Privacy statement

Last updated 7 October 2026

This statement explains what happens to your information when you use Leierett.no, and what rights you have.

Who is responsible

Sandnes AI ENK (org. no. 833 064 142), Norway, is the data controller. Send questions about privacy to mathias@sandnes.ai.

What information is processed

• What you write: your question and the most recent messages in the conversation, which are sent along each time so the answer makes sense.
• Documents you upload: the text of the PDF (your lease, for example). The server extracts the text and sends it back to your browser. The file itself is not stored.
• Your choices: the website language, and the language for letters to your landlord.
• Technical data: IP address, time and the page you visited, in our hosting provider's logs. Your IP address is also held in memory for a short while to limit how many messages can be sent, so the service isn't abused.

The server only handles your messages while it prepares the answer. We never write the content of messages to logs or databases.

Storage on your device

Conversations, saved cases, text from uploaded documents and your choices are stored in your browser (localStorage), not with us. They stay there until you delete them. You can delete a single conversation or case from the menu, or everything at once here:

Delete all my data

If you use a shared computer, delete your data when you're done.

What we use the information for

• Answering your question: finding the relevant sections of the Norwegian Tenancy Act and writing the answer, next steps and draft letters. The legal basis is our legitimate interest in offering a free information service that you ask for (GDPR Art. 6(1)(f)).
• Security and operations: logs and limits on the number of messages, to keep the service stable and prevent abuse. The legal basis is our legitimate interest in a safe service (Art. 6(1)(f)).

We don't send newsletters or marketing, don't sell information, don't profile you and make no automated decisions about you. The answers are legal information for you to weigh up yourself.

Who receives the information

Providers that process information on our behalf, under a data processing agreement:

• Anthropic: the AI model that writes the answers. Anthropic, PBC, USA. Receives the text you send and the text of documents you've uploaded. Deletes it within 30 days. Doesn't use it to train models. If a request is flagged for breaking Anthropic's usage policy, it may be kept for up to 2 years. Transfer: EU Standard Contractual Clauses.
• Railway: server hosting. Railway Corporation, USA. Receives technical logs (IP address, time, page), deleted after up to 30 days. Transfer: EU Standard Contractual Clauses.

Everything the website needs, such as code, styling and icons, comes from our own server. No other services see that you visit the site.

We only hand information to authorities when the law requires it. As we don't store conversations, there is usually nothing to hand over.

Transfers outside the EEA

Anthropic and Railway are US companies, and your information may be processed in the USA. The transfers rely on the EU Standard Contractual Clauses in the data processing agreements. You can ask for a copy of these safeguards at mathias@sandnes.ai.

How long information is kept

• By us: not at all. Your messages exist on the server only while the answer is being prepared.
• By Anthropic: up to 30 days (up to 2 years if a request is flagged, see above).
• Technical logs at Railway: up to 30 days.
• In your browser: until you delete it.

Your rights

You have the right to access, correct and delete your information, to restrict processing, to data portability, and to object to processing based on our legitimate interest. Because we don't store conversations and don't know who you are, we usually have nothing about you to show or delete. You can see and delete your conversations yourself in your browser.

If you have questions, email mathias@sandnes.ai. We reply within 30 days, free of charge. If you think we're processing information unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Cookies

We use no cookies for analytics, tracking or advertising. The website sets only two, both needed for it to work:

• lang: the language you chose (kept for one year).
• csrf_token: a security code that stops other websites from sending forms in your name (kept for one day).

These, and what is stored in your browser so you can see your conversations, don't require consent (Norwegian Electronic Communications Act, section 3-15).

Tips when you write

Write what's needed to understand your situation, but no more. You don't need to give your national ID number, bank account, passport number or full names. You can fill in details like these yourself in the draft letters before you send them. Avoid health information and other sensitive details unless they matter for your case.

Changes

We update this statement when the way we process information changes.

• 7 October 2026: first version.