Små Helter privacy policy

1. Who is responsible?

Cateno AS (Norwegian organisation no. 886 658 532), Spjelkavikvegen 132, 6010 Ålesund, Norway, is the controller for Små Helter. Send privacy and support enquiries to support@smahelter.no.

2. Who and what this policy covers

This policy covers the Små Helter mobile app, smahelter.no and the services used by the app. A parent creates and manages the family. Child profiles are used under the parent’s responsibility and do not have separate email sign-in.

3. Data we process

• Account and family: names, email address, family and profile names, language, password hash and optional birth details entered by the parent.
• Use of the service: chores, assignments, submissions, approvals, progress, stars, coins, rewards and family activities.
• Photos: images the family chooses to attach as evidence for a chore. Photos are not a public feed.
• Device and security: device name, platform, technical device identifier, sessions, IP address, user agent and security events.
• Sign-in and messages: email verification, password recovery, transactional email delivery status and, if selected, basic profile details from Apple, Google, Vipps or Facebook.
• Optional integrations: details and access tokens needed if a parent connects an external calendar.

The website does not use analytics, advertising trackers, tracking pixels or external fonts.

4. Why we use the data

We process data to create and provide the family service, authenticate users, show the correct family content, send essential service messages, handle support, protect the service against misuse and meet legal obligations. The legal basis is normally the agreement with the account holder, our legitimate interest in secure and stable operation, and legal obligations where applicable. We do not use the data for behavioural advertising or cross-service tracking.

5. Providers and sharing

Information is available to people in the same family according to their role and parent-controlled choices. We use hosting and database services to provide the service, Resend for transactional email when production delivery is enabled, and the selected sign-in or calendar provider when a parent requests the integration. Providers receive only the information needed for their task. We do not sell personal data.

Some providers may process data outside Norway or the EEA. Such transfers must use a valid transfer mechanism and appropriate safeguards.

6. Security and retention

Controls include encrypted transport, access control, secure password hashing, short-lived access tokens and encrypted storage of photo evidence and certain provider tokens. We retain information while the account is used or while it remains necessary for its purpose. Unused image uploads are cleaned automatically, security data is kept only as long as needed to address abuse, and deleted data is removed from active systems through a controlled process.

Protected backups have an operational cleanup target of 14 days. A separate erasure journal prevents deleted accounts from being restored from an older backup. Data may be kept longer when required by law, a dispute, security needs or documented misuse.

7. Your rights

You may request access, correction, deletion, restriction, portability or object to processing when data-protection law provides that right. Parents can delete an account in the app under Profile → Delete account. If the app cannot be opened, follow smahelter.no/en/delete-account/. You can also contact support@smahelter.no. We may request proportionate identity verification before disclosing or deleting data.

You may complain to the Norwegian Data Protection Authority.

8. Changes and contact

We update this policy when the service or processing changes. Material changes are communicated in the app or through the contact information associated with the account. See also the terms and support page.