Privacy statement
How we handle information about the people who visit Nordlyskart, under the General Data Protection Regulation (GDPR) articles 13 and 14 and the Norwegian Personal Data Act.
Last updated October 2026
Controller
The controller is Myrull Media AS, which runs nordlyskart.no. If you have questions about your information, write to us with .
What information we handle
- Statistics with Google Analytics 4, only if you accept it in the cookie banner: the pages you visit, how long you stay, the type of device and browser, and your approximate country and city. Google Analytics 4 does not store IP addresses. See also the cookie policy.
- Technical information. As on every website, the hosting provider records some technical information about requests for security and operation, such as the IP address, the time and the page opened.
- The map. The aurora map fetches its map tiles from OpenFreeMap, which then sees your IP address and which tiles are fetched, as any service you load content from does.
- Consent log. When you make a choice in the banner, we store a random code, the choice, how you made it, the banner version, the page and the date and time. We do not store names, e-mail addresses or IP addresses.
- Contact form. If you write to us, we handle your name, e-mail address and the message, which is sent to us by e-mail through Resend. To protect the form against spam we use Cloudflare Turnstile, which handles some technical information about the browser to check that the message does not come from a program. It loads only when you open the form.
We do not sell information to anyone and do not use it for advertising. You do not need to register to use the site.
Purposes and legal basis
- Google Analytics: your consent (GDPR article 6(1)(a)), which you can withdraw at any time under “Cookie settings” at the foot of every page.
- Consent log, to be able to document consent: legal obligation (GDPR article 6(1)(c) and article 7(1)).
- Security and operation of the site, including the map and spam protection: legitimate interest (GDPR article 6(1)(f)).
- Replies to messages sent with the contact form: to answer your enquiry (GDPR article 6(1)(b)).
Who receives the information
The information is handled by providers working for us, each only for its own task: hosting (Vercel), storage of the consent log (Upstash), sending e-mail (Resend), spam protection (Cloudflare), map tiles (OpenFreeMap) and statistics after consent (Google).
We do not share the information with others unless the law requires it.
Transfers outside the EU/EEA
Some providers, among them Google, Vercel, Resend and Cloudflare, may handle information in the United States. The transfer rests on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses (GDPR articles 45 and 46).
Google’s privacy policy: policies.google.com/privacy.
How long we keep the information
- Google Analytics: 2 months, after which Google Analytics deletes it automatically.
- Consent log: 2 years, after which it is deleted automatically.
- Technical information: a short period, under the provider’s rules.
- Messages: as long as needed to answer, then deleted, unless the law requires otherwise.
Your rights
You have the right of access to your information and to ask for rectification, erasure, restriction of processing and data portability. You can also object to processing based on legitimate interest (GDPR articles 15–22).
- Messages you have sent us: write to us with and give the e-mail address you used. We answer to that address within a month, with a copy of the information or confirmation that it has been deleted.
- Statistics and technical information: these are tied to a random identifier in the browser, not to your name or e-mail address, so we cannot link them to you (GDPR article 11). If you want them deleted, you can give us the identifier in the _ga cookie in your browser. The simplest is to decline or withdraw consent under “Cookie settings”, as explained in the cookie policy.
You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet.
Changes
We may update this statement. Changes are published on this page with the date of the latest revision.