Privacy policy

Who is responsible

The controller for the personal data described here is Silicon Valhalla (organisation number 919 806 052). We run the Silicon Valhalla site, an independent directory, events calendar and news publication about the Nordic startup ecosystem.

Questions about this policy or your data: hello@siliconvalhalla.no.

Visiting the site

You can read the site without giving us any personal data. We do not use accounts for visitors and we do not set cookies (see the cookie policy).

Our hosting provider receives your request and, to deliver the page and protect the service, processes technical data such as your IP address, the page requested, the time and your browser type in its server logs.

We measure traffic with Vercel Web Analytics. It counts page views and shows us aggregated information such as which pages are read, the referring site, country, browser and device type. It does not use cookies and is not used to track you across other websites or to build a profile of you.

Contacting us

If you use the contact form we collect your name, email address, subject and message, and the time you sent it. We use them to read and answer your message. The message is stored in our database. When email sending is enabled we also email a copy to our contact address so we can reply.

Legal basis: our legitimate interest in answering messages sent to us (and, where you ask for something, taking steps at your request).

Newsletter

If you subscribe we collect your email address, optionally your name, the topics you are interested in, the time you gave your consent and, once you confirm, the time of confirmation. We use a double opt-in: we email you a link and you are only subscribed after you confirm. A unique confirmation code is stored with your subscription for that purpose and expires after seven days.

We use this data to send you the newsletter you asked for. Legal basis: your consent, which you can withdraw at any time (every newsletter will contain an unsubscribe link, and you can also write to us).

Submitting a company

If you submit a company we collect the company details you enter (name, description, website, city, country, industry, tags, funding stage, size and founding year), your email address, optionally your name, and the time you gave your consent.

We use them to review the submission and to contact you about it. If we approve it, the company information (not your contact details) may be published in the directory. Legal basis: your consent and our legitimate interest in running a curated directory.

Companies listed in the directory

The directory describes companies using their name, description, website, location, size, funding stage and logo, from what the company submitted or from public sources. Information about a company is not personal data about its founders unless it names or identifies a person.

A listed company can ask us to correct or remove its listing at any time. Every company page has a "Request removal or correction" link that opens our contact form with the company already named, and you can also write to hello@siliconvalhalla.no. We act on such requests promptly.

Spam protection and rate limits

The contact, newsletter and submission forms are protected by Cloudflare Turnstile, which checks that a visitor is a person. To do this, Cloudflare processes technical information such as your IP address and browser characteristics. Turnstile is only loaded on those pages.

We also limit how often one visitor can submit a form. For that we keep a one-way, keyed hash of your network address (not the address itself) with a counter. These records are removed automatically on a rolling basis once they are two days old. Forms also contain a hidden field that only automated programs fill in.

Legal basis: our legitimate interest in keeping the service secure and free of abuse.

News headlines and links

The front page shows headlines from a third-party news feed (Arctic Startup). Our server fetches the feed; your browser does not contact the publisher until you click a link, and no data about you is sent to the publisher by us. Once you follow a link you are on the publisher's site and its own policy applies.

Advertising

Advertisements and sponsored listings are sold directly by us and clearly labelled. We do not use an advertising network, and the ads we show do not set cookies, load tracking pixels or collect data about you. When you click an advertisement you go to the advertiser's own website, which has its own policy.

Who handles your data for us

We use these service providers (processors) to run the site. They may only use your data to provide their service to us:

• Vercel Inc.: hosting and web analytics. The site's server functions run in Frankfurt, Germany.
• Supabase Inc.: database and file storage, where messages, subscriptions and submissions are kept, in Frankfurt, Germany (EU Central).
• Cloudflare, Inc.: Turnstile spam protection on the forms.
• Resend (EU region): sending the newsletter confirmation and our contact notifications.

Transfers outside the EEA

Vercel, Cloudflare and our other US-based providers (Supabase Inc. and Resend) may access or process data from the United States. Where personal data leaves the European Economic Area we rely on the EU-US Data Privacy Framework for providers certified under it, and on the European Commission's Standard Contractual Clauses as a fallback where a provider is not certified or the framework cannot be relied on. Our database and hosting are in Frankfurt, and Resend sends from its EU region.

We do not sell your personal data.

How long we keep data

• Contact messages: deleted automatically 12 months after we receive them.
• Newsletter: until you unsubscribe. An address that unsubscribes, or that never confirms its subscription, is deleted automatically 30 days later.
• Company submissions: deleted automatically 12 months after we approve or reject them, or 12 months after you sent them if we have not reviewed them by then. A company that was approved stays in the directory; only the submission record, with your contact details, is deleted.
• Rate limit records: removed on a rolling basis once they are two days old.
• Server logs and analytics: according to the providers' retention periods.

Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing, a copy in a portable format, and you can object to processing based on our legitimate interest. Where we rely on consent you can withdraw it at any time. Write to hello@siliconvalhalla.no; we answer within one month.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or the authority in the country where you live.

Children

The site is not aimed at children under 16, and we do not knowingly collect their data.

Changes to this policy

We update this page when our practices change and show the date it applies from at the top (now 7 October 2026).