Privacy Policy

Last updated: 11 August 2026

Who we are

Syncmap AS (org. nr. 936393047), Svingen 16, 3801 Bø i Telemark, Norway.

For anything in this policy, write to [email protected].

When this policy applies

Syncmap has two different relationships with personal data, and it matters which one you are in.

We are the data controller of this website, the Syncmap demo, enquiries from organisations who want to start using Syncmap, support correspondence, and invoicing.

We are a data processor whenever an organisation uses Syncmap to handle information about you. That includes the obvious case, where your device is enrolled with a fire service and you use the app yourself. It also includes information an organisation records about you without you using Syncmap at all – a position from tracking equipment it operates, a photograph taken at a mission, a note naming you. In all of these the organisation is the data controller. They decide what is collected, how long it is kept, and who may see it.

This policy still describes what Syncmap does with that data – how positions are recorded, what is stored where, who processes it on our behalf. What it cannot tell you is why your organisation chose to collect something, or what else they do with it. For that, ask them. Our obligations to them are set out in our terms of use and the accompanying data processing agreement, which uses the European Commission’s standard contractual clauses for controllers and processors, and nothing here overrides any of it.

What we collect, and why

This website and the demo in your browser

We use Plausible Analytics to count visits to our websites and to Syncmap when it runs in a web browser. Plausible sets no cookies and assigns no identifier to you. It processes your IP address in passing to derive an approximate country and device type, and does not store it. We see page counts, referrers and countries – never individuals.

Our basis is legitimate interest (GDPR Art. 6(1)(f)): we need to know roughly how the site is used, and this is the least intrusive way we know of to find out. Because nothing is stored on your device and no identifier is created, we do not ask for consent under ekomloven § 3-15. If you would rather not be counted at all, most browser tracker-blockers will stop it.

The Syncmap apps contains no analytics at all. It measures nothing about how you use it and contacts no analytics service, whether you are using the demo or working on a real mission.

The Syncmap demo

The demo lets you try Syncmap without an account and without signing in. There is nothing to register and we do not ask who you are.

Whatever you draw, type or photograph in the demo is stored on our servers so that it survives a page reload and can be shared. Two things follow from how the demo works:

• Anyone with the demo link can open, read and edit the same document. Demo links are meant to be handed around at trade fairs and demonstrations. There is no access control on them.
• Please do not put real personal data or real mission information into the demo. Use it as a sandbox. If you want to try Syncmap with real data, you should create a trial account instead.

Demo content is deleted 30 days after it is created. Our basis is legitimate interest: offering a working trial is how we explain the product.

Location and position sharing

Syncmap can show where people and vehicles are during a mission. A position comes either from tracking equipment your organisation issues, or from the Syncmap app itself.

Positions are recorded only while a mission is active. Nothing is recorded between missions, off shift, or on your way home.

What happens to a position:

• Others working the same mission see it on the map, and you may receive notifications based on where you are.
• It is stored with the mission, so movements during a mission can be reviewed afterwards, at a debrief for example.
• Position history is part of the mission data, and gets deleted along with it.
• If you attach a photo at your own position, the position saved with that photo is your location fix, and is stored like anything else you add.

A position is attributed to whatever the equipment is assigned to – a person or a vehicle – as recorded by your organisation. Where equipment is shared or reassigned between shifts, a position is attributed to whoever or whatever it was assigned to at the time.

Your organisation is the data controller for all of this. It decides whether to use position sharing, who carries equipment, and how long mission data are kept. We record and display positions on its instruction, and the data processing agreement governs it – not this policy. If you want to know how it is used where you work, ask them.

Enquiries and starting a subscription

If you register interest or begin setting up an organisation, we collect the name, email address, phone number and organisation you give us, so that we can reply and set up your access. Our basis is Art. 6(1)(b) – steps taken at your request before entering a contract.

We use Cloudflare Turnstile on the signup form to keep automated abuse out. It processes your IP address and browser characteristics to decide whether you are a person. It does not identify you to us.

Support and invoicing

We keep support correspondence so we can follow up on problems, and invoicing details because we have to. The basis is our contract with your organisation and, for accounting records, a legal obligation under bokføringsloven.

Who processes data on our behalf

We use a small number of providers to run Syncmap. They act on our instructions and may not use the data for their own purposes.

Our servers, database and file storage are all in Frankfurt. Where a provider is registered in the United States, we rely on the EU Commission’s standard contractual clauses or the EU–US Data Privacy Framework, and have satisfied ourselves that the data reaching them is limited to what the service needs – an email address, a phone number, a map coordinate.

Customers of Syncmap are notified before we add or change a provider, as required by our data processing agreement.

How long we keep things

Data we hold as a processor for an organisation is kept for as long as that organisation’s agreement runs, and deleted within 90 days of it ending.

Keeping it safe

Devices authenticate with a cryptographic key that is generated on the device and cannot be extracted from it. Traffic is encrypted in transit. Access to production systems is restricted to the people who need it and protected by multi-factor authentication where available. We take regular backups, keep dependencies patched, and have a procedure for handling and reporting security breaches. Syncmap AS and its staff are bound by a duty of confidentiality.

Your rights

You have the right to ask what we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. Write to [email protected] and we will answer within a month.

If your data is in an organisation’s Syncmap – anything to do with missions, your device, or your name as it appears to colleagues – that organisation is the controller and you should ask them. We will help them answer you.

You may also complain to Datatilsynet, the Norwegian Data Protection Authority, if you think we have handled your data wrongly.

Accounts and deletion

The demo creates no account, and its content is deleted on the 30-day cycle described above.

Access to a working Syncmap is arranged by an administrator at your organisation, who can also revoke it. We act on their instruction. If you cannot reach them, write to [email protected] and we will help.

Children

Syncmap is a professional tool for emergency services. It is not directed at children and we do not knowingly collect data about them.

Changes to this policy

We date every version of this page and keep earlier versions available. If we change something that materially affects you, we will say so rather than quietly editing the text.