Privacy Policy – Envra

Effective date
Last updated

1. Introduction

Envra AS processes personal data when you contact us, visit our websites, create an account, use our services or otherwise use the Envra platform.

This Privacy Policy describes the personal data we process, why we process it, the legal bases we rely on, how the data is protected, how long it is retained and the rights you have.

This Privacy Policy applies when Envra AS is the controller, including in relation to visitors to Envra’s own websites, users of the Envra platform, customer contacts and individuals who communicate with us.

When Envra processes analytics and visitor data on behalf of a customer, the customer is normally the controller and Envra is the processor. Information about such processing should primarily be provided in the privacy policy of the website or service you visit. Envra assists the customer in safeguarding data subjects’ rights in accordance with the Data Processing Agreement.

2. Roles and responsibilities

Envra as controller

Envra is the controller for data relating to:

  • account and user administration

  • subscriptions and payments

  • support and customer communication

  • security and abuse prevention

  • onboarding and communication

  • our own websites and services

  • legal acceptance of the Terms and Privacy Policy

Envra as processor

When customers use Envra for analytics, tracking and reporting on their own websites or services, Envra processes data on behalf of the customer.

In such cases, the customer is normally the controller, while Envra is the processor.

3. What personal data do we process as controller?

Depending on how you use Envra, we may process the following categories of personal data:

  • name, email address, telephone number, address, country and language
  • customer number and other account identifiers
  • company information, organisational affiliation, role and access level
  • account, login and authentication information
  • user settings and profile information
  • payment, invoice and subscription information, including organisation/VAT number, invoice references, currency and references from the payment provider
  • information about trial periods, subscriptions, cancellations and account status
  • websites, domains and web addresses registered or submitted for analysis
  • reports, analysis results and information about the use of Envra’s services
  • IP address, user agent, browser, operating system and device information
  • random visitor and session identifiers
  • page views, clicks, searches and other usage events
  • referral data, UTM parameters and attribution data
  • error messages, performance data and technical information
  • activity, operational and security logs, including logins, administrative actions and timestamps
  • contact, access and support requests, including messages, comments and any attachments
  • recipient information and delivery status for reports and other service communications
  • invitations, referrals and information about customer or agency relationships
  • consents, opt-out choices and communication preferences
  • records of acceptance of the Terms, Privacy Policy and Data Processing Agreement, including the time of acceptance, document version, IP address and user agent
  • other information you voluntarily provide to us, such as profile information, attachments or contractual documents

4. Analytics and visitor data

Envra may process analytics and visitor data, including:

  • page views, date and time of visit
  • page address, hostname, page path and language
  • clicks, CTA events and other conversion events
  • form events and technical information about the form, but not the content entered in form fields
  • search terms and search events
  • scroll, duration and engagement data
  • video playback, video progress and file downloads
  • purchase and transaction events, such as transaction reference, value, currency and payment status
  • performance data and web performance metrics
  • client errors, 404 errors and other technical error data
  • referral, source and campaign data
  • device type, operating system, browser, user agent and screen/viewport size
  • IP address and geographical information derived from the IP address, such as country, region and city
  • random session identifiers and, where this is enabled and the necessary consent has been obtained, a random visitor identifier

The data is processed to provide the customer with insight into how the customer’s websites and services are used and to measure traffic, engagement, conversions, technical quality and errors.

Envra may produce aggregated statistics based on the analytics data. Envra uses such statistics for its own purposes, such as operations, security, capacity planning, statistics and further development of the service, only when the data has been anonymised in such a way that individuals cannot reasonably be identified. Otherwise, processing of personal data on behalf of the customer is carried out in accordance with the customer’s instructions and the applicable Data Processing Agreement.

5. Purposes

We process personal data for the following purposes:

  • to create and administer user accounts, customers, websites and organisational affiliations
  • to provide the features and services activated or requested by the customer or user
  • to collect, calculate, present and deliver analyses, reports and recommendations
  • to authenticate users and administer roles, permissions and access rights
  • to detect, prevent, investigate and address abuse, fraud, security incidents and unauthorised access
  • to monitor technical operations, capacity and availability and to diagnose and correct errors
  • to respond to contact, access and support requests and follow up on the customer relationship
  • to conduct onboarding and send necessary information about accounts, services, subscriptions, reports, security and operational matters
  • to administer trial periods, subscriptions, payments, invoicing, credits and cancellations
  • to administer customer, agency, invitation, referral and commission relationships
  • to document acceptance of the Terms, Privacy Policy, Data Processing Agreement and other agreements
  • to document consents, opt-out choices and communication preferences
  • to improve existing features, user experience, security, operations and performance based on service usage, technical measurements, error reports and feedback
  • to send marketing communications and offers where we have a valid legal basis for doing so
  • to comply with legal obligations, including bookkeeping, accounting and documentation requirements
  • to establish, exercise or defend legal claims

6. Legal bases

We process personal data on the following legal bases:

Contract

Where the processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Legal obligation

Where processing is necessary to comply with requirements under accounting, bookkeeping or other legislation.

Legitimate interests

Where processing is necessary for secure operations, abuse prevention, technical stability, logging, support and improvement of the service.

  • Security and abuse prevention: Envra has a legitimate interest in protecting the platform, customers and users against unauthorised access, fraud, abuse, attacks, service disruptions and other security incidents. For this purpose, we may process login information, IP addresses, user agents, security events and relevant activity logs.
  • Technical operations and stability: Envra has a legitimate interest in ensuring that the service is available, stable and technically reliable. For this purpose, we may process technical logs, error messages, performance data and information about devices, browsers and usage events in order to detect, diagnose, correct and prevent errors and capacity problems.
  • Support and follow-up: Where the processing is not necessary to perform a contract, Envra has a legitimate interest in responding to enquiries, resolving problems, following up on matters and documenting communication with customers, users and others who contact us.
  • Improvement of existing services: Envra has a legitimate interest in understanding how existing features are used and perform so that we can improve usability, quality, security, performance and stability. For this purpose, we may use limited information about service usage, technical measurements, error reports and feedback. The data is not used on this legal basis for individual marketing or for purposes incompatible with the original purpose.
  • Documentation and legal claims: Envra has a legitimate interest in documenting events and communications where necessary to establish, exercise or defend legal claims and handle disputes.
  • Customer and user administration: Envra has a legitimate interest in administering customer relationships, user accounts, access rights and necessary communication with the customer’s contacts and users where the contract has been entered into with the organisation rather than the individual user.

Before relying on legitimate interests as a legal basis for processing, we assess whether the processing is necessary, whether the purpose can be achieved in a less intrusive manner, and whether the individual’s interests, rights or freedoms override our interests. We limit the data, access to it and the retention period to what is necessary for the relevant purpose. Where possible, we use aggregation, pseudonymisation or anonymisation.

You have the right to object to processing based on legitimate interests. See the section on your rights.

Consent

Where you have consented to the processing.

7. Cookies and tracking

Envra uses cookies, localStorage, sessionStorage and similar technologies for:

  • authentication

  • session management

  • analytics and attribution

  • security and abuse prevention

  • improvement of the service

More information is available at /en/cookies.

8. Login via Google and Microsoft

When you use Google or Microsoft login, we receive information such as your name, email address and unique identifier.

We do not receive your password.

Google and Microsoft are independent controllers for their authentication processing.

9. Sharing and recipients of personal data

Envra discloses or otherwise makes personal data available to the recipients described below where this is necessary for the relevant purpose and there is a valid legal basis. The recipients used depend on the services and integrations used by the customer or user.

9.1 Providers used by Envra as controller

When Envra is the controller, we may use providers for:

  • operations, hosting, storage, backups and technical infrastructure
  • payment processing, invoicing and subscription management
  • authentication and login
  • sending necessary service communications and, where there is a valid legal basis, marketing communications
  • customer support and case management
  • generation or processing of text, images, audio and video
  • monitoring operations, errors and security

These providers process personal data under an agreement with Envra and only for the specified purposes. Some providers may also be independent controllers for limited purposes arising from law or the provider’s own services. This applies particularly to payment, authentication and integration providers.

An up-to-date list of providers, including their legal entity, service, role, purpose, data categories, processing countries and any applicable transfer mechanism, is available at /en/subprocessors.

9.2 When Envra is the processor

When Envra processes personal data on behalf of a customer, we share the data with subprocessors only in accordance with the customer’s instructions, the Data Processing Agreement and Article 28 of the GDPR.

The conditions for engaging and changing subprocessors are set out in the Data Processing Agreement. The list at /en/subprocessors constitutes the Data Processing Agreement’s current appendix of subprocessors.

9.3 Integrations activated by the customer

The customer may choose to connect Envra to external services, such as advertising, analytics, publishing, email or content providers. When the customer activates such an integration, data may be exchanged with the selected provider to perform the function requested by the customer.

The external provider may be the customer’s processor or an independent controller for all or part of the processing. The customer’s agreement and privacy terms with the relevant provider govern the provider’s own processing.

9.4 Payment providers and other independent recipients

Payment providers may process data as independent controllers where this is necessary for purposes including identity verification, fraud prevention, security, compliance with financial regulatory requirements and payment processing.

We may also disclose data to public authorities, courts, auditors, accountants, banks, insurance companies or legal advisers where the disclosure is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Envra does not sell personal data.

10. Transfers of personal data outside the EEA

Envra’s primary storage of platform data takes place in Finland. Some providers may process personal data outside the EEA.

Such transfers take place only where there is a valid transfer mechanism under Chapter V of the GDPR. This may be an adequacy decision by the European Commission, including the EU–US Data Privacy Framework for certified recipients, or the European Commission’s Standard Contractual Clauses combined with necessary supplementary measures.

Information about relevant providers, processing countries and transfer mechanisms is available at /en/subprocessors. You may contact us if you would like more information about the safeguards applicable to a particular transfer.

11. Security

We use organisational and technical security measures, including:

  • role-based access control
  • site and company isolation
  • CSRF protection
  • rate limiting
  • security logging
  • password hashing
  • monitoring and abuse prevention

Security breaches are handled in accordance with applicable law.

12. Retention periods

We retain personal data for as long as necessary for the purposes for which it was collected:

  • Account and customer data is retained for as long as the customer relationship continues. After the subscription ends, the customer has a 30-day reactivation period. Customer content, identifiers and associated resources that are not required to be retained for other reasons are then deleted or anonymised.
  • Analytics and event data is retained for the period included in the customer’s subscription. The applicable retention period is specified in the selected plan and ranges from 90 days to 10 years under the plans currently available.
  • Support requests are retained for as long as necessary to handle the matter, follow up on the customer relationship and document any claims.
  • Activity logs are normally retained for 180 days, security logs for 365 days and rate-limit logs for 14 days.
  • Backups are normally deleted or overwritten within 30 days.
  • Invoice, payment and accounting data is retained for as long as required by bookkeeping and other applicable legislation.
  • Agreements and records of acceptance of legal terms and consents are retained for as long as necessary to document validity, comply with legal obligations or handle legal claims.

When the retention period expires, the data is deleted or anonymised. Data may be retained for longer where this is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

13. Your rights

You have the right to:

  • access
  • rectification
  • erasure
  • restriction of processing
  • data portability
  • object to processing
  • withdraw consent

You may also lodge a complaint with the Norwegian Data Protection Authority if you believe that our processing infringes applicable law.

These rights apply subject to the conditions and limitations set out in the Norwegian Personal Data Act and the GDPR. If Envra is the controller, you may contact us at legal@envra.ai. We normally respond within one month. We may request information necessary to verify your identity.

If your request concerns processing carried out by Envra on behalf of a customer, you should first contact the organisation operating the website or service. Envra will assist the customer in accordance with the Data Processing Agreement.

14. Automated decision-making and profiling

As controller, Envra does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Envra may use automated processing for analytics, reporting, security, abuse prevention and recommendations. This may involve analysing or categorising usage patterns, but it is not used to make decisions about individuals’ rights, access to services or other matters with a similarly significant effect.

When Envra processes data on behalf of a customer, the service may enable the customer to analyse or segment user behaviour. The customer determines the purpose of such use and is responsible for assessing whether the processing constitutes profiling, establishing the necessary legal basis and providing information to data subjects. Envra does not make decisions about these individuals on its own initiative.

15. Contact

Envra AS
Org. no.: 937 896 131

Email: legal@envra.ai