Privacy Policy | FjordID

Privacy policy

Last updated: 2026-10-29

FjordID is operated by polarmake, Norway. In this policy "we" means polarmake as operator of FjordID.

Two roles

Processor. When your users sign in to an application that uses FjordID, the application owner (our customer) decides why and how their data is used. We process it on their behalf. If you are such an end user, contact the application owner about your data; they are the controller.

Controller. We decide how data is used for our own website, for customer accounts on fjordid.eu (the people who sign up to create apps) and for billing. This policy covers that in full, and describes the processor role so customers can see what we hold.

What we store

Identity data for customers' applications (processor)

  • In Keycloak: username and email address, name and any profile attributes the application uses, a salted password hash, sessions, and whether the email address is verified.
  • Login events: Keycloak records successful logins in the shared realm and keeps those events for 30 minutes. The FjordID API reads them to keep, per app and per user, the Keycloak user ID, email, username, first and last login time and login count, which feed the sign-up and login counts in the console.
  • Sign-up notification state: whether a customer's team has been emailed about a new sign-up in their app.

Customer accounts and billing (controller)

  • Name and email address of console users, the tenant and team they belong to, apps they configure (names, client IDs, redirect URIs), hashed API keys and an audit log of console actions.
  • Subscription and payment status. Payments are handled by Mollie; card numbers never reach us.
  • Email we send you: verification, password reset, magic links and notifications.
  • Messages you send to our support and privacy addresses.

Our website (controller)

  • Page views and basic technical data go to cookieless, self-hosted Umami analytics that we run ourselves. No third party receives them.
  • We do not use an error-reporting vendor. Errors from the portal and API are written only to our own server logs.

Where it is stored and who receives it

Databases and backups are on Hetzner servers and storage in Germany. Brevo (France) sends our email, Mollie (Netherlands) handles payments, and Mistral AI (France) receives the app description when a customer uses the optional AI configuration assistant. We use no error-reporting vendor; errors stay in our own logs. The full table, with what each receives, is on the subprocessors page. We do not sell personal data. SMS login through Sinch is planned but not enabled: we collect no phone numbers and send nothing to Sinch today, and this policy will be updated before it is switched on.

Cookies

  • Sign-in uses Keycloak's session cookies on our authentication host, which are needed to keep you signed in. The login pages also set a language cookie, KEYCLOAK_LOCALE, for one year.
  • We do not use advertising or cross-site tracking cookies. Our analytics is Umami, which is designed to work without cookies.

How long we keep data

  • Accounts that register but never confirm their email address are deleted automatically after 7 days.
  • Keycloak login events: 30 minutes.
  • Local database backups: 7 days. Copies uploaded to Hetzner Object Storage have no automatic expiry set by us.
  • Per-app login records are deleted when the app is deleted. Apart from that we do not run automatic deletion of end-user accounts: the application owner decides when a user is removed.
  • For everything else we keep data while the account or app exists and delete it on request, unless the law requires us to keep it (for example billing records).

Your rights

You can ask for access, correction, deletion, restriction, portability or to object, and you can withdraw consent where we rely on it. Email privacy@fjordid.eu. If you are an end user of a customer's application, we will pass your request to that customer. You can also complain to your data protection authority.

Customers: data processing agreement

Customers who use FjordID to sign in EU/EEA residents need a data processing agreement with us. Request it at privacy@fjordid.eu. You are responsible for your own privacy notice to your end users and for having a legal basis to process their data.

Changes

We update this page when our practice changes; the date above shows the latest revision. Security details are on the security page.