Privacy Policy & Data Protection Statement
Effective Date: January 1, 2026 · Last Updated: November 1, 2026 · Governed by EU General Data Protection Regulation (GDPR) (EU 2016/679) & Norwegian Markedsføringsloven § 15.
This Privacy Policy describes how Trivela AS ("Trivela", "we", "us", or "our") collects, processes, and protects your personal data when you interact with the MobileScout Web Application, Mobile PWA, API endpoints, and the Windows Tray Companion (MobileScoutCompanion.exe). We prioritize minimal data collection, robust isolation across user saves, and strict compliance with European privacy standards.
1. Data Controller Identity & Contact
The Data Controller responsible for the processing of personal data under the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven) is:
Registration Address: Oslo, Norway
Official Privacy & Data Protection Officer Contact: privacy@trivela.no
General Customer Support: support@trivela.no
2. Categories of Personal Data Processed
MobileScout adheres to the principle of data minimization (GDPR Article 5(1)(c)). We categorize processed information into four distinct streams:
A. Account & Authentication Data
When authenticating with MobileScout, we process your verified email address and internal authentication subject ID via one of two supported pathways:
- Google SSO (OAuth 2.0): We request strictly minimal, non-sensitive standard scopes:
openid,email, andprofile. We do not request or store Google Drive, Gmail, or contact list permissions. - 6-Digit Email One-Time Password (OTP): Delivered directly via Supabase Auth and Resend. No password is stored on our servers.
B. Career Save Scouting Snapshot Data (Non-PII In-Game Game State)
To display your tactical team sheets and recruitment ratings, our read-only Windows tray companion transfers snapshot payloads comprising in-game Football Manager™ (FM26 & FM27) state: fictional or licensed in-game player numeric UIDs, in-game club names, savegame in-game dates, and user shortlist selections. This data represents in-game simulation states, contains zero personal real-world identifers, is strictly read-only, non-cheat sanitized, and is scoped exclusively to your tenant identifier.
C. Marketing Consent Records (Norwegian Markedsføringsloven § 15 Compliance)
Pursuant to Section 15 of the Norwegian Marketing Control Act (Markedsføringsloven § 15), direct electronic marketing is never dispatched without prior explicit, verifiable opt-in consent. We store your marketing_opt_in flag, consent timestamp, IP address, and acquisition source. Every commercial update includes an automated 1-click unsubscribe mechanism that instantly synchronizes to our Supabase database.
D. Payment & Entitlement Metadata (Stripe Tokenized Billing)
When purchasing search packs or subscriptions, your transaction is processed directly by Stripe Payments Europe, Ltd. Full payment card numbers are processed exclusively by Stripe and never touch MobileScout servers. Trivela AS never handles, transmits, or stores raw credit or debit card numbers or CVC codes. We store solely non-sensitive payment metadata: Stripe Customer ID, Subscription ID, plan tier, entitlement quota balance, and billing lifecycle timestamps.
3. Named Sub-Processors & Processing Regions
We engage vetted third-party service providers (sub-processors) under binding Data Processing Agreements (DPAs) incorporating standard contractual clauses (SCCs) and technical safeguards:
| Sub-Processor | Role & Activity | Hosting Region | Data Processed |
|---|---|---|---|
| Supabase (EU) | Authentication, Postgres Database, Row-Level Security | European Union (Frankfurt / Ireland) | Email, Auth ID, savegame snapshot records |
| Vercel Inc. | Next.js edge runtime, serverless hosting, CDN | Global Edge Network (EU primary) | Request logs, IP headers, transient web traffic |
| Stripe Payments Europe Ltd. | PCI-DSS Level 1 payment processing & billing portal | Ireland (EU) & Global | Payment details, invoices, customer tokens |
| Resend, Inc. | Transactional OTP emails & opted-in notifications | United States / EU DPA | Recipient email address, message dispatch logs |
| Cloudflare Turnstile | Bot detection, anti-abuse, OTP flood defense | Global Edge | Browser telemetry signals, client IP (hashed) |
| TypeSafe Jev (jev-1.14.0) | Typed AI recruitment verdicts & squad role analysis | Secure API Infrastructure | Anonymized in-game FM attributes only (Zero user PII sent to Jev) |
4. Your Rights Under GDPR & Norwegian Law
Under Chapters III of the GDPR and Norwegian data protection statutes, you possess unequivocal rights regarding your personal data:
- Right of Access (Article 15): Request confirmation and an exportable copy of all personal data held by Trivela AS associated with your account.
- Right to Rectification (Article 16): Request correction of inaccurate or incomplete account information.
- Right to Erasure / Account Deletion ("Right to be Forgotten", Article 17): Permanently delete your MobileScout account, stored career snapshots, shortlists, and authentication records upon request.
- Right to Data Portability (Article 20): Receive your personal data and saved shortlists in a structured, commonly used, and machine-readable format (.json / .fmf).
- Right to Restriction of Processing (Article 18): Restrict processing during active disputes or verification processes.
- Right to Withdraw Consent (Article 7(3) & Markedsføringsloven § 15): Withdraw marketing consent anytime via the 1-click unsubscribe link in any email or by toggling notification preferences in your account dashboard.
- Right to Lodge a Complaint with a Supervisory Authority: If you believe our data processing infringes applicable privacy regulations, you have the statutory right to file a complaint with the Norwegian Data Protection Authority:
Datatilsynet · Postboks 458 Sentrum, 0105 Oslo, Norway · Website: datatilsynet.no
To exercise any of these rights, contact us at privacy@trivela.no. We acknowledge and fulfill verified subject requests within 30 days without fee.
5. Data Retention, Security & Isolation
All database interactions are protected via Supabase Row-Level Security (RLS) policies enforcing multi-tenant isolation. Career save snapshot records are tied to unique tenant tokens; users cannot access or view scouting data from other accounts.
We retain account data for the duration of your active relationship with MobileScout. Inactive accounts with zero activity for 18 continuous months are scheduled for automated purge, unless retention is required by Norwegian accounting and tax statutes (Bokføringsloven).