Privacy Policy

Last updated 7 October 2026.

This policy explains which personal data Svippit processes, why, who we share it with and what rights you have. It covers svippit.com, the merchant dashboard and the online stores that run on Svippit.

Who we are

Svippit is operated by Visplan AS, org. no. 871 168 172, Håkonsgaten 24, 5015 Bergen, Norway. Send privacy questions to hello@svippit.com.

Who is responsible for what

Svippit has two roles, depending on who you are:

• You are a merchant or you visit svippit.com. Visplan AS is the controller of the data about you.
• You shop in a store on Svippit. The store is the controller of the data about your purchase. Visplan AS is its processor: we run the store, receive the order and send the receipt on the store's behalf, under an agreement with the store. Questions about an order, or about what the store does with your data, go to the store. The store's contact details are in its terms of sale.

For the payment itself, Vipps MobilePay AS is an independent controller and has its own privacy policy at vippsmobilepay.com.

Merchants

When you create an account and a store, we process:

• Account: name, email address, password (stored as a hash), language and whether you want product news by email.
• Store: organisation number, company name, contact person, email, phone, address, VAT status and website. For a sole proprietorship the company name is often your own name. We fetch company details from the Norwegian Register of Business Enterprises, the Danish CVR or the Finnish PRH, through Signicat or directly from the registers.
• Vipps MobilePay application: when you ask us to, we send your organisation number, company name, store URL and the bank account number you enter to Vipps MobilePay, so the application is ready for you. We do not store the bank account number.
• Content: products, images, digital files and texts you add.
• Billing: sales, platform fee and invoices. Invoices are created in our accounting system, Fiken, with company name, organisation number, billing address and billing email.
• Where you came from: at signup we store, once, which website or campaign (UTM parameters) sent you to us.
• Usage and troubleshooting: which steps of the store setup and the Vipps application you have completed, so we can help when something stalls.

We process this to deliver the service to you (contract, GDPR Article 6(1)(b)), to meet our bookkeeping obligations (legal obligation, point (c)) and to improve the service, understand where new merchants come from and keep the platform secure (legitimate interest, point (f)).

We email you about orders, payments, invoices and weekly sales figures because the service needs it. We also occasionally send news about Svippit to merchants with an active store. You can unsubscribe from the news with the link at the bottom of every email or in the settings, without affecting the other emails.

Customers who shop in a store

When you shop, we process on the store's behalf:

• name, email address and phone number, which Vipps MobilePay shares when you pay
• delivery address, when the goods are shipped
• what you bought, price, any discount code, notes and the status of payment and delivery
• the language and browser you shopped from, so we can send the receipt in the right language and troubleshoot payments that stall

We store the profile from Vipps MobilePay linked to your Vipps ID, so your orders can be matched to the right customer. We never receive card numbers or bank details. We do not use your data for our own marketing, and we never sell it.

Visitors to svippit.com

• Visitor statistics without cookies. We count page views to see which pages are used and which websites visitors come from. A visit is recorded with a code made from your IP address and browser together with today's date. The code changes every day, and the IP address is not stored. If you have accepted analytics in the consent banner, we instead use a random ID stored in your browser, so we can see repeat visits. Individual records are deleted after 90 days; only totals remain. We also use Vercel Web Analytics and Plausible, which count visits without cookies and without storing the IP address. The basis is our legitimate interest in understanding traffic (point (f)).
• The Google tag. We use Google Ads to measure which ads bring in new merchants. The tag loads on svippit.com but sets no cookies and sends no identifying data until you have said yes in the consent banner. Without consent it only sends anonymous, cookieless signals, as Google's consent mode is designed to do. The basis for the cookies and ad measurement is your consent (point (a), and section 3-15 of the Norwegian Electronic Communications Act).
• Store pages. Svippit does not use the Google tag in the stores. If the store has turned on the Meta pixel, see the section below.

Svippit.com has no Meta pixel.

Cookies and browser storage

The dashboard also stores temporary data in your browser to remember which store you last opened and a draft of the product you are working on. You can change your consent at any time by deleting the cookies for svippit.com; we will then ask again.

The Meta pixel in stores

A store can choose to connect the Meta pixel and Meta's Conversions API to measure its ads on Facebook and Instagram. This happens only in stores that have turned it on, and only when you have said yes in the store's own consent banner. The consent applies to that one store only.

The store and Meta Platforms Ireland Limited are then joint controllers of the data sent to Meta. Svippit sets up the pixel, shows the consent banner and sends the purchase event to Meta on the store's behalf, as processor. On a purchase, email address and phone number are sent only in hashed form (SHA-256), together with IP address, browser type, Meta's cookies (_fbp, _fbc), product ID, quantity and amount. We delete the IP address and browser type once the event is sent, and after 7 days at the latest.

Every store with the pixel has its own privacy notice that explains this in detail, linked at the bottom of the store. See also Meta's privacy policy.

Who we share data with

We use these suppliers. They process data only on our instructions, under a data processing agreement.

We also share data with:

• Vipps MobilePay AS, which processes payments and Vipps MobilePay applications as an independent controller.
• The store you shop in, which receives the details of your order.
• Meta, only from stores with the pixel and only with your consent (see above).
• Public authorities, when the law requires it.

Transfers outside the EEA

Some suppliers are US companies. When data is transferred to the USA, it is based on the EU-US Data Privacy Framework or the EU standard contractual clauses.

How long we keep data

• Account and store: for as long as you have an account with us. When you delete the account, it and the store are deactivated immediately.
• Accounting records: invoices, sales and orders are kept for as long as section 13 of the Norwegian Bookkeeping Act requires, currently 5 years after the end of the financial year.
• Visitor statistics: individual records are deleted after 90 days.
• Meta data from stores with the pixel: IP address, browser type and Meta's cookies are deleted after 7 days at the latest.
• Emails to us: while the matter is open and for a reasonable time afterwards.

Your rights

You have the right to access the data we hold about you, to have errors corrected and to have data deleted when we no longer need it. Data we must keep under the Bookkeeping Act cannot be deleted before the period has run out. You also have the right to receive the data you have given us, to object to processing based on our legitimate interest, and to withdraw a consent at any time.

Send your request to hello@svippit.com. You will get an answer within one month. If it concerns a purchase in a store, we forward the request to the store, which is responsible.

If you believe we process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (www.datatilsynet.no), or the data protection authority where you live. We appreciate it if you contact us first.

Changes

We update this policy when the service changes. The date at the top shows when it was last changed. We notify merchants by email of material changes.