Privacy Policy

Last updated: 04.08.2026

This is a translation provided for convenience. The Norwegian version of this policy is the legally binding one.

1. Data controller

VIKSE DEVELOPMENT AS, company registration number 937 865 163, Damsgårdsveien 18, 5058 Bergen, Norway, is the data controller for the processing of personal data in the Bonussøk service at bonussok.no ("the service"). This means the company, not the website, is responsible for ensuring your data is processed in accordance with the Norwegian Personal Data Act and the General Data Protection Regulation (GDPR).

If you have questions about privacy, contact us at hei@bonussok.no.

2. What data we process, and why it is needed

2.1 Account data

  • Email address. Necessary to create an account, sign in and receive alerts you have asked for. If you do not provide an email address, we cannot deliver the service.
  • Password. Stored only as an encrypted hash. If you sign in with Google, we store no password at all.

    • 2.2 Subscription and payment

  • Payment details (card number and similar) are given directly to our payment provider, Stripe, and are never stored by us. Necessary in order to take out a subscription.
  • We store subscription status and purchase history. Necessary to give you the right access and to meet our bookkeeping obligations.

    • 2.3 Your use of the service

  • Searches you run (route, dates, cabin class, number of passengers) and saved trips. Necessary to show results and to deliver features such as saved searches.
  • Alerts you create (route, date range, passengers). Necessary in order to send you the alert — without this data we cannot notify you.
  • Clicks on booking links and use of features. Used for troubleshooting and improving the service, mainly in aggregated form.

    • 2.4 AI chat

  • The messages you write in the AI chat are processed in order to answer you, and are sent to our sub-processor OpenAI to generate the response. Avoid writing sensitive personal data in the chat.

    • 2.5 Technical information

  • IP address, browser type and technical error/event logs. Used for operations, security, troubleshooting and to prevent misuse of the service.

    • 2.6 Statistics and marketing (only with your consent)

  • If you consent in the cookie banner, we use Google Analytics, Meta Pixel and DataFast to record page views, which features and searches are used, which campaign or channel visitors come from, and purchases completed after an ad click. For signed-in users, DataFast links the usage statistics to user ID and email address.

    • 3. Legal basis

    Each processing activity has its own legal basis under GDPR Article 6:

  • Account, searches, saved trips, alerts and AI chat: necessary to perform the contract with you (Article 6(1)(b)).
  • Payment and subscription management: necessary to perform the contract (Article 6(1)(b)).
  • Retention of purchase and accounting documentation: legal obligation under the Norwegian Bookkeeping Act (Article 6(1)(c)).
  • Important messages about your account and the service (e.g. changes to terms and security notices): legitimate interest in administering the customer relationship (Article 6(1)(f)).
  • Newsletters and email marketing: consent (Article 6(1)(a)), or within an existing customer relationship (Norwegian Marketing Control Act section 15). You can always unsubscribe via the link in the email.
  • Statistics and ad measurement using cookies (Google Analytics, Meta Pixel, DataFast): consent (Article 6(1)(a)). The tools are only loaded after you have chosen "Accept all".
  • Operations, security, troubleshooting and abuse prevention: legitimate interest in a secure and stable service (Article 6(1)(f)).

    • Consent can be withdrawn at any time, see sections 7 and 8.

    4. How long we keep the data

  • Account data, searches, saved trips and alerts: for as long as you have an account. If you delete your account (under Profile), the data is deleted or anonymised without undue delay.
  • Purchase and accounting documentation: five years after the end of the financial year, because the Norwegian Bookkeeping Act requires it.
  • Your cookie consent choice: until you change it or clear your browser data.
  • Statistics in Google Analytics: up to 14 months.
  • Technical logs: normally deleted or anonymised within 30 days.
  • Support enquiries by email: for as long as necessary to follow up the case.

    • 5. Processors and other recipients

    We use a set of sub-processors to deliver the service. Where the supplier processes personal data on our behalf they are processors, and we have entered into data processing agreements where this is required:

  • Supabase: database and authentication. Account data is stored in the EU (Ireland).
  • Stripe: payment processing. Stripe is additionally an independent controller for parts of its processing, connected to its own regulatory duties such as fraud prevention and anti-money-laundering rules.
  • Netlify: hosting and delivery of the website itself.
  • Resend: sending email (alerts, receipts, newsletters).
  • OpenAI: generates the answers in the AI chat.
  • Google (Analytics), Meta (Pixel) and DataFast: statistics and ad measurement — only if you have consented.

    • Seat maps are loaded from the third party seatmaps.com only when you open them yourself; seatmaps.com then receives your IP address in the same way as when you visit any website.

    Beyond this we disclose personal data only where we are legally obliged to, for example to public authorities. We never sell your personal data.

    6. Transfers outside the EU/EEA

    Account data, searches and alerts are stored with Supabase in the EU (Ireland). Some sub-processors — Stripe, Google, Meta, OpenAI, Netlify and Resend — process data in the USA. Such transfers take place on the basis of the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) and/or the EU Standard Contractual Clauses (SCC), with additional measures where necessary.

    7. Your rights

    Under Chapter III of the GDPR you have the right to:

  • Access which personal data we process about you (Article 15)
  • Have incorrect or incomplete data corrected (Article 16)
  • Have your data erased, the "right to be forgotten" (Article 17). You can delete your account yourself under Profile
  • Request that processing be restricted (Article 18)
  • Receive the data you have given us in a machine-readable format, and have it transferred to another service (data portability, Article 20)
  • Object to processing based on legitimate interest, and to direct marketing (Article 21)
  • Not be subject to fully automated decisions with legal effect for you (Article 22). We make no such decisions
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

    • To exercise any of these rights, contact us at hei@bonussok.no. It is free of charge, and we reply within one month at the latest. If you believe we process personal data in breach of the rules, you have the right to complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the supervisory authority in your own country.

    8. Cookies and local storage

    We distinguish between necessary and optional storage in your browser:

    Necessary (always set — the service does not work without them)

  • Your sign-in session (Supabase authentication, in the browser's local storage)
  • Your choices for theme, language and consent (including the key cookieConsentV2)
  • __stripe_mid (lifetime 1 year) and __stripe_sid (30 minutes) from the payment provider Stripe: fraud prevention at payment

    • Optional (set only after you have chosen "Accept all")

  • _ga and _ga_* from Google Analytics: usage statistics, lifetime up to 2 years
  • _fbp from Meta Pixel: ad measurement, lifetime 90 days
  • datafast_visitor_id and datafast_session_id from DataFast: statistics and campaign attribution, lifetime up to 1 year

    • If you choose "Only necessary", none of the optional ones are set. You can change or withdraw your choice at any time via the "Cookies" link at the bottom of the page — tracking then stops, and the tracking cookies are deleted. You can also delete cookies in your browser's own settings.

    9. Security

  • All traffic is encrypted (HTTPS/TLS)
  • Passwords are stored only as an encrypted hash
  • Database access is restricted with row-level access control, and each system has only the access it needs
  • Payment details are handled exclusively by Stripe (PCI DSS certified)

    • 10. Changes to this policy

    If we make material changes, we will notify you by email or clearly within the service before the changes take effect. The date at the top shows when the policy was last updated.

    11. Contact

    VIKSE DEVELOPMENT AS

    Company reg. no. 937 865 163

    Damsgårdsveien 18, 5058 Bergen, Norway

    Email: hei@bonussok.no

    👨‍✈️

    Before we take off

    We use necessary cookies for the service to work. Optional cookies for statistics are only set if you accept them.