Privacy policy

Last updated: 2026-09-29

1. Who we are

Amp Eleven AS, Bergen, Norway, is the data controller for personal data processed on amp11.no and its subdomains. For any privacy request or question, write to hello@amp11.no.

2. What we collect and why

2.1 Contact form

When you submit the contact form at amp11.no/contact, we collect and process:

• Name
• Company
• Role / title
• Email address
• Phone number (optional)
• Which stage you selected from the dropdown
• The message you wrote

Legal basis: your consent (GDPR art. 6(1)(a)) — you submit the form voluntarily so we can respond. Purpose: reading and responding to the enquiry, and internal record-keeping of the conversation. Retention: for as long as needed to serve the conversation and any follow-up, then archived or deleted per Section 5.

Submissions are delivered to us as email by Resend and posted to an internal channel in Slack. Both act as data processors for us.

2.2 Anti-abuse and rate limiting

To protect the form from bots and spam we use Cloudflare Turnstile (a bot-detection widget) and rate-limit submissions by IP address using Upstash Redis. The rate-limit key is your IP hashed to a short-lived counter; the record is discarded within minutes. Legal basis: our legitimate interest (GDPR art. 6(1)(f)) in preventing abuse of a public form.

2.3 Analytics (only with your consent)

If you accept analytics in the cookie banner, we load Google Analytics 4 and collect standard product-analytics events (page views, a few user-interaction events such as clicking a partner's email link or a footer CTA). IP is anonymised by Google before storage. We do not use analytics for advertising and have not enabled Google Signals or ad personalisation. If you decline or ignore the banner, no analytics scripts load and no events are recorded. Legal basis: your consent.

2.4 Cookies

We use the minimum set of cookies possible:

• amp11.consent — remembers your choice on the cookie banner so we don't ask on every page. Lifespan: 365 days. Necessary for the site to honour your preference; no consent required.
• _ga, _ga_<property> — set by Google Analytics only if you accept analytics. Lifespan: up to 13 months. Purpose: distinguishing unique visits.

The site itself does not set any advertising or profiling cookies. You can change your consent at any time by clearing the amp11.consent cookie and reloading — the banner will reappear.

2.5 Server logs

Our hosting provider, Vercel, keeps standard access logs (IP address, URL, user agent, timestamp) for a short window for security and reliability. Legal basis: our legitimate interest in operating and defending the site.

3. Third-party processors

We share personal data only with the processors listed below, and only for the purpose named. Each has its own privacy policy, linked below.

• Vercel Inc. — hosting, access logs.
• Resend, Inc. — transactional email delivery for contact-form submissions.
• Slack Technologies — internal team notification of contact-form submissions.
• Cloudflare, Inc. — Turnstile bot-detection on the contact form.
• Upstash, Inc. — short-lived Redis store for rate-limit counters.
• Google LLC — Google Analytics 4, only if you accept analytics cookies.
• Sanity.io — content management. Public site visitors are not identified to Sanity; the CMS only handles editorial content authored by Amp Eleven staff.

4. Google user data and OAuth-authorised access

Where an Amp Eleven application accesses your data on a Google service through OAuth, we handle that data as follows:

• We request only the scopes strictly necessary for the feature you asked for, and only after you have granted consent on Google's own permission screen.
• Data returned by Google APIs is used solely to provide the feature you initiated. We do not use it for advertising, do not sell it, and do not share it with third parties for any purpose unrelated to that feature.
• We do not use Google user data to train, fine-tune, or evaluate machine-learning or AI models.
• You can revoke Amp Eleven's OAuth access at any time from your Google account at myaccount.google.com/permissions. On revocation, we stop pulling further data and delete any copy we hold, unless a specific legal obligation requires us to keep it.
• Amp Eleven's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Retention

We keep personal data no longer than we need it for the purpose we collected it for:

• Contact-form emails — kept while the conversation is active, and archived per our internal retention rules (typically up to 24 months from the last message) unless we have entered into an ongoing engagement with you, in which case the correspondence forms part of that record.
• Rate-limit counters — deleted within minutes.
• Analytics events — retained by Google per its default GA4 retention (14 months).
• Server access logs — retained by Vercel per its own retention policy.

6. Your rights

Under the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased (right to be forgotten).
• Restrict or object to processing.
• Data portability, where applicable.
• Withdraw consent at any time — for analytics, by clearing the consent cookie; for OAuth-authorised apps, from your Google account.
• Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

To exercise any of these rights, email hello@amp11.no. We will respond within 30 days.

7. International transfers

Some of the processors listed in Section 3 are established outside the EU/EEA (United States). Where personal data is transferred to such a processor, the transfer is covered by the EU Commission's Standard Contractual Clauses or an adequacy decision (for example the EU-US Data Privacy Framework). You can request a copy of the safeguards in place for any specific transfer by writing to us.

8. Security

All traffic to and from amp11.no runs over HTTPS. Access to contact-form data, our CMS, and third-party dashboards is limited to Amp Eleven staff and protected by multi-factor authentication. We review our processor list and our access controls at least annually.

9. Children

The site is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has submitted data to us, contact us and we will delete it.

10. Changes to this policy

We will update this page when our data practices change. The "Last updated" date at the top always reflects the most recent revision. For material changes we will surface a notice on the site.

11. Contact us

Amp Eleven AS
Bergen, Norway
hello@amp11.no