on your device where this is not strictly necessary for the service you have requested. The measurement stores nothing on your device and reads no cookies; it only sends the address of the page you are viewing and the domain that linked here — the same information your browser provides when the page loads — to our own server. No consent banner is therefore shown.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Contact us at kontakt@avent.no — we respond without undue delay and within 30 days at the latest.

Complaints

If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (datatilsynet.no). We appreciate you contacting us first so we can put things right.