Privacy Policy

Humryk is a platform for online stores, B2B sales and production. It is provided by Key-Tech AS, which is the controller of the personal data this policy describes, with the exceptions in section 2.

• Key-Tech AS, organisation number 932 472 112
• Hans Tanks gate 19, 5008 Bergen, Norway
• Email: post@humryk.com

We have not appointed a data protection officer. Send questions about privacy to the email address above.

We are the controller of data about you when you visit humryk.no or humryk.com, contact us, register a store, have a Humryk user account or receive email from us.

The stores that use Humryk are the controllers of data about their own customers: consumers who shop in the online store, business customers in the B2B portal, subscribers and newsletter recipients. For that data we are a processor. We process it only to provide Humryk to the store, on the store's instructions and under the data processing agreement we have with every store. If you are a store's customer, read section 4.

The table covers the data we are responsible for. The legal bases refer to Article 6(1) of the General Data Protection Regulation (GDPR). Where the basis is legitimate interest, the table names the interest, and you can object (see section 13).

Online stores and B2B portals on Humryk are run by the stores themselves. The store is the controller of the data you give when you shop, create an account, subscribe or sign up for a newsletter. The store's own privacy policy tells you what it does with it.

We store and process this data on the store's behalf: for example name, email, phone, delivery address, orders, subscriptions, newsletter consents and how the online store is used. We use it only to provide the service to the store, never for our own marketing, and each store sees only its own customers. Neither we nor the store see your card number: it goes straight to the payment provider.

To see, correct or delete your data, or to withdraw a consent, contact the store. Its contact details are in the online store. If you write to us, we pass your request on to the store and help it answer.

The store decides which cookies, analytics tools and connections – for example Google, Meta, accounting and shipping – its online store uses, and asks for your consent where the law requires it. You change your cookie choice in each online store.

Stores can connect an AI assistant – for example Claude, ChatGPT or Cursor – to Humryk through our MCP server (Model Context Protocol) and ask about sales, orders, products and customers in plain language.

• The assistant can only read. It can read sales, orders, products, stock, customers, business customers, subscriptions, abandoned checkouts and email-marketing statistics. It cannot create, change, delete or send anything.
• You grant access yourself: you sign in with your Humryk user and approve the app on our site. The app never gets your password, only an access token.
• The assistant sees what you have access to in your stores, nothing more.
• Answers can contain personal data about the store's customers, such as names, email addresses, phone numbers, delivery addresses and what they bought. The assistant fetches only what you ask about.

What the assistant receives is sent to the AI service you connected and is processed there under the agreement between you and that provider – for example Anthropic or OpenAI. We do not control what the provider stores, so check the privacy and data settings in the app you use. The store remains the controller of its customer data and decides whether to use it with an AI assistant.

We do not store your conversations, the questions you ask, what the assistant searches for or what it receives, and we never read the assistant's chat history or memory. For each call we log only the tool, the app, the user and the store, whether the call succeeded and how long it took. The log is deleted after 90 days.

You see and remove connected apps under Settings → AI assistant → Connected apps in Humryk. An app you remove cannot renew its access, and the token it holds stops working when it expires, normally within an hour. We do not use data from the connection to train AI models, and we do not sell it.

Humryk can draft text for the store: product descriptions, pages, newsletters, translations, search-engine texts and code snippets. What the store asks for help with – its own texts, products and brand – is sent to Anthropic, which writes the draft with its Claude AI model. Customer lists and orders are not sent to these features. Anthropic does not use the data to train its models, and a draft becomes part of the store only if someone chooses to use it.

Stores can connect Humryk to Google Merchant Center and to Meta (Facebook and Instagram) to show their products in Google Shopping and in the Meta catalogue. The store always starts the connection, with its own Google or Meta account.

• Google: we ask for access to Merchant Center (the «content» scope). We use it to find the store's Merchant Center account, submit and update the products, and read whether Google has approved them.
• Meta: we ask for catalog_management and business_management to find the store's business account and catalogue, submit and update the products and read their status, and for ads_management only to send purchases to Meta for measurement (Conversions API). We do not create, change or run any ads.
• To the catalogues we send the products: name, description, images, price, stock status and links. Data about the store's customers is sent only if the store turns on conversion tracking (see below).
• Access tokens are stored encrypted. When the store disconnects, we delete the tokens and the account details. The store can also remove Humryk from its Google or Meta account.

If the store has also turned on conversion tracking, Humryk sends purchases from the online store to Meta or Google, with the customer's email address and phone number in hashed (one-way encrypted) form. We do this on the store's behalf, and the store is responsible for informing its customers and obtaining consent where the law requires it.

Humryk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for advertising, do not sell it, do not use it to train AI models and do not let any person read it unless the store asks us to or security or the law requires it.

We never sell personal data. We use providers that run parts of the service for us (processors). They receive only what they need for the task and may not use the data for their own purposes.

Some recipients process data on their own responsibility:

• Stripe processes card and Vipps payments and payouts to the stores, and verifies the identity of store owners as anti-money-laundering rules require. Stripe receives and processes personal data about store owners and contacts and about the customers who pay, under the Stripe Privacy Policy.
• Vipps MobilePay processes data about customers who pay with Vipps under its own terms.
• Meta and Google receive data from the marketing cookies on our website when you have consented. For the collection through the Meta pixel, we are joint controllers with Meta.
• Integrations the store chooses: accounting (Fiken, Tripletex, PowerOffice, Conta and Duett), shipping (Bring, PostNord, DHL, Helthjem through Profrakt, and Shippo), Cropster, Google Merchant Center and Meta. We send only what the task needs – for example the recipient and address to the carrier, or invoice details to the accounting system – and only when the store has turned the connection on. The provider processes the data under its agreement with the store.
• Public registers: when you enter an organisation number or an address, we or your browser look it up in the Norwegian Register of Business Enterprises (Brønnøysundregistrene), the Norwegian Mapping Authority (Kartverket) or similar Nordic registers.
• Authorities: we disclose data to the police, tax authorities or other authorities only when the law requires us to.

The database and the servers that run Humryk are in the EU. Some providers are American companies or process data in the USA or Switzerland (see the table in section 8). For Switzerland, the European Commission has decided that the level of protection is adequate. We transfer data to the USA only to companies certified under the EU–US Data Privacy Framework, or under the European Commission's Standard Contractual Clauses with additional measures such as encryption. You can get a copy of these safeguards by writing to us.

• All traffic to and from Humryk is encrypted (HTTPS), and the database and backups are encrypted at the provider.
• Access tokens for connections such as Google and Meta are stored encrypted.
• Each store sees only its own data, and the store's users get access by role.
• Only those of us who need it for operations and support can access production data, and what we do in the system administration is logged.

If we discover a personal data breach that may put you at risk, we report it to the Norwegian Data Protection Authority (Datatilsynet) within 72 hours and notify you when the law requires it. If the breach concerns the stores' customer data, we notify the store without undue delay.

If you have found a security vulnerability, write to post@humryk.com. We welcome reports made in good faith and respond quickly.

A cookie is a small file a website stores in your browser. We also use the browser's local storage (localStorage) in the same way. What the site needs to work, we use without asking. Marketing cookies we use only if you say yes.

On humryk.no and humryk.com:

In the admin (app.humryk.com):

Each online store has its own consent banner and its own list of cookies, which the store controls.

Your choice for marketing cookies on this website:

Your choice applies to the browser you are using now, and to humryk.no and humryk.com separately. If you withdraw consent, we delete the marketing cookies from our website straight away. You can also delete cookies and local storage in your browser settings.

• Access: find out what data we hold about you and get a copy.
• Rectification: have incorrect or incomplete data corrected.
• Erasure: have data deleted that we no longer need or have no basis for.
• Restriction: have us pause the use of your data for a while, for example while we check whether it is correct.
• Data portability: get data you have given us in a machine-readable format, where the processing is based on consent or contract.
• Objection: object to processing based on legitimate interest. You can always object to direct marketing.
• Withdrawing consent: at any time, as easily as you gave it. It does not affect processing that took place before you withdrew it.

Write to post@humryk.com. We answer as quickly as we can and within one month at the latest. We may ask you to confirm who you are before we disclose or delete anything. It costs nothing. If you are a customer of a store on Humryk, send your request to the store (see section 4).

• A store or user account: write to post@humryk.com from the email address on the account. Data we must keep under the Bookkeeping Act is deleted when the period ends.
• Google and Meta connections: disconnect in Humryk, and we delete the access tokens and account details. You can also remove Humryk from your Google or Meta account. If you want us to delete more of what we received through the connection, write to us.
• AI assistants: remove the app under Settings → AI assistant → Connected apps. The call log is deleted after 90 days, or sooner if you ask.
• Enquiries and news: write to us, or unsubscribe from the news with the link at the bottom of the email.
• Marketing cookies: withdraw your consent in section 12.
• A store's customer: ask the store to delete your data.

We confirm by email when the data has been deleted, within one month of receiving your request at the latest.

You choose whether to contact us or register a store. Without contact details we cannot answer you, and without the details in the registration we cannot create the store. We are required by law to keep accounting records.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects on you (GDPR Article 22). New stores are approved by a person.

We update this policy when the service or the law changes, and the date at the top shows when it last changed. For material changes, such as new purposes or new kinds of data, we notify stores by email before the change applies. We never use data from Google or other connections for new purposes without asking for new consent.

• Key-Tech AS, organisation number 932 472 112
• Hans Tanks gate 19, 5008 Bergen, Norway
• Email: post@humryk.com

If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet. We would appreciate it if you contacted us first, so we can put it right.