Privacy Policy

1. Data Controller Information

This Privacy Policy explains how Higley & Sønner (organisasjonsform: Enkeltpersonforetak, registered in the Norwegian Central Coordinating Register for Legal Entities / Enhetsregisteret, Brønnøysundregistrene), operating Sable Research ("we," "our," or "us"), collects, uses, stores, and protects your personal data when you use our website, financial modeling tools, research portal, and Discord community integrations (collectively, the "Services").

2. Legal Basis for Processing Personal Data

In accordance with the Norwegian Personal Data Act (Personopplysningsloven) and Regulation (EU) 2016/679 (GDPR), we process your personal data under the following legal bases:

• Performance of a Contract (GDPR Art. 6(1)(b)): To authenticate you, provide subscription access to our mine models and valuation engines, process transactions, and maintain your account.
• Compliance with Legal Obligations (GDPR Art. 6(1)(c)): To maintain accounting and financial transaction records as required by the Norwegian Bookkeeping Act (Bokføringsloven).
• Legitimate Interests (GDPR Art. 6(1)(f)): To maintain cybersecurity, prevent fraud, monitor system health, and improve our valuation algorithms.
• Consent (GDPR Art. 6(1)(a)): For optional communication preferences and non-essential analytical cookies (where explicitly provided).

3. Personal Data We Collect

3.1. Information You Directly Provide

• Account & Identification Data: Your name, email address, password hash, and company details.
• Billing & Payment Data: Payment card details, billing address, and tax information. All cardholder data is transmitted directly to our PCI-DSS certified payment processor (Stripe) and is never stored on our servers.
• Community Identity: Discord User ID and username when linking your account for subscriber role authorization.

3.2. Technical & Diagnostic Data

When accessing our Services, our hosting infrastructure automatically collects server logs containing:

• IP address (truncated or anonymized where appropriate)
• Browser type, operating system, and screen resolution
• Request timestamps, referring URLs, and navigation flow
• Error telemetry and session tokens

4. Third-Party Processors & Subprocessors

We engage reputable third-party service providers who process data strictly under Data Processing Agreements (DPA) compliant with GDPR Article 28:

5. Data Retention & Erasure

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active Accounts: Retained for the duration of your active subscription and account lifecycle.
• Financial & Tax Records: Retained for a mandatory period of 5 years following the end of the financial year pursuant to the Norwegian Bookkeeping Act (Bokføringsloven § 13).
• Account Deletion: Upon your request to delete your account, your profile and identity data will be permanently purged or anonymized within 30 days, subject to statutory bookkeeping retentions.

6. Your Statutory Rights (GDPR & EEA)

Under Norwegian and European privacy law, you have the following enforceable rights:

• Right of Access (Innsynsrett - Art. 15): Request a complete copy of the personal data we hold about you.
• Right to Rectification (Retting - Art. 16): Request correction of inaccurate or incomplete information.
• Right to Erasure (Sletting / "Right to be forgotten" - Art. 17): Request deletion of your data where processing is no longer required.
• Right to Restrict Processing (Begrensning - Art. 18): Request temporary limitation of processing in certain dispute scenarios.
• Right to Data Portability (Dataportabilitet - Art. 20): Receive your personal data in a structured, machine-readable format (JSON/CSV).
• Right to Object (Innsigelse - Art. 21): Object to data processing grounded in legitimate interests.

To exercise any of these rights, please email us at support@sable-research.com. We respond to all verified requests within 30 days without fee.

7. Supervisory Authority & Complaints

If you believe our processing of your personal data violates data protection regulations, you have the right under GDPR Art. 77 to file a complaint with the supervisory authority:

8. Security Measures

We employ strict industry-standard technical measures including TLS 1.3 in-transit encryption, AES-256 at-rest database encryption, row-level security (RLS) database isolation, and principle-of-least-privilege access controls.

9. Updates to this Policy

We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. Significant alterations will be notified via email or a platform notice prior to taking effect.