Last updated: 2026-11-14
This policy explains how ZeroSubnet AS (“we”, “us”) processes personal data when you visit turboproject.cloud(the “website”) or contact us about TurboProject. It is written to comply with the EU General Data Protection Regulation (GDPR) as incorporated into Norwegian law by the Personal Data Act (personopplysningsloven).
1. Data controller
ZeroSubnet AS, Norway, is the controller for the processing described here. Contact us about privacy at privacy@zerosubnet.com.
When our customers use the TurboProject service, the customer is the controller for the personal data in their workspace and ZeroSubnet AS acts as their processor under a data processing agreement (DPA). Questions about that data should be directed to the customer organisation.
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Delivering the website securely | IP address, user agent, requested URL, timestamps (server and security logs at our hosting provider) | Legitimate interest in operating and protecting the website (art. 6(1)(f)) | Short-lived; typically no more than 30 days |
| Answering demo requests and enquiries | Name, work e-mail, company, team size, your message | Steps prior to entering a contract at your request (art. 6(1)(b)), or legitimate interest in answering business enquiries (art. 6(1)(f)) | Up to 24 months after our last contact, unless a customer relationship follows |
| Customer relationship, contracts and invoicing | Contact and billing details for customer representatives | Contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)), including the Norwegian Bookkeeping Act | For the duration of the contract and as required by bookkeeping rules (generally 5 years) |
| Aggregate website statistics | Anonymous, cookieless page-view counts (no personal profiles) | Legitimate interest in improving the website (art. 6(1)(f)) | Aggregated only |
We do not sell personal data, and we do not use it for automated decision-making or profiling.
3. The TurboProject mobile app
The TurboProject app for Android and iOS (package com.zerosubnet.turboproject) is used by people whose organisation has a TurboProject workspace. You sign in with your organisation's account. For the data in the workspace, your organisation is the controller and ZeroSubnet AS is its processor (see section 1).
| Data | Why | Kept |
|---|---|---|
| Your name and work e-mail, from your organisation's sign-in | To show who you are and which tasks are yours | As long as your organisation keeps your account |
| Photos you take or pick as evidence on a task, with the time they were added and a SHA-256 checksum | To document the work in your organisation's workspace | As long as your organisation keeps the task (its retention rules apply) |
| Comments, task status changes, votes and chat messages you post | To run your organisation's projects and change hubs | As long as your organisation keeps them; changes are kept in the audit log |
| A push notification token, your device's name, the platform (Android or iOS) and the app version | To send you notifications about your tasks and change hubs | Until you sign out, the token stops working, or your account is removed |
| A sign-in token, stored encrypted on your device | To keep you signed in | Up to 180 days. Signing out deletes it, and it can be revoked on the web under API tokens |
- Camera and photos: the app uses the camera only when you take an evidence photo, and reads only the photos you pick. It doesn't scan your photo library.
- Notifications: notifications are delivered by Google Firebase Cloud Messaging (and Apple's push service on iOS). The notification text, such as a task's name, passes through these services.
- No ads or tracking: the app has no advertising, no analytics or tracking SDKs, and doesn't collect your location or contacts. We don't sell data from the app or share it for advertising.
- All data is sent encrypted (HTTPS).
- Deleting your data: sign out to remove the device registration and the sign-in token from the device. To have your account or workspace data deleted, ask your organisation's administrator, or write toprivacy@zerosubnet.com. We pass the request to your organisation.
4. Recipients and processors
We share personal data only with service providers who process it on our behalf under a data processing agreement:
- Cloudflare, Inc.: website hosting, content delivery and security (and bot protection on the contact form, if enabled).
- Our internal lead-handling tools: receiving and following up on enquiries.
- Hetzner Online GmbH (Germany): hosting of the TurboProject service.
- Microsoft (Azure): storage of files and evidence photos in the service.
- Postmark (ActiveCampaign, LLC): sending e-mail from the service, such as invitations and reminders.
- Google LLC (Firebase Cloud Messaging) and Apple Inc.: delivering notifications to the mobile app.
Some providers may process data outside the EU/EEA. Where they do, transfers are protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.
5. Cookies and similar technologies
The website does not set advertising or tracking cookies, and does not use third-party analytics that identify you. That is why we do not show a cookie banner. Our hosting provider may set strictly necessary security cookies (for example to filter malicious traffic), which are exempt from consent under the Norwegian Electronic Communications Act § 2-7b and the ePrivacy Directive. If we ever add optional cookies, we will ask for your consent first.
Fonts are served from our own domain. We do not load fonts or scripts from Google or other advertising networks. Signing in to the TurboProject application (app.turboproject.cloud) uses a strictly necessary session cookie.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, or its processing restricted;
- object to processing based on legitimate interest;
- data portability, where processing is based on contract or consent;
- withdraw consent at any time, where processing is based on consent.
Send requests to privacy@zerosubnet.com. We will reply within one month. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet),datatilsynet.no, or with the supervisory authority where you live.
7. Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit, access control and logging. See our security page for how the TurboProject service is protected.
8. Changes
We may update this policy. The date at the top shows when it was last changed. Material changes will be highlighted on this page.