Privacy policy

Last updated: 11 November 2026 · Les på norsk

This is a translation of our Norwegian privacy policy. If the two differ, the Norwegian version applies.

This policy explains what information PrisHjelpen processes when you use prishjelpen.no and PrisHjelpen in ChatGPT: what we collect, what we use it for, who receives it, how long we keep it, and what you can do yourself.

The controller is Fiducias AS (Norwegian organisation number 914 985 692), which runs PrisHjelpen. Send privacy questions to [email protected].

In short

• You can search and compare prices without an account, and we use no tracking cookies.
• An account is optional. You only need one to save products and get price alerts.
• We do not sell personal data or use it for advertising.
• You can delete your account yourself under Min konto (My account).

Visitor statistics

We keep our own visitor statistics for prishjelpen.no. They use no cookies and are not linked to user accounts.

• What we store: the pages you visit, the searches you make (search terms and filters), the products you view and the store links you click; when you press a price alert button, and whether you were logged in, whether your account was verified and whether you already had an alert on the product; when you ask for a price alert by email without being signed in, and when you save a price alert, with its type, whether it repeats and whether it was switched on from the email; the website you came from and any campaign parameters in the link; browser, operating system and device type; country, region and city estimated from your IP address; your IP address with its last part removed; and a visit ID derived from the shortened IP address and the browser, so that we can count visits without cookies.
• Why: to see which products and searches are popular, to prioritise which store pages we fetch prices from, to understand where visitors come from, and to see how many who start a price alert finish it.
• Legal basis: our legitimate interest in running and improving the service (GDPR Article 6(1)(f)).
• Who receives it: no one outside PrisHjelpen and the providers that run the service for us (see below).
• How long: 25 months. After that we replace the visits with daily figures: numbers of visits, visitors and events per country, device type and kind of source (such as "Google" or "Direct"). Search terms, addresses and visit IDs are not kept.

Clicks to online stores

When you click through to an online store, we record the click: which offer, store and product, the price and the time, with a random reference.

• Who receives it: for stores we partner with, the link goes through an affiliate network (Adtraction, Daisycon, Partner-ads or Tradedoubler). The network receives the reference and the address of the product page in the store, records the click itself with your IP address and browser information among other things, and may set its own cookies. The network and the store are independent controllers of what they collect; read their privacy policies.
• Why: PrisHjelpen may earn a commission when a click leads to a purchase. The network then tells us the order value, the commission, the network's own order number and which reference the purchase belongs to, not your name or what you bought. The network can still link the reference to you, so we treat it as personal data.
• Legal basis: our legitimate interest in being paid for the service (Article 6(1)(f)), and our bookkeeping obligation for the sales (Article 6(1)(c)).
• How long: for 25 months a sale is linked to the click and the visit it came from, and so to the product you clicked. Then the click and the visit are deleted, and the link with them. We keep sales as accounting records for 5 years after the end of the financial year, as the Norwegian Bookkeeping Act requires, without the link to the click.

User account

You can create an account with an email address and password, or sign in with Google. You can also switch on a price alert with just your email address: we email you a link, and only when you open it do you get an account and the alert is switched on. Until then we store nothing; the address, the product and the alert are encrypted in the link, which works for one day. An account without a password signs in with a link by email.

• What we store: your email address and when it was confirmed; a hash of your password if you have chosen one (never the password itself); when you sign in with Google, a fixed ID for your Google account and your email address, and nothing else from your Google profile; and for each sign-in, the time, IP address and browser information.
• Saved products and price alerts: which products you have saved, when and at what price; for price alerts, the type (automatic or target price), the target price, whether the alert repeats, when the alert was switched on or changed and the price then, and when and at what price we last alerted you.
• Why: to sign you in, keep the products you save, and send you price alerts and necessary emails (confirming your email address or a price alert, sign-in links, password reset and connecting ChatGPT). Whether an alert is sent is decided automatically from the prices and the settings you chose.
• Legal basis: our agreement with you about the account (Article 6(1)(b)).
• Your choices: you change or remove a price alert on the product page or under Mine produkter (My products), without removing the product. If you remove a saved product, its alert goes with it.
• Who receives it: Brevo sends our emails and receives your email address and the content of the email. Brevo does not store the email text itself, but keeps a log with, among other things, the recipient, subject line, time and whether the email was delivered. The subject line of a price alert names the product and the price. Google is an independent controller of the sign-in at Google.
• Email opens: the emails contain an invisible tracking pixel from Brevo. When it loads, Brevo counts that an email was opened, without linking the open to you, and sees your IP address and email client as any image on the web does. We use the figures to see that the emails arrive and are read, on the basis of our legitimate interest in price alerts and confirmations working (Article 6(1)(f)). You avoid it by letting your email client block images.
• How long: for as long as you have the account. A sign-in is kept until you sign out, reset your password or delete the account. When you delete your account, everything above is deleted from our database immediately. Emails we have already sent stay in your inbox, and Brevo's logs of them are deleted after 1 month, and the backups are replaced as described below. If you have not confirmed your email address yet, confirm it first, or write to us and we will delete the account for you.

Notifications on your device

If you turn on price alerts in your browser, we store the browser's push address and the encryption keys that belong to it, tied to your login, along with browser information. We delete them when you turn the notifications off, log out or delete your account. Notifications are delivered through the push service of your browser's vendor (Google, Mozilla, Apple or Microsoft), which receives them encrypted and cannot read their content. The legal basis is our agreement with you about the account (Article 6(1)(b)).

PrisHjelpen in ChatGPT

PrisHjelpen can be used as a plugin in ChatGPT. When ChatGPT uses PrisHjelpen for you, OpenAI sends us only what the tool needs. We do not receive your conversation, your name or your OpenAI account. This is what each tool receives and returns:

• search_products receives the search term, and optionally a price range, brand and category. Returns the search term, whether only some of the words matched, and the matching products, with prices, store links and price history.
• search receives the search term. Returns the ID, name and address of the matching products.
• get_product receives the product's ID or barcode. Returns the product, the store offers with price, stock and whether the price is old, the lowest price in the last 3 months, price history and, for a ChatGPT user, whether you have saved it.
• fetch receives the product's ID. Returns a description of the product and its prices, the address of the product page and public product details.
• save_product receives the product, the price alert you want (type, target price and whether it repeats), and the first time, your email address. Returns the saved product and alert, and when relevant, that the email address is not confirmed yet; the text of the answer may mention the email address the account uses. If we do not have your email address, the answer asks ChatGPT to ask you for it. If the address you give already has an account, we answer that we have emailed a link to that address, and save nothing until the link is used.
• unsave_product receives the product. Returns that it has been removed, and removes its price alert with it.
• list_saved_products receives nothing beyond the user ID below. Returns your saved products, their price alert settings and whether an alert has been reached.
• With every request: a user ID that OpenAI creates for PrisHjelpen and that is not your OpenAI account, and supplementary information such as language, approximate location and browser. We do not use the supplementary information, and it is filtered out of our logs. The IP address and browser information that come with every request are handled as described under Server logs; we also use the IP address to check that the request comes from ChatGPT.

The product information in the answers (name, image, prices, stores, links and price history) is public. ChatGPT shows you the answers in the conversation, and OpenAI processes them as part of your conversation. OpenAI is an independent controller of the conversation; read OpenAI's privacy policy.

• Why and legal basis: we answer searches and lookups because you ask ChatGPT to, on the basis of our legitimate interest in offering the service (Article 6(1)(f)). Saving and price alerts rest on our agreement with you about the account (Article 6(1)(b)).
• An account from ChatGPT: the first time you save a product, we create an account with your email address and link the user ID to it, so that saved products and alerts keep working next time. If an account with that address already exists, we email it a link. The user ID is encrypted in the link, which works for one day, and the connection is only made once you click it. The account is otherwise handled as described under User account.
• How long: searches and lookups are not stored beyond the server logs below. The user ID is stored on your account for as long as the account exists. Otherwise it exists only encrypted in any link we have emailed you, in the server logs, and in the abuse counter, with the retention periods below.
• Your choices: ask ChatGPT to remove saved products, or disconnect PrisHjelpen in your ChatGPT settings. Disconnecting stops new requests, but does not delete the account or the price alerts. To delete the account, sign in at prishjelpen.no (with Google, with a sign-in link by email, or by registering with the same email address) and delete it under Min konto, or write to us.

Server logs, error reports and abuse

• What we store: for each request, the IP address, time, address, parameters and browser information. Passwords, email fields and the supplementary information from ChatGPT are filtered out of form data. Free text such as search terms is logged as written, and addresses with time-limited codes (the links to confirm an email address, switch on a price alert, sign in, reset a password and connect ChatGPT) and the contents of background jobs, such as the encrypted links, may also appear in the logs. Error reports describe what went wrong and may contain the same information. Background jobs, such as sending an email, are stored with what they need, for example which account the email is for.
• Why: operations, troubleshooting and security. To stop abuse, we also count requests for 1 to 10 minutes at a time, per IP address, per user ID from ChatGPT, per account or per email address (for emails we send; the address is then stored only as a hash).
• Legal basis: our legitimate interest in a secure and stable service (Article 6(1)(f)).
• Who receives it: AppSignal monitors performance and errors for us and receives the logs. Notices of new errors are sent with Brevo to our mailbox at Google (Gmail).
• How long: on the server, logs are overwritten continuously, normally within a few hours; logs from the previous version of the app remain until the next update, and the server's backups may hold them for 7 days. At AppSignal they are deleted according to AppSignal's retention period, normally 30 days. Error reports are kept until the error is fixed, and deleted 90 days after that; we keep error notices in the mailbox for as long as we need them to fix the error. Finished background jobs are deleted after one day, failed ones after 90 days. The abuse counters expire after 1 to 10 minutes and are then removed from the cache over time, normally within 2 weeks.

Messages to us

If you write to us, we receive your email address and what you write. Email to prishjelpen.no is forwarded through Cloudflare to our mailbox at Google (Gmail). We use your message to reply and to handle your rights, on the basis of our legitimate interest in replying (Article 6(1)(f)) and our obligations under data protection law (Article 6(1)(c)). We keep the message while the matter is open, and delete it once the matter is closed, unless it is needed for a complaint or claim that has been or may be raised; then we keep it until that is settled or the deadline for raising the claim has passed.

Cookies

We only use cookies the website needs to work: one that keeps you signed in until you sign out, and one that remembers temporary choices (such as the page you were on before signing in) until you close your browser. We use no cookies for tracking or advertising. The affiliate networks may set their own cookies when you go on to an online store.

Who processes data on our behalf

• Cloudflare, Inc. (USA) sits in front of our website and our ChatGPT service: all traffic, with the IP address and the request, passes through Cloudflare, which also forwards email sent to prishjelpen.no. Norwegian visitors are normally served from Cloudflare's data centres in Norway or the EU.
• Hetzner Online GmbH (Germany) provides our servers, in data centres in the EU.
• Brevo (France) sends email.
• AppSignal B.V. (the Netherlands) monitors performance and errors.
• Google: the mailbox where messages and error notices arrive is an ordinary Gmail account. There, Google (Google Ireland Limited for users in the EEA) processes the data under Google's own privacy policy, not under an agreement with us.

Cloudflare, Hetzner, Brevo and AppSignal process the data only under a data processing agreement with us, and Google as described above. Cloudflare also keeps its own logs of the traffic, which Cloudflare keeps only as long as they are needed to deliver, secure and troubleshoot the service; Brevo's logs of sent emails are deleted after 1 month. Google (for sign-in), OpenAI, the affiliate networks and the online stores are independent controllers of what they collect themselves.

Transfers outside the EEA

We send PrisHjelpen's answers in ChatGPT to OpenAI because you ask for them. For users in the EEA, OpenAI Ireland Limited is responsible for ChatGPT; how OpenAI may transfer data onwards is described in OpenAI's privacy policy.

Cloudflare and Google are US companies, so data may be processed in the USA. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection (GDPR Article 45). We use no other providers outside the EEA. OpenAI, Google (for sign-in), the affiliate networks and the online stores may process data outside the EEA under their own terms.

Backups

We take daily backups of the database, which are kept for 7 days. Before larger technical changes we may also take a separate copy, which is deleted once the change has proven to work. Data you delete disappears from the backups as the copies are replaced.

Your rights

You have the right to access the data we hold about you, and to have it corrected, deleted or handed over in a machine-readable format. You can also ask us to restrict processing, and object to processing we do on the basis of legitimate interest. You delete your account yourself under Min konto; for everything else, write to [email protected]. Writing from the email address the account is registered with is quickest. If you no longer have access to it, or have no account, we will ask for what we need to find the data and make sure it concerns you. We reply within one month.

If you use PrisHjelpen without an account, we usually cannot find data about you, because the statistics are not linked to a name, an email address or a full IP address.

Price alerts and the abuse limits are decided automatically, but we make no automated decisions that have legal effects for you or similarly significantly affect you. If you believe we process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Changes

We update this policy when the service changes. The date at the top shows when it was last changed.