Privacy Policy

For personal data processed via aival.no, AIVAL AS is the data controller.

• AIVAL AS, org. no. 836 909 232
• Korsveien 14, 1368 Stabekk, Norway
• Email: jesper@aival.no
• Phone: +47 908 20 330

When you submit the contact form on aival.no, we process:

• Name (required)
• Phone number (required)
• Email (optional)
• Company (optional)
• Message (optional)
• Submission timestamp

If you start a conversation with the voice-agent demo (ElevenLabs widget) on the site, audio and a transcript are transmitted to ElevenLabs in order to generate real-time responses. The demo is only activated when you actively click to start the conversation, and it is a separate website feature that is not part of the services we deliver to clients.

If you submit your contact details through a lead ad form (lead ads/instant forms) on Facebook or Instagram, Meta collects your name, phone number, email and your answers on the form, and transfers this data to AIVAL so that we can follow up with you.

We use Vercel Analytics for visitor statistics. Vercel Analytics does not use cookies and does not collect personally identifiable information.

We process personal data on the following legal bases:

• Responding to enquiries and preparing offers: legitimate interest and pre-contractual steps (GDPR art. 6(1)(b) and (f)).
• Providing the voice-agent demo: your consent when you initiate the conversation (GDPR art. 6(1)(a)).
• Collecting your contact details via Meta's lead ad form: your consent when you submit the form on Meta (GDPR art. 6(1)(a)), and legitimate interest for our subsequent follow-up (GDPR art. 6(1)(f)).
• Operating, securing and improving the website: legitimate interest (GDPR art. 6(1)(f)).

We do not use your data for marketing without your explicit consent, and we never sell personal data.

Who processes your data depends on whether you have used the website, or whether you were contacted on behalf of one of our clients, and in that case which product and setup the client has chosen.

For the website and our own marketing we use these suppliers:

When we deliver services to clients, we use sub-processors in these categories:

• hosting, database and job queue for the platform
• sending and receiving SMS
• language model that drafts SMS replies
• email notifications to the client's advisors
• CRM and SMS follow-up for certain clients on a legacy setup

Which suppliers are used for an individual client depends on product and setup and is stated in the data processing agreement with the client. The specific list is available on request from jesper@aival.no.

In the setup for financial institutions, processing takes place entirely within the EU/EEA. This covers hosting, SMS, language model and email notifications.

We do not disclose personal data to other third parties unless required by law.

Some sub-processors are established in the United States. Transfers take place under the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, under the EU-US Data Privacy Framework. The basis that applies to the website suppliers is shown in the table in section 4. For suppliers used in client deliveries it is stated in the data processing agreement.

In the setup for financial institutions, the SMS dialogue, the language-model calls and the email notifications are processed entirely within the EU/EEA.

• Contact-form enquiries: up to 24 months from last contact, after which the data is deleted.
• Lead ad form data from Facebook/Instagram: retained for up to 24 months from last contact, the same period as the website contact form.
• Voice-agent conversations: up to 90 days with ElevenLabs.
• Vercel Analytics: aggregated and anonymised, no long-term retention of individual visits.

You have the right to:

• access the data we hold about you
• rectify inaccurate data
• have your data erased
• restrict processing
• data portability
• object to the processing
• withdraw consent at any time

Send requests to jesper@aival.no. We respond within 30 days. You may also lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no).

We use TLS encryption for all data in transit, role-based access control following the principle of least privilege, and logging of access to personal data. Personal-data breaches are reported to the Norwegian Data Protection Authority within 72 hours.

When AIVAL delivers SMS services to clients (such as real-estate agencies and financial-services providers), we process personal data on behalf of the client under a separate data processing agreement. Which sub-processors are involved depends on whether the client uses the standard setup or the setup for financial institutions, see section 4.

In those cases the client is the data controller and determines the purpose of the processing. AIVAL:

• processes only data for which the client has obtained consent
• does not use personal data for our own purposes, marketing or product development
• does not use personal data to train, fine-tune or validate machine learning models
• deletes the data within 30 days of contract end, and conversation logs within 90 days at the latest

This does not prevent us from using anonymised and aggregated statistics that cannot be linked to individuals, to improve the service and in marketing.

Requests about how a specific client processes your data must be directed to that client as the data controller.

aival.no does not use any tracking or marketing cookies. Technical cookies may be used for basic functionality, such as remembering your language preference.

We may update this policy when services or regulations change. Material changes will be announced on the site at least 30 days before they take effect. The date of the most recent update is shown at the top of the page.