Privacy policy

1. Who is responsible for your data

norbert.energy is operated by Niklas Timpe, a Swedish enskild firma (sole trader). Until a limited company (aktiebolag) is formed, Niklas Timpe is personally the data controller for any personal data collected through this site. Full contact details are on the company information page.

Questions about this policy or your data can be sent to info@norbert.energy.

2. What we collect, and why

Waitlist and "become a design partner" form. When you submit the form on this site, we collect your name, email address, company, phone number (optional), and the message you write. We use this solely to respond to your inquiry and to evaluate you as a potential design partner, investor, or hire. This is processed on the basis of our legitimate interest in responding to inquiries you initiate, and, where relevant, to take steps at your request before entering into an agreement.

Direct email. If you email us directly, we process whatever personal data is in that email for the same purposes, on the same basis.

Console accounts. If you're invited to or sign up for the norbert console (console.norbert.energy), we store your name, email address, a securely hashed password (we never store your actual password), your organization/company name, your role within that organization, and session data (IP address, device/browser, session expiry) needed to keep you signed in. If you request access or receive an invitation before your account is created, we store your email address for that purpose. This is processed to provide the console to you under our agreement with you, and on the basis of our legitimate interest in keeping accounts secure.

Technical logs. Our hosting infrastructure automatically logs limited technical information for every visitor, such as IP address, browser type, and request timestamp, for security, abuse prevention, and troubleshooting. This is processed on the basis of our legitimate interest in keeping the site secure.

Cookies. norbert.energy (this marketing site) does not set any cookies. The norbert console (console.norbert.energy) sets one cookie, better-auth.session_token, to keep you signed in; it's strictly necessary for the console to work, expires automatically after a few days, and isn't used to track you across other sites. Neither site uses analytics, advertising, or tracking cookies or scripts. Because our only cookie is strictly necessary, no consent banner is required for it under the Swedish Electronic Communications Act (LEK); if that changes, this policy and a consent banner will be updated accordingly.

3. How long we keep it

Form and email submissions are kept for as long as we're actively in contact with you (for example, while evaluating a design partnership, investment, or hire), and are deleted once that's concluded. Regardless of that, we delete it no later than 24 months after your last contact with us, unless we're required to keep it for longer by law.

Web server access logs are automatically rotated and deleted after 30 days. We don't currently apply the same automatic time limit to other technical/application logs, though we delete them periodically as part of routine maintenance.

Console account data is kept for as long as your account is active. We delete it if you or your organization ask us to, or if the account is removed.

4. Who we share it with

• Resend — our email delivery provider. Messages submitted through the waitlist form, and account-related emails from the console (such as sign-in links), are sent via Resend, which processes the message content to deliver it. Resend is US-based; the transfer is covered by its certification under the EU-U.S. Data Privacy Framework and by Standard Contractual Clauses (see Resend's Data Processing Addendum).
• Hetzner Online GmbH — our hosting provider, based in Germany. Hosts the website, the console application, and the database that stores console account data, and processes technical server logs.

We don't sell your data, and we don't share it with anyone else or use it for advertising.

5. Your rights

Under GDPR, you have the right to access, correct, or delete your personal data, to restrict or object to our processing of it, and to request a copy in a portable format. To exercise any of these, email info@norbert.energy. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).

6. Changes to this policy

If this policy changes, we'll update the date at the top of this page.