Privacy at IDDS

1. Who is responsible?

Intelligent Data-Driven Solutions AS (IDDS), Norwegian organisation number 934 858 204, is the controller for the personal data we use for these purposes. Contact hello@intelligent-datadriven.solutions.

This notice covers this website and the IDDS investor room at investor.intelligent-datadriven.solutions, including access through idds-investor-room.xxlbo.chatgpt.site. Other products and partner services may have their own privacy notices.

2. Using the investor room

An “approved email address” is an address added to the room’s invitation list by an IDDS administrator. We receive it from you or the contact who arranged the invitation. You can ask us for the source of your particular address. It is not made public.

Invitation and access

We store your email address, technical user ID, access status and timestamps of access changes. The purpose is to restrict confidential material to invited recipients. Our legal basis is our legitimate interest in secure investor and partner discussions (GDPR Article 6(1)(f)).

One-time code and session

We send a code to check that you control the address. The app stores keyed hashes of the code and session token, expiry and the number of code attempts — not the plain-text code or session token in the database. The purpose and legal basis are secure access as described above.

Confidentiality agreement (NDA)

We record user ID, email, agreement version, document hash, acceptance time and expiry. Processing is necessary to enter into and perform the agreement with you (Article 6(1)(b)). Documenting the agreement and any legal claims also relies on our legitimate interest in protecting confidential information (Article 6(1)(f)). Acceptance is not consent to marketing.

Security and troubleshooting

The app uses short-lived keyed hashes of email and IP addresses to limit abuse. Access-change logs contain the administrator, affected email, action and timestamp. Hosting and email providers also process technical logs, such as IP address, browser, time, requests and delivery status. The purposes are security, delivery and troubleshooting, based on legitimate interests (Article 6(1)(f)).

Using the room is voluntary, but access requires email verification and NDA acceptance. Access depends on the invitation list and technical checks, not profiling. We do not make automated decisions about you that have legal or similarly significant effects.

The app has no behavioural analytics, advertising pixels or open/click tracking in its code emails. We do not use sign-in data for AI analysis or model training in the investor room. Changes you make to the financial scenarios are temporary in your view, not stored as a personal investor profile.

3. How long do we keep data?

One-time code: 10 minutes

The code expires after ten minutes or after use. Too many incorrect attempts can also block it.

Sign-in: up to 12 hours

A session lasts no longer than twelve hours. Signing out or revoking access ends it earlier.

Abuse prevention and access logs

Person-linked rate limits apply for up to one hour. Access-change logs are retained for 90 days. Expired codes, sessions, rate limits and older access logs are cleaned up when new codes are requested; physical deletion does not necessarily happen at the exact expiry time.

Invitation list

An address remains while access is relevant. Revocation marks the record inactive and removes active sessions and codes. Inactive invitation records are not automatically deleted. IDDS must review and manually delete them once access administration and necessary documentation no longer require them. You can ask us to remove your record.

NDA acceptance: normally three years

The acceptance record is normally kept until the agreement expires, three years after acceptance. Expired records are cleaned up when the room is used. Necessary evidence in a specific dispute may be retained separately for as long as the legal claim requires it.

Providers’ delivery logs, operational logs and backups have separate retention rules; the periods above apply to the app’s active database. Copies may remain longer for recovery, security or legal obligations. Contact IDDS for information about retention and deletion in the particular service.

4. Website, cookies and contact

The public website does not set its own cookies or use analytics or advertising tracking. Fonts and images are served from the website. Google Firebase Hosting processes technical request information to deliver and secure the site.

The investor room uses the necessary __Host-investor-session cookie to keep you signed in for up to twelve hours. It contains a random session token, not your email address. The platform may also use necessary security and sign-in mechanisms. Blocking necessary cookies may prevent sign-in.

Contact links open your own email application; nothing is sent until you send it. We use your name, address and message to respond and follow up, based on legitimate interests (Article 6(1)(f)), or steps before a contract that you request (Article 6(1)(b)). Messages are kept while the matter and necessary documentation require them. Any statutory accounting records follow accounting rules. Please avoid sending sensitive personal data.

5. Who receives the data?

Access is limited to authorised IDDS administrators and operational providers who need it for their task. We do not sell the data or share it with other investors.

• OpenAI / ChatGPT Sites provides hosting and data storage for the investor room, with subprocessors including Cloudflare. Hosted data is processed on our behalf under the Sites Terms and Data Processing Addendum. Separate platform and account data may be covered by OpenAI’s Privacy Policy. Guests do not need an OpenAI account; the owner’s separate ChatGPT sign-in is optional for the owner.
• Sweego (Mindbaz) receives your email address, code and message content for delivery, and processes delivery logs such as the receiving mail server, time and delivery result. Its terms and Data Processing Agreement describe recipient-data processing. Your own email provider receives the message to deliver it to you.
• Google / Firebase Hosting hosts the public website. See Firebase privacy information.
• Email and technical operations providers may process correspondence or necessary operational data when providing these services. Data may also be disclosed where legally required or necessary for a specific legal claim.

Processing outside the EEA

Hosting and subprocessors may involve processing outside the EEA, including in the United States. We do not promise that investor-room data is stored only in Norway or the EEA. OpenAI’s DPA describes the use of EU Standard Contractual Clauses (SCCs) or European Commission adequacy decisions for such transfers. See also OpenAI’s subprocessors. Contact IDDS for information about the transfer basis and a copy of relevant safeguards for processing that concerns you.

6. Your rights and contact

You may request access and a copy, correction, deletion or restriction of your personal data. You may object to processing based on legitimate interests. Data portability applies where its conditions are met. These rights are not absolute: necessary agreement evidence or legal claims may justify continued retention. We will explain any such reason.

Send requests to hello@intelligent-datadriven.solutions, preferably from the invited address. We may request information necessary to verify your identity. We normally respond within one month and will explain any lawful extension.

You may complain to the Norwegian Data Protection Authority, or the supervisory authority where you live or work. You do not have to contact us first.

7. Changes

The date above shows when this notice was last updated. We will provide new information before material changes in processing take effect. This notice provides privacy information; it is not a new NDA or an investment commitment.