Privacy notice

Who is responsible

Higley & Sønner, organisation number 938 262 292, Hans Tanks gate 19, 5008 Bergen, Norway, is the controller for personal data used to operate Sable Research. Contact support@sable-research.com for privacy requests. Norwegian personopplysningsloven and the GDPR apply.

Information and purposes

Account and access: we use your name, email, authentication identifiers, verification state, preferences and subscription entitlements to create and secure your account and supply the service. Supabase handles authentication, including password credentials for email/password accounts. This is necessary to perform the account or subscription contract (GDPR Article 6(1)(b)). Required account details are needed for account-based services.

Billing: we receive customer/subscription identifiers, plan, interval, payment status, renewal dates and invoice references to administer access and billing enquiries (Article 6(1)(b)). Stripe collects payment credentials in checkout; our application does not collect full card numbers. Accounting information is retained where required by Norwegian bookkeeping law (Article 6(1)(c)).

Optional connections: external sign-in, Discord and Nortilus connections exchange identity/access information needed for the connection you request (Article 6(1)(b)). This can include provider IDs, profile name, email, Discord username and membership/role status. Discord can be disconnected from the billing page.

Support and security: correspondence, email-delivery records and technical logs such as request time, network address and error details help answer enquiries, investigate failures and prevent abuse. Contract support uses Article 6(1)(b); security uses our legitimate interest in protecting the service and its users (Article 6(1)(f)). You may request information about that interest assessment.

Optional marketing and non-essential tracking require a separate applicable legal basis, including consent where required. Accepting terms or reading this notice is not advertising or analytics consent. Account information is not used to calculate personalised investment recommendations.

Usage analytics

We measure page categories, successful sign-ins, approximate country, mobile or desktop device category, and site loading, responsiveness and visual stability to improve the service. Analytics is enabled by default unless you have turned it off or your browser sends a Do Not Track or Global Privacy Control signal. You can turn it off at any time using the footer control. Default settings do not constitute consent.

These records do not contain account IDs, email addresses, raw IP addresses, search terms, URL queries, company or asset selections, form entries or session recordings. A random event identifier avoids duplicate measurements; it is not a persistent reader identifier. An hourly keyed network hash is used separately to limit abuse and expires within two hours, with hourly cleanup. Country estimates can be affected by VPNs.

Only the site owner can view the application dashboard. Supabase stores event records for 30 days, followed by hourly deletion; provider backup expiry can take longer. No analytics cookie is created merely by visiting. If you change the footer setting, a first-party preference cookie remembers your choice for six months. Analytics may be incomplete when readers opt out or browsers block measurements.

Recipients and international access

Supabase supplies authentication and application data storage; Vercel supplies hosting and request processing; Stripe supplies checkout and billing and may act as merchant of record. Google/Gmail is used for transactional email where configured. These providers receive information needed for their functions.

Apple or Google receive sign-in information if you select their sign-in option. Discord processes community activity under its own terms/privacy policy. Nortilus receives identity/access information when you use its connection. A connected provider can be an independent controller for its own service, rather than solely our processor.

Infrastructure, support and authorised administration may involve access outside Norway or the EEA. Transfers requiring a GDPR safeguard must use an applicable adequacy decision or appropriate safeguards such as European Commission standard contractual clauses. Contact us for the recipients and safeguards applicable to your data and how to obtain a copy. We do not claim all processing is exclusively in the EEA.

Cookies and browser storage

The application uses authentication/session storage, short-lived cookies securing sign-in and account-linking flows, and browser storage for selected display preferences such as colour theme. Blocking essential storage may prevent sign-in or connections.

Continued browsing is not tracking consent. Non-essential cookies or similar tracking must remain disabled until any required consent is given. Essential storage needed for a service you request does not require an advertising-style consent choice.

Retention

Account/profile data are kept while needed to provide your account; cancelling billing does not itself delete the account. You may request deletion separately. After closure, retainable information is limited to outstanding transactions, complaints, security investigations and legal obligations, and is erased or anonymised when those purposes end.

Accounting documentation subject to the ordinary Norwegian five-year rule is retained for five years after the end of the relevant financial year; other statutory categories or specific legal duties can have different periods. Payment providers may have independent recordkeeping duties.

Support correspondence and delivery/security records are kept as needed to resolve the matter, demonstrate delivery or investigate abuse. Continued retention requires a documented legal or security need. Provider backups expire under the applicable backup schedule. You may request details relevant to your account.

Your rights

You can request access, correction, erasure, restriction and, where applicable, a portable copy. You can object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Requests are subject to legal conditions, including accounting-retention duties.

Email support@sable-research.com. We may request proportionate identity verification. We respond without undue delay and normally within one month. If a permitted extension is needed, we explain it within that month. Requests are normally free.

You can complain to Datatilsynet (https://www.datatilsynet.no/om-datatilsynet/kontakt-oss/klage-til-datatilsynet/) or your competent local authority. Access is updated automatically from payment/entitlement status; ask support to review an incorrect access decision. This is not automated investment suitability assessment.

Material changes to how we use personal data will be explained as required before new processing begins. The date on this notice identifies this version.