Privacy — Rett fra Bonden

Who we are

Rett fra Bonden is an open catalogue of local matprodusenter in Norway, available at rettfrabonden.com. The service is run as an independent project. Contact: kontakt@rettfrabonden.com.

What we collect

We collect different types of data depending on how you use the service. Here is the full overview:

Website visitors (everyone)

When you visit rettfrabonden.com we register:

Which page you visit (URL path)
Referrer URL (where you came from)
An anonymised hash of IP address and browser type (SHA-256, truncated — we do not store the full IP address or browser string)
Timestamp of the visit

We use no cookies. We use no third-party analytics tools such as Google Analytics. All analysis happens in our own database.

Search and AI queries

When you search for producers — via the website, ChatGPT, Claude MCP or the API — we store:

The text you searched for
Selected category and city
Number of results returned
Which protocol was used (API, MCP, A2A)
Anonymised IP hash (same method as for page visits)

We store this to understand which searches give good results and to improve the service.

Sellers who register (claim)

When you register as a produsent to manage your profile, we collect:

Name, email address and optionally phone number
A 6-digit verification code sent to your email
Claim token (cryptographic key for sign-in, expires after 30 days)

After verification you can yourself add and edit: address, opening hours, products, certifications, description, images and contact info. Everything you add is visible on your public profile page.

Sign-in

We do not use passwords. Sign-in happens via a magic link sent to your email. The link is valid for 15 minutes and can only be used once. We do not store passwords because we do not have any.

Images

Sellers can upload profile pictures and product photos. These are stored on the server. If image scanning is enabled, the image may be sent to an external AI service (Anthropic Claude or OpenAI) for automatic product recognition.

Conversations between agents

Rett fra Bonden supports the A2A protocol (agent-to-agent). When an AI agent contacts a producer agent, the conversation text, status and any transaction info are stored in the database.

What we do not collect

We use no cookies
We have no third-party tracking (no Google Analytics, Facebook Pixel, etc.)
We do not store full IP addresses — only a truncated hash
We do not store passwords (passwordless sign-in)
We do not collect payment information
We never sell data to third parties

Legal basis

We process personal data based on:

Data type	Basis	Explanation
Analytics (page visits, searches)	Legitimate interest	To improve the service. The data is anonymised (hashed IP/UA).
Seller registration	Consent	You actively provide data when you register. You can withdraw consent.
Seller profile (public info)	Consent	You choose what to add. Everything is visible on your profile page.
Image upload	Consent	You upload images yourself. Image scanning is optional.

Where data is stored

All data is stored in a SQLite database on a server hosted by Fly.io in the Stockholm region (ARN). Data is not transferred to countries outside the EU/EEA, with the exception of:

Email is sent via an SMTP service to deliver verification codes and magic links
If image scanning is enabled, images may be sent to Anthropic (USA) or OpenAI (USA) for analysis

The source code is open and available on GitHub.

How long we keep data

Data type	Retention
Page-visit analytics	Can be deleted via admin. No automatic expiry is set today.
Search logs	Same as analytics.
Verification codes	Unverified claims expire after 7 days.
Magic links	Expire after 15 minutes. Used links older than 1 hour are auto-deleted.
Claim token (sign-in)	Expires after 30 days. Renewed at next sign-in.
Seller profile	For as long as you wish to remain registered.
Uploaded images	Stored until manually deleted.

Your rights

Under the Norwegian Personal Data Act and the GDPR you have the right to:

Request access — we can tell you what we have stored about you
Correct errors — sellers can update their profile directly via the dashboard
Delete data — contact us to have your profile and associated data removed
Withdraw consent — you can ask to be removed at any time
File a complaint — you can complain to Datatilsynet (the Norwegian Data Protection Authority, datatilsynet.no) if you believe we are breaking the rules

For all enquiries: kontakt@rettfrabonden.com

Security

We use the following measures to protect data:

All traffic is encrypted with HTTPS/TLS
Admin access is protected by API keys in environment variables
Content Security Policy (CSP) and other security headers are active
All database queries are parameterised (protection against SQL injection)
IP addresses and browser info are stored only as hashes (irreversible anonymisation)
Rate limiting on sensitive endpoints

Changes to this policy

If we change how we handle data, we update this page. We have no newsletter or popup notifications — check this page if you're wondering.

Last updated: 16 April 2026