Privacy Policy

Last updated: May 9, 2026

This Privacy Policy describes how Mikael Høiseth, operating as Høi Z ENK (org.nr. 924 425 407, Tamokveien 1427, 9334 Øverbygd, Norway) ("we", "us", "Daedalus") collects, uses, and protects your personal data when you use the Daedalus mobile application and the website at daedalus-app.no ("the service").

We are the data controller for the personal data described in this policy. For any privacy-related question or request, contact hello@daedalus-app.no.

1. Data We Collect

1.1 Account data

• Email address and password hash (for authentication)
• Full name (provided at signup)
• User ID (system-generated, used to identify your account)
• Organization name and role, if you are part of a Daedalus Organization plan
• Professional certifications you choose to record on your profile

1.2 Operational data you create in the app

• Trip logs, pre-trip safety checks, incident reports, and hazard markers
• Participant information you choose to record (names, phone numbers, and emergency contact details)
• PDF reports generated by the app

1.3 Location data

Daedalus uses your device location to log trip routes, attach hazards to map points, fetch local weather and avalanche forecasts, and provide accurate coordinates for emergency SOS. Location is collected only while the app is in use. You can disable location access at any time in iOS Settings — some features will be unavailable without it.

1.4 Device and technical data

• Device model, operating system version, and app version (for debugging)
• Push notification token (for sending you trip and safety alerts you have opted into)
• IP address (collected by our hosting providers; used for security and abuse prevention)

1.5 Subscription and billing data

• Daedalus Solo (in-app subscription): Apple processes your payment. We receive a confirmation that your subscription is active, the product purchased, and the renewal/expiration dates from Apple via RevenueCat. We do not receive your credit card details, full Apple ID, or billing address.
• Daedalus Organization (web subscription): Stripe processes your payment. We receive your Stripe customer ID, billing email, and subscription status. We do not store your card number or CVV — these are handled and stored by Stripe under PCI-DSS compliance.

1.6 Website data

The website daedalus-app.no does not use marketing cookies or tracking pixels. Strictly necessary cookies may be set by Stripe during checkout for fraud prevention; these are governed by Stripe's privacy policy.

2. Why We Collect This Data (Legal Basis)

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) for account data, operational data, and subscription data — we cannot provide the service without these
• Legitimate interests (Art. 6(1)(f) GDPR) for debugging logs and abuse prevention — to keep the service stable and secure
• Consent (Art. 6(1)(a) GDPR) for location and push notifications — granted via the iOS permission prompts and revocable at any time in iOS Settings
• Legal obligation (Art. 6(1)(c) GDPR) for accounting records related to subscription payments (Norwegian Bookkeeping Act)

3. How We Use Your Data

Your data is used solely to:

• Provide and operate the service (authentication, trip logging, safety documentation, PDF generation)
• Process subscription payments and manage your subscription status
• Send you transactional notifications (trial expiry, payment receipts, security alerts) and trip-related push notifications you have opted into
• Comply with legal obligations (e.g. tax records)

We do not sell your data, share it with advertisers, or use it for marketing profiling.

4. Data Sharing — Third-Party Processors

We use the following processors. All have signed data processing agreements with us where required, and all transfers outside the EEA rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

We do not transfer your data to any other party for any other purpose, except where required by law (e.g. valid court order from a Norwegian or EU authority).

5. How Long We Keep Your Data

• Account data and operational data: for as long as your account exists. If you delete your account, all personal data is permanently deleted within 30 days, except records we are legally required to retain.
• Accounting records: 5 years after the end of the financial year in which the transaction occurred (Norwegian Bookkeeping Act § 13).
• Debug logs: 90 days, then automatically purged.
• Backups: rolling 30-day backups; deleted account data is purged from backups within 30 days of account deletion.

6. Account Deletion

You can delete your account at any time directly in the app: open Profile → Settings → Delete Account and confirm. Deletion is permanent and irreversible: your authentication record, profile, trip logs, incident reports, hazard markers, and participant data you uploaded are deleted from our database within 30 days. Apple subscription cancellation is handled separately by you in iOS Settings → [your name] → Subscriptions; we do not have the ability to cancel your Apple subscription on your behalf.

If you cannot use the in-app deletion for any reason, email hello@daedalus-app.no from the address registered on your account and we will process the deletion manually within 30 days.

7. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of them, email hello@daedalus-app.no. We will respond within 30 days.

• Right of access (Art. 15) — request a copy of the data we hold about you
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — delete your data ("right to be forgotten")
• Right to restriction (Art. 18) — limit how we use your data
• Right to data portability (Art. 20) — receive your data in a machine-readable format (JSON export)
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)) — for processing based on consent (location and notifications), you can withdraw at any time in iOS Settings; this does not affect the lawfulness of processing carried out before withdrawal
• Right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, postboks 458 Sentrum, 0105 Oslo, postkasse@datatilsynet.no) or your local EU/EEA supervisory authority if you believe we have violated your rights

8. Security

We use industry-standard security measures including TLS encryption in transit, encryption at rest in Supabase, row-level security policies, hashed passwords (bcrypt), and least-privilege access for our infrastructure. No system is 100% secure, but we work to protect your data and will notify affected users and Datatilsynet within 72 hours of becoming aware of a personal data breach as required by GDPR Art. 33–34.

9. Children

Daedalus is intended for use by professional outdoor leaders aged 18 and over. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, contact us and we will delete the data.

10. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be notified to active users by email at least 30 days before they take effect.

11. Contact

Data controller: Mikael Høiseth, Høi Z ENK
Tamokveien 1427, 9334 Øverbygd, Norway
Email: hello@daedalus-app.no

This privacy policy is provided in English. The Norwegian Personal Data Act (personopplysningsloven) and the GDPR govern any conflict of interpretation.