Tilbudo

Privacy

Last updated 5 November 2026

Draft. Tilbudo is a prototype and this text has not yet been reviewed by a lawyer. Bracketed items are still to be decided before launch.

Who is responsible

Tilbudo, Lian Platå, Kristiansand, Norway. Contact: tilbudo.norway@gmail.com

We are the controller for the personal data described here. GDPR applies through the EEA agreement and the Norwegian Personal Data Act.

What we collect from you

  • Account: email address and, if you sign in with Google, the name and email Google shares.
  • Requests: your description of the job, city or postcode, urgency, optional budget, your name, optional phone number and optional photos.
  • Replies: what businesses write back (price, availability, notes) and when.
  • Notifications: which updates you have seen.
  • Cookies: only the cookies needed to keep you signed in. We use no analytics or advertising cookies.

What we collect about businesses

To find businesses near you we use the Brønnøysund Register Centre, Geoapify and, where the business has a website, its public contact page. We store the business name, address, phone, website and email address, plus a Google rating where one is available. For sole proprietorships this can be personal data. If you are a business and want to know what we hold, or want no more inquiries, use the unsubscribe link in any of our emails, reply "no thanks", or contact us. We keep your email address on a suppression list so the opt-out is honoured.

Why we use it, and on what basis

  • To run your account and requests: performance of the service you asked for (GDPR Art. 6(1)(b)).
  • To contact businesses for a quote on your behalf and to turn their replies into comparable quotes: our and your legitimate interest in getting a quote (Art. 6(1)(f)). [to be confirmed by counsel]
  • To keep the service secure and prevent abuse: legitimate interest (Art. 6(1)(f)).

Who receives it

  • Businesses you contact: the content of the inquiry you review, your name and anything you choose to include, such as a phone number or photo links.
  • Service providers (processors): Supabase (database, login, photo storage), an AI model provider (OpenRouter or Azure OpenAI) that reads your request and business replies to classify the job, draft the email and extract prices, an email delivery provider (Mailtrap or Gmail), and Geoapify (location lookups). [Processor agreements and transfer safeguards outside the EEA to be confirmed]

We do not sell personal data.

AI and automated processing

AI drafts the email and extracts price, availability and notes from replies. Extraction can be wrong, so the original reply stays available behind each quote. Nothing here produces a decision with legal effect on you. How quotes are ranked is explained in the terms.

How long we keep it

[Retention periods for requests, replies, photos and the suppression list to be decided]

Your rights

You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Write to tilbudo.norway@gmail.com. You can also complain to the Norwegian Data Protection Authority, Datatilsynet.