Last updated 6 October 2026

Privacy Policy
 

Daily Pot AS · Org.nr 917 104 611 · Vaskerelven 21, 5014 Bergen · post@dailypot.no

Daily Pot AS runs the Daily Pot app. This page explains what personal data the app collects, why, how long we keep it, and what you can do about it. We are the data controller for that data.
 

1. What we collect, and why

Your account
When you create an account we store your name, email address and an encrypted form of your password. You may optionally add a phone number and birthday. If you sign in with Apple or Google, we receive your name and email address from them instead of a password. With Apple, the email address may be Apple's private relay address instead of your real one.

Why: to give you an account and let you sign back into it.

Legal basis: performance of a contract — GDPR Art. 6(1)(b).
 

Orders and payments
When you order, we store what you ordered, the amount, the time, the payment method, whether it was paid, and a payment reference from the payment provider.

We never see or store your card number. Card and Apple Pay payments are handled entirely by Stripe, and Vipps payments by Vipps MobilePay. They send us only a reference and a result.

Why: to take your order, take payment, and issue a receipt.

Legal basis: performance of a contract — Art. 6(1)(b); and, for keeping the sales record afterwards, a legal obligation — Art.
6(1)(c). See section 4.

Gift cards
If you buy a gift card for someone else, we store the recipient's name and email address, along with the card's code, value, balance and redemption history, and any message you add. We use the recipient's email address only to deliver the gift card and its confirmation, and never for marketing. The recipient is not signed up for anything by receiving a gift card.

Why: to deliver the gift card and let the recipient redeem it.

Legal basis: performance of a contract with you as the buyer — Art. 6(1)(b); and our legitimate interest in delivering the gift you asked us to send — Art. 6(1)(f).

Loyalty points and perks
We store your points balance and history, your tier, your member code, which loyalty cards you have tapped and when, and any perks you have redeemed or used. We also record the days you visit (one per day, counted from purchases, card taps and perks) to work out your tier.

We record the time of each card tap per member so the same person cannot collect from the same card repeatedly within a short window.

Why: to run the loyalty programme and prevent abuse of it.

Legal basis: performance of a contract — Art. 6(1)(b); abuse prevention is our legitimate interest — Art. 6(1)(f).

Table reservations
If you book a table we store the date, time, number of guests, any notes you add, and the phone number and email you give for the booking. This is shared with Wix, which runs our reservation system and sends your confirmation email.

Why: to make and confirm your booking.

Legal basis: performance of a contract — Art. 6(1)(b).

Push notifications
If you allow notifications, we store a push token identifying your device, so we can tell you when your order is ready. If you have also opted in to offers (see below), we use the same token to send them.

Why: to send you notifications you asked for.

Legal basis: your consent — Art. 6(1)(a). You can withdraw it at any time in your device settings; we delete the token when you sign out.

Offers and marketing
If you choose to receive offers, we send them by push notification and email. We only do this with your consent, and it is entirely optional: you can use the app, order and earn loyalty points without it. We send offers using the contact details you already gave us (your email address and your device's push token), and we do not build a marketing profile from your orders to target them.

You can turn offers off at any time under Profile in the app, and every marketing email also has an unsubscribe link. Turning offers off does not affect order notifications or receipts.

Why: to tell you about offers and news you asked to hear about.

Legal basis: your consent — Art. 6(1)(a), and section 15 of the Norwegian Marketing Control Act (markedsføringsloven).

Crash and error reports
If the app crashes, we receive a crash report containing your account's internal ID, your device model, OS version, and technical details of the fault. We have deliberately configured this not to include your name, email, or order contents.

Why: to find and fix faults.

Legal basis: our legitimate interest in a working app — Art. 6(1)(f).

What we do not do
We do not use advertising trackers, we do not build marketing profiles, we do not sell or rent your data to anyone, and we do not collect your location.

2. Who else processes your data

Each of these acts as our processor, handles only what its job requires, and is bound by a data processing agreement.

• Supabase — database and sign-in. Ireland (EU).
• Stripe — card and Apple Pay payments. EU/US, under EU Standard Contractual Clauses.
• Vipps MobilePay — Vipps payments. Norway/EEA.
• Wix — table reservations and confirmation emails. EU/US, under EU Standard Contractual Clauses.
• Expo — delivers push notifications, including offers, to your device. US, under EU Standard Contractual Clauses.
• Postmark — sends account emails, such as password resets. US, under EU Standard Contractual Clauses.
• Sentry — crash reports. EU/US, under EU Standard Contractual Clauses.
• Google — optional "Sign in with Google", and Android push notifications via Firebase. EU/US, under EU Standard Contractual Clauses.
• Apple — Apple Pay and optional "Sign in with Apple". EU/US, under EU Standard Contractual Clauses.

Your account data, orders and loyalty history are stored in the EU (Ireland).

We may also disclose data where the law requires it — for example to tax authorities, or in response to a valid legal order.

3. Legal bases, summarised

• Account, orders, reservations, loyalty — contract, Art. 6(1)(b).
• Gift cards — contract and legitimate interests, Art. 6(1)(b) and 6(1)(f).
• Keeping sales records for five years — legal obligation, Art. 6(1)(c).
• Crash reporting and preventing loyalty abuse — legitimate interests, Art. 6(1)(f).
• Push notifications, and offers by push or email — consent, Art. 6(1)(a).

4. How long we keep it

• Account details (name, email, phone, birthday) — until you delete your account, at which point they are erased immediately.
• Sales records (orders, payments, receipts) — five years after the end of the financial year, because the Norwegian Bookkeeping Act (bokføringsloven § 13) requires it. GDPR Art. 17(3)(b) permits us to keep these despite a deletion request.
• Reservations, push tokens, loyalty passes — deleted when you delete your account.
• Marketing consent and contact preferences — deleted when you delete your account, or when you turn offers off.
• Gift card recipient details — gift card balances never expire, so we delete the recipient's name and email address three years after the card was last used (or bought, if it was never used). The card itself stays valid and can still be redeemed with its code. The sale itself is kept as a sales record for five years (see above).
• Crash reports — kept for up to 90 days, then deleted automatically.

What deleting your account actually does
Your name, email, phone and birthday are erased, your loyalty balance is cleared, and your login stops working — immediately and permanently.

Your past sales records are kept for the five years the law requires, but with the link to you removed. They can no longer be traced back to a named person.

5. Your rights

Under the GDPR you may:

• See what we hold about you (Art. 15).
• Correct anything wrong (Art. 16).
• Delete your account and personal data (Art. 17) — you can do this yourself in the app, under Profile → Delete Account, without contacting us.
• Get a copy of your data in a portable format (Art. 20).
• Restrict or object to processing based on our legitimate interests (Art. 18 and 21).
• Withdraw consent for notifications and offers at any time, without affecting anything we did beforehand.

Write to us at post@dailypot.no and we will respond within one month.

If you think we have handled your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no), or to the supervisory authority where you live.

6. Security

Passwords are never stored in readable form. Data is encrypted in transit. Access to the database is restricted per-user at the database level, so one customer's account cannot read another's. Payment credentials never reach our systems at all.

7. Children

The app is not aimed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

8. Changes to this policy

If we change how we use your data, we will update this page and change the date at the top. Significant changes will be announced in the app.

9. Contact

Questions about anything on this page, or about your own data, come straight to us.

Daily Pot AS
Vaskerelven 21, 5014 Bergen, Norway
Org.nr 917 104 611
post@dailypot.no

Goodness, served round.