Privacy policy

This is a translation. The Norwegian version applies if the two differ.

Last updated: 6 April 2026

1. Who are we?

Sparebørsen is a cashback service that lets you earn money back when you shop with our partner stores. The service is operated by Mosel AS (org. no. 937 308 809), based in Bergen, Norway. Contact: personvern@spareborsen.no.

2. What data do we collect?

We collect the following personal data:

• Account information: Name, email address and, if you log in with Vipps, your phone number.
• Purchase data: Information about purchases made through our affiliate links, including the store, the amount and the time.
• Technical information: IP address, browser, device and operating system, to keep the service working properly.
• Cookies: We use necessary cookies for login and affiliate tracking, including a device ID (the “sb_did” cookie, lifetime 180 days).
• Click and account events: When you click through to a partner store, we record the time, the partner store, your IP address, browser information and device ID. The same is recorded when you register and when you log in. The purpose is to link purchases to the right account, including purchases you made before you registered, so that you receive the cashback you are entitled to, and to prevent misuse. This data is kept for no longer than 180 days and is processed on the basis of legitimate interest (GDPR art. 6(1)(f)).
• Order confirmations for cashback claims: When you submit a cashback claim, you upload the order confirmation from the store (PDF or image). It is used solely to verify your claim and is deleted automatically no later than 90 days after the case has been decided.

3. Why do we process the data?

• To deliver the cashback service and track your purchases.
• To create and manage your user account.
• To pay out the cashback you have earned.
• To improve the service and the user experience.
• To meet legal obligations (accounting, tax).

4. Legal basis

We process personal data on the basis of: our agreement with you (GDPR art. 6(1)(b)), legitimate interest (GDPR art. 6(1)(f)), and consent where required (GDPR art. 6(1)(a)).

5. Who do we share data with?

• Affiliate networks: Adtraction, TradeDoubler, Awin and others, to track and confirm purchases.
• Payment providers: For paying out cashback.
• Technical providers: Hosting and infrastructure (Vercel, PostgreSQL).

We never sell your personal data to third parties.

6. Storage and deletion

Personal data is kept for as long as you have an active account. When you delete your account, your data is removed within 30 days, except for data we are legally required to keep (a maximum of 5 years for accounting purposes). Click and account events containing IP address and device ID are deleted automatically after 180 days.

7. Your rights

You have the right to:

• Access the data we hold about you.
• Have incorrect data corrected.
• Have your data deleted.
• Data portability: receive a copy of your data.
• Withdraw your consent.
• Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

8. Specific provisions for Sparebørsen for Business (merchant subscription)

When a store subscribes to Sparebørsen for Business and sends customer transactions to us (via the tracking script, the Shopify integration, the Zettle integration or manual registration), Mosel AS acts as data processoron the store's behalf for the customer data the store sends us (email address, phone number, SPB code, transaction amount). The store is the data controller for this data under the GDPR.

A data processing agreement (DPA) is entered into automatically when a merchant registers, as part of the terms of use. We:

• Keep customer data only for as long as necessary to deliver cashback
• Never share customer data with other merchants
• Anonymise customer data on request (GDPR art. 17) via the dashboard
• Process data within the EU/EEA (hosted in Norway via Hostinger)

8.1 Payment data for merchants

Invoicing and payment handling for merchant subscriptions are carried out by Paddle.com Inc. (US/EU) as merchant of record. Paddle receives card details and billing information directly; Mosel AS never stores card details. See Paddle's privacy policy for how they process your payment data.

8.2 Sub-processors

When you use Sparebørsen for Business, we may use the following sub-processors:

• Hostinger: hosting and operation of the platform (EU/Lithuania)
• Paddle.com Inc.: invoicing and payment (US/EU)
• Resend: transactional email (US, with EU compliance)
• Shopify, Zettle: when an integration with these services is active

9. Analytics, marketing and tracking

9.1 Statistics (without cookies)

We use Plausible Analytics to measure traffic and use of the service. Plausible does not collect personal data, uses no cookies and does not identify you. No data is transferred outside the EEA.

9.2 Analytics and ad tracking (only with your consent)

If you consent via our consent banner, we activate the following services. The legal basis is GDPR art. 6(1)(a), consent, and it can be withdrawn at any time by clicking “Cookies” at the bottom of the page.

• Google Analytics 4: statistics and user behaviour. Data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework (DPF).
• Google Ads: ad conversions. Processed by Google LLC (USA), under the DPF.
• Meta (Facebook/Instagram): ad conversions and audience matching. May transfer data to the USA under Standard Contractual Clauses (SCC).
• TikTok: ad conversions. May transfer data to the USA and Singapore under SCC.
• Snapchat: ad conversions. May transfer data to the USA under SCC.
• Microsoft / Bing Ads: ad conversions. Data is processed by Microsoft Corporation (USA), under DPF/SCC.
• Pinterest: ad conversions. May transfer data to the USA under SCC.
• X (Twitter) Ads: ad conversions. May transfer data to the USA under SCC.
• Reddit Ads: ad conversions. May transfer data to the USA under SCC.

See our cookie page for a full overview of all the cookies and tracking we use.

9.3 Affiliate attribution (necessary)

To register cashback and credit it to your account, we use affiliate tracking: when you click through to a partner store via Sparebørsen, a first-party subId (a pseudonymous identifier) is stored with us and with the affiliate network in question (see section 5). This is necessary for the service to work and is processed on the basis of our agreement with you (GDPR art. 6(1)(b)). No third-party advertising cookies are set at this step.

10. Contact us

Questions about privacy? Contact us at personvern@spareborsen.no