Privacy Policy

1. Who is responsible

Tubing Supply AS, organisation number 837 679 222, Stavanger, Norway, is the data controller for the processing described here. Questions and requests concerning personal data can be sent to support@tubingsupply.no.

2. Information we process

Accounts and company access: name, business email, phone number, company name, organisation number, role, account status, sign-in time, registration source and access decisions.
RFQs, quotations and sales orders: contact details, technical requirements, project or purchase references, delivery information, files you choose to upload and commercial correspondence.
Support requests: category, subject, message, name, company, email, optional phone number, delivery state and case status.
Security and operations: administrative audit events, delivery errors and limited technical logs needed to protect and operate the service.
Optional updates: whether and when you separately consented to occasional product or technical marketing emails. Account, RFQ and security emails do not depend on this optional consent.
Privacy-minimised website analytics: route path without query parameters, referring host, country/region/city supplied by the hosting platform, device category, bot classification and pageview time. If you are signed in, the pageview may be connected to your existing account.

AI Customer Service keeps the active conversation and unsent message in this browser so navigation does not erase them. The browser copy is available for 24 hours after activity and is replaced when you start a new chat; expired copies are discarded when you return. This copy is specific to the browser and account. If you sign in and choose Save chat, the conversation and subsequent replies are stored with your account for access across devices. You can delete saved conversations from Saved conversations.

3. Website analytics and cookies

Our first-party analytics is designed to provide aggregate visitor numbers, popular pages and approximate geography without building persistent anonymous profiles. The service does not store your raw IP address or user-agent. Instead, it creates a one-way visitor hash that changes every day. The hash cannot be used to follow an anonymous visitor across days. Query strings and URL fragments are discarded, detected bots are excluded from human totals, and browser Do Not Track is honoured.

We also use Vercel Web Analytics for aggregate website performance. We do not use advertising cookies or cross-site tracking. Essential cookies or equivalent browser storage may be used for sign-in security, maintaining a quote basket, preserving a session and remembering for seven days that you dismissed a company-account prompt. The prompt preference is only a timestamp; it is not a visitor identifier and is not sent to us.

Videos in the Knowledge Hub use YouTube’s privacy-enhanced player. Preview images are served by our website; the YouTube player loads only when you select play. Playback connects your browser to YouTube, which processes technical information under its own privacy policy. You can also choose the direct YouTube link.

4. Purposes and legal bases

To understand product interest, we count selected catalogue views, part selections, basket additions and catalogue openings. For AI customer service, fixed classification rules record product categories, verified part references and question topics such as specifications or documentation. These interest records contain no question text, email address or account identifier. We also summarise the products, quantities and last changes already stored in quote baskets, and compare them with submitted RFQs to improve product information and the enquiry flow. Guest baskets are shown only in aggregate in these insights. Authorised administrators can see account-linked baskets to support existing customer relationships; this does not subscribe you to marketing or trigger automatic reminders. A temporary conversation reference groups questions within the current chat session; it is not used to follow you across sessions. Known bots, internal staff and test traffic are excluded. Do Not Track and Global Privacy Control are honoured for these measurements.

To take steps at your request before a contract and to perform B2B supply agreements, including RFQs, quotations, orders, deliveries and account access.
To pursue our legitimate interests in answering business enquiries, supporting customers, improving the website, measuring aggregate usage, preventing abuse and maintaining secure operations.
To comply with legal duties that apply to business, accounting, product traceability, sanctions, tax or dispute records.
Where we specifically ask for consent for an optional purpose, consent is the legal basis and can be withdrawn for future processing.

We do not sell personal information and do not use it for automated decisions that produce legal or similarly significant effects.

Authorised Tubing Supply personnel and suppliers that operate the service may receive only the data needed for their task. Current processor categories include cloud hosting and deployment (Vercel), database, authentication and file storage (Supabase), and transactional email (Resend). Information may also be shared with carriers, suppliers, professional advisers or public authorities when required for a request, contract or legal obligation.

Where a provider processes data outside Norway or the EEA, we use the provider’s applicable data-processing terms and lawful transfer safeguards. We do not give service providers permission to use customer data for their own advertising.

6. Retention

Raw first-party pageviews are automatically deleted after 90 days. Daily anonymous visitor hashes have no use beyond their day.
Product-interest events and AI topic classifications older than 90 days are removed by an hourly cleanup. This is separate from correspondence or conversations you explicitly choose to save. Aggregate internal reports may preserve summary counts.
Account information is kept while the account or company relationship is active, then reviewed for deletion or anonymisation. Data linked to an open request, order, security event or legal duty is retained as needed for that purpose.
Uncompleted company-account requests and delivery errors are reviewed and removed or anonymised when they are no longer needed for follow-up, security or accountability. Positive marketing-consent evidence is retained while the consent is relied on and as needed to document withdrawal.
RFQs and support correspondence are normally reviewed after the business follow-up period. Accepted quotations, sales orders and related documentation may be retained longer for contractual, warranty, traceability, accounting or legal requirements.
Email delivery errors and audit records are retained only while useful for troubleshooting, security and accountability, then deleted or anonymised under our operational retention routines.

7. Security

We use encrypted transport, role-based admin access, row-level database security, service-only credentials, audit logging and restricted file access. Access to visitor analytics and support cases is limited to authorised administrators. No internet service can promise absolute security, but we review controls and investigate suspected incidents.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may also withdraw consent where consent is the basis. Some rights can be limited by contractual or legal record-keeping duties.

Send a request to support@tubingsupply.no. We may need to verify your identity before releasing or changing account data. You may also complain to the Norwegian Data Protection Authority (Datatilsynet).

9. Changes

We update this notice when the service or processing changes. The current date is shown at the top, and material changes will be highlighted where appropriate.