Privacy policy

The short version: the Grafpoint Power BI visuals do not collect, send or store any data from your reports. We only process the small amount of personal data needed to sell you a licence, deliver your key and answer your questions. We do not sell personal data, and we do not use advertising or tracking cookies.

This policy covers the website at getgrafpoint.com, trial keys, purchases of Grafpoint licences, licence key delivery, quotes and support.

1. Who is responsible

The controller for the personal data described in this policy is [Legal name], organisation number [Org. no.], [Address], Norway. Email: privacy@getgrafpoint.com.

“Grafpoint”, “we” and “us” in this policy mean this business. We are not required to appoint a data protection officer.

2. The visuals do not process your report data

Grafpoint visuals run inside Microsoft Power BI. They draw the data that Power BI gives them, in your browser or in Power BI Desktop, and nothing else. They make no network requests, contain no analytics or telemetry, and do not store your data anywhere outside the report. Your licence key is checked inside the visual without contacting us. We therefore never receive, see or store the data in your reports, and we are not a processor of that data. Microsoft’s processing of your reports is covered by Microsoft’s own terms. See also our security page.

3. What we collect, why, and on what legal basis

3.1 Visiting the website

Every web request carries technical data such as IP address, browser type, the page requested and the time. Our host, Cloudflare, processes this to deliver the site and protect it against abuse. We count page views with Cloudflare Web Analytics, which uses no cookies and does not identify you across sites; we only see totals. Legal basis: our legitimate interest in running a secure, working website (GDPR Article 6(1)(f)). We keep no visitor logs of our own.

3.2 Trial keys

When you ask for a trial key, we process your email address, company name and the visual you chose, so we can send the key and keep to one trial per address. Legal basis: taking steps at your request before a contract (Article 6(1)(b)), and our legitimate interest in preventing repeated trials (Article 6(1)(f)). We do not add you to a mailing list.

3.3 Quote requests

When you ask for a whole-organisation quote, we process what you enter in the form: name, work email, company, country, company size, number of Power BI users, what you want to license, where your reports run, and your message. We use it to prepare the quote and answer you. Legal basis: taking steps at your request before a contract (Article 6(1)(b)).

3.4 Buying a licence

Payments are handled by Paddle (Paddle.com Market Ltd and its affiliates) as merchant of record. Paddle is the seller you pay: it handles your card or other payment details, calculates and collects VAT or sales tax, and issues your invoice. Paddle is an independent controller for the data it collects at checkout, under Paddle’s privacy policy. We never see or store your full card details.

From Paddle we receive your name and email address, your company name and country, what you bought (products, licence type, number of seats, billing period), the order and subscription IDs, the price and the dates, and your VAT number if you entered one.

We use this to create and deliver your licence key, send renewal keys, handle refunds and cancellations, answer questions about your order, and keep the accounts the law requires. Legal basis: performance of our contract with you (Article 6(1)(b)) and our legal obligation to keep accounting records (Article 6(1)(c)).

3.5 Your licence key

Your licence key contains the products you bought, the licence type, the number of seats, the expiry date, an order reference and the company name you gave at checkout, which the visual shows as “Licensed to …”. The key is digitally signed so it cannot be changed. When you paste it into a visual, it is saved inside your Power BI report like any other format setting, and anyone who can open that report can see it. We keep a record of each key we issue so we can send it again if you lose it. Legal basis: performance of our contract (Article 6(1)(b)).

3.6 Licence emails and “Resend my key”

We email your licence key, and new keys on renewal, to the address on your order. If you use the “Resend my key” form, we use the email you enter only to look up your order and send the key to the address already on that order. Legal basis: performance of our contract (Article 6(1)(b)).

3.7 Support and other contact

If you email us, we process your name, email address, your message and any files you attach, so we can answer you. Legal basis: our legitimate interest in answering questions (Article 6(1)(f)), or performance of our contract when the question is about your licence (Article 6(1)(b)). Please do not send us report data or screenshots with personal or confidential data; use sample data to show a problem.

4. Who we share data with

We use these service providers. Each processes personal data only on our instructions under a data processing agreement, unless stated otherwise.

We also share data when the law requires it, for example with tax authorities or auditors. We do not sell or rent personal data, and we do not share it for advertising.

5. Transfers outside the EEA

Some providers are based in, or may access data from, the USA or the UK. When data leaves the EEA, we rely on an adequacy decision by the European Commission (this covers the UK, and US companies certified under the EU–US Data Privacy Framework), or on the European Commission’s standard contractual clauses, with extra safeguards where needed. Email privacy@getgrafpoint.com for a copy of the safeguards that apply.

6. How long we keep data

7. Your rights

Under the GDPR you have the right to access the personal data we hold about you and get a copy; to rectify data that is wrong; to erase your data, unless we must keep it, for example for accounting; to restrict our processing in certain cases; to data portability; to object to processing based on our legitimate interests; and to withdraw consent at any time where processing is based on consent.

To use any of these rights, email privacy@getgrafpoint.com. We answer within one month, and may ask you to confirm your identity, for example by replying from the email address on your order. Changing the company name inside a licence key means issuing a new key; we do that on request.

8. Complaints

If you think we handle your data unlawfully, please contact us first so we can fix it. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority where you live or work.

9. Cookies

Our website sets no cookies for analytics or advertising. Cloudflare may set a strictly necessary security cookie to protect the site against bots. When you open the checkout, Paddle may set cookies needed for the payment to work and to prevent fraud, under Paddle’s own policy.

10. Security

We protect personal data with access control and two-factor authentication on our accounts, encrypted connections everywhere, and by keeping as little data as we can. Licence keys are signed with a private key that is stored as an encrypted secret and never leaves our systems.

11. Children

Our products are for businesses. We do not knowingly collect data from children under 16.

12. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Paddle may run automated fraud checks at checkout under its own policy.

13. Changes to this policy

We update this policy when our services or the law change. The effective date at the top shows the current version. If a change is significant, we tell customers by email before it takes effect.

14. Contact

[Legal name] · [Address] · privacy@getgrafpoint.com