Privacy Policy for Toolcape
Last updated 4 November 2026
This is a translation. If the versions differ, the Norwegian version applies.
1. Who we are
Dyst AS, org. no. 934 222 946, Losbyveien 1, 1475 Finstadjordet, Norway ("Dyst", "we") develops and provides Toolcape. We are the controller of the personal data described in this policy. Send questions about privacy to [email protected].
2. When the business is responsible, not us
When a business uses Toolcape, the business is the controller of the data in the systems it connects and in the operations that are performed, for example email, documents and accounting. We process this data on behalf of the business under a data processing agreement.
If you have questions about such data, or want to exercise your rights, contact the business, for example your employer. Requests we receive about such data are forwarded to the business.
3. What we process, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Operating and securing the website and Toolcape | IP address, browser, requests and technical logs | Legitimate interest in operating and securing the services (GDPR Article 6(1)(f)) | As long as needed for operation and security. The data is then deleted on a rolling basis |
| User accounts and login | Name, email address, business, role and a log of logins | Legitimate interest in providing the service the business has an agreement for (Article 6(1)(f)) | As long as the account exists, and then as long as needed to document the agreement and the use |
| Documenting agreements and acceptance of terms | Name, email address, business, org. no., which terms were accepted, time and IP address | Legitimate interest in being able to document the agreement (Article 6(1)(f)) | The term of the agreement and three years after it ends |
| Personal notes and worklog in Toolcape | What you yourself store as notes and in the worklog | Legitimate interest in providing the features you use (Article 6(1)(f)) | As long as you choose in the settings, or until you delete them |
| Customer relationships and invoicing | Contact persons, invoices and payments | Legal obligation under the Norwegian Bookkeeping Act (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)) | As long as the Bookkeeping Act requires |
| Support | Requests, attachments and correspondence | Legitimate interest in helping customers and users (Article 6(1)(f)) | While the case is ongoing, and then as long as needed to follow up the customer relationship |
| Email from Toolcape | Email address and the content of the email | Legitimate interest in providing the service (Article 6(1)(f)) | As long as needed to deliver and troubleshoot the sending |
| Fixing errors | Technical data about errors | Legitimate interest in fixing errors and securing the service (Article 6(1)(f)) | As long as needed to fix the error |
| Enquiries and demos | Name, email address, business and what you write to us | Legitimate interest in answering enquiries (Article 6(1)(f)) | As long as needed to follow up the enquiry |
| Waitlist for early access | Name, work email, business, what you wanted to use Toolcape for, the language you used and the time of signup | Consent (Article 6(1)(a)) | Until you ask us to delete the signup, or until early access has ended and the data is no longer needed |
| News about Toolcape | Name and email address | Consent (Article 6(1)(a)), or for existing customers the exception in section 15 of the Norwegian Marketing Control Act | Until you withdraw your consent or opt out |
| Commission to partners | Org. no., subscription and amounts for customers a partner has referred or follows up | Legitimate interest in calculating commission (Article 6(1)(f)) | As for invoicing |
| Legal claims | The data needed in the case | Legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f)) | Until the case is closed and the claim is time-barred |
When we use data about the use of Toolcape to improve the service, we use it in anonymised or aggregated form.
4. Who we share data with
- Subprocessors that operate the service for us. The list is at toolcape.com/en/subprocessors.
- Accounting system and bank, for invoicing and payment.
- Partners that sell and follow up Toolcape: demo requests, waitlist signups and the data needed to calculate commission.
- Public authorities, when the law requires it.
- Lawyers, auditors and other advisers bound by confidentiality, when necessary.
5. Transfers to countries outside the EEA
Some of the subprocessors process data outside the EEA, in particular in the USA. The transfers are based on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. The list of subprocessors shows the basis for each of them.
6. Cookies
We only use cookies and browser storage needed for login and security, and to remember choices you make, for example the theme and how you last logged in. We do not use cookies for analytics, tracking or marketing. Cloudflare, which protects the website, may set technical cookies to stop attacks.
7. Your rights
You have the right to access the data we hold about you, and to have it rectified or erased. You can also ask for the processing to be restricted, and to receive data you have provided to us in a machine-readable format. If you have given consent, you can withdraw it at any time.
The right to object: You can at any time object to processing we carry out on the basis of legitimate interest, on grounds relating to your particular situation. You can always object to your data being used for marketing.
We respond within one month. You can complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe we process data about you in breach of the rules.
8. Automated decisions
We do not make decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you.
9. AI clients
AI clients that the business connects to Toolcape, for example Claude, ChatGPT or Copilot, are the business's own providers. What they do with the data follows from the business's agreement with them.
10. Changes
We update the policy when the processing changes. The date at the top shows when it was last changed. In case of material changes, we give notice on the website and by email to the businesses we have an agreement with.
11. Contact
Dyst AS, Losbyveien 1, 1475 Finstadjordet, Norway, [email protected].
Versions:1.0 (current)beta