DRAFT – not legally reviewed. The text must be checked by a lawyer before it is used, and the fields marked [PLACEHOLDER] must be filled in. The Norwegian version is authoritative.

Privacy notice

Last changed: [PLACEHOLDER: date]

1. Who is responsible

Mimir Lineage is run by [PLACEHOLDER: full name] as a private individual, [PLACEHOLDER: postal address]. Send privacy questions to [PLACEHOLDER: e-mail address]. The operator of Mimir Lineage is the controller for the accounts and for what the service itself decides – storage, sharing and security.

2. About the service

Mimir Lineage is a genealogy tool in a closed beta. You enter information about persons, their relationships and the sources the information is based on. Trees are private: only people you invite can see them.

3. What we process

• Your account: name, e-mail address, language, your password as a secure hash (never in plain text), passkeys (the public key only) and any two-step sign-in settings.
• What you record in trees: persons – including living ones –, names, dates, places, relationships, sources, transcriptions and images of sources. Location, camera data and other metadata are removed from images on upload.
• Change history: who changed what in a tree, and when. It is visible to the tree's members.
• Technical logs: events for operation and security, with internal ids – never names, e-mail addresses or tree content.
• E-mail we send: address confirmation, password resets, invitations and receipts for important changes.
• The waitlist: the e-mail address and language you signed up with, and when you confirmed and were invited. Unconfirmed addresses are deleted after 7 days, invited ones 90 days after the invitation is sent.

We never ask for national identity numbers, and you must not record them.

4. Purposes and legal basis

• Providing the service you asked for – account, trees, sharing (contract, GDPR Art. 6(1)(b)).
• Security, abuse prevention and troubleshooting (legitimate interest, Art. 6(1)(f)).
• Information about other persons in trees: you are responsible for being allowed to record them. The service gives living persons extra protection – see section 6 – and processes them on the basis of a legitimate interest in genealogy, with strict limits. [PLACEHOLDER: to be assessed by a lawyer]

5. Who has access

• The members you invite to a tree, with the role you give them.
• Support only when the tree's owner has explicitly given time-limited permission. The access is read-only, and every lookup is shown to the owner.
• Processors: e-mail provider [PLACEHOLDER: provider and country]. During the beta the service runs on hardware in Norway owned by the operator. [PLACEHOLDER: backups – provider and country]

We do not sell information, do not use it for advertising and do not share it with others.

6. Protection of living persons

A person counts as living unless a death or burial is recorded, the owner has marked the person as deceased, or the birth was more than 110 years ago. Living persons are shown only to members the owner has explicitly given access. Information such as adoption, donors, surrogacy, gender transition and earlier names of living persons needs a further permission.

7. Storage and deletion

• Your account is kept until you delete it. You can delete it yourself once you no longer own any trees.
• A tree is kept until its owner deletes it. Then everything in it is deleted – persons, sources, images and change history.
• Technical logs are deleted after [PLACEHOLDER: number of days].
• Backups are deleted after [PLACEHOLDER: number of days].

8. Your rights

You have the right to access, rectification, erasure and data portability. Much of this you can do yourself: change information in the app, download a tree as a JSON file and delete the tree or your account. You can also object to processing and ask for restriction. Contact [PLACEHOLDER: e-mail address]. You can complain to the Norwegian Data Protection Authority, Datatilsynet.

9. If you are in someone's tree

If someone has entered information about you and you do not want that, contact [PLACEHOLDER: e-mail address] – also if you have no account. We contact the tree's owner and make sure the information about you is corrected or removed where you are entitled to it.

10. Cookies

We only use cookies that are necessary for sign-in and security to work. No tracking, no third-party analytics.

11. Changes

Material changes to this notice are announced by e-mail before they take effect.