Legal

    Privacy Policy

    LAST UPDATED — OCTOBER 2026

    Introduction

    Capacity Connect is operated by Gridscope AS (org. no. 937 330 324), Sigurd Hoels vei 9, 0655 Oslo, Norway ("we," "our," or "us"), which is the controller of your personal data. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

    This policy tells you what personal data we collect, why we use it, who we share it with and what rights you have. It applies to everyone who visits capacityconnect.ai or uses the platform.

    1. Information We Collect

    1.1 Information You Provide

    We collect information that you voluntarily provide when using our services:

    • Account Information: Name, email address, company name, job title, and password
    • Profile Information: Professional details, company information, and contact preferences
    • Transaction Data: Information about capacity requirements, RFPs, proposals, and contracts
    • Communication Data: Messages, inquiries, and support requests
    • Billing Information: Invoice address and contact person

    1.2 Information Automatically Collected

    When you access our platform, we automatically collect certain information:

    • Usage Data: Pages viewed, features used, time spent, and interaction patterns
    • Device Information: IP address, browser type, device type, and operating system
    • Cookies: We use cookies and similar tracking technologies (see Section 6)
    • Log Data: Server logs, error reports, and performance data

    2. How We Use Your Information

    We use the collected information for the following purposes, each on the legal basis stated:

    • Provide Services: Operate and maintain the platform, match buyers with providers, facilitate transactions. Legal basis: the contract with you or your company (Art. 6(1)(b) GDPR); for contact persons at a customer, our legitimate interest in serving that customer (Art. 6(1)(f) GDPR)
    • AI-assisted Drafting: Draft RFPs, proposals and summaries from what you enter, using Anthropic's models. Your data is not used to train AI models. Legal basis: the contract with you or your company (Art. 6(1)(b) GDPR)
    • Improve Platform: Analyze usage patterns, develop new features, enhance user experience. Legal basis: our legitimate interest in improving our service (Art. 6(1)(f) GDPR)
    • Communications: Send service updates, respond to inquiries, provide customer support. Legal basis: the contract with you or your company (Art. 6(1)(b) GDPR) and our legitimate interest in answering you (Art. 6(1)(f) GDPR)
    • Marketing: Send newsletters and promotional content, which you can opt out of at any time. Legal basis: your consent (Art. 6(1)(a) GDPR)
    • Security: Detect and prevent fraud, abuse, and security incidents. Legal basis: our legitimate interest in keeping the platform and its users safe (Art. 6(1)(f) GDPR)
    • Legal Compliance: Comply with applicable laws, regulations, and legal processes. Legal basis: our legal obligations (Art. 6(1)(c) GDPR)

    2.1 Marketing and Business Relationships

    We use HubSpot as our CRM and marketing platform, and LinkedIn to market our services. For these purposes:

    • Manage our relationships with customers, partners and prospects, and follow up on conversations. Data: name, company, job title, contact details and our communication with you. Legal basis: our legitimate interest in following up business contacts (Art. 6(1)(f) GDPR).
    • Understand how visitors use our website. Data: pages visited, time on site and how you found us. Legal basis: your consent (Art. 6(1)(a) GDPR), given in our cookie banner.
    • Show our ads on LinkedIn to business contacts in our CRM. Data: the email addresses of those contacts, which we upload to LinkedIn. Legal basis: our legitimate interest in reaching business contacts (Art. 6(1)(f) GDPR). You can object at any time, and we will remove you from these lists (see Section 3.5).
    • Show our ads on LinkedIn to relevant professionals and measure how they perform. Data: your visits to our website, if you accept advertisement cookies. Legal basis: your consent (Art. 6(1)(a) GDPR), given in our cookie banner.
    • Follow up when you fill in a form on our website. Data: the details you enter in the form. Legal basis: our legitimate interest in answering your request (Art. 6(1)(f) GDPR). We send newsletters and marketing emails only if you tick the box for them on the form; without it, we only write to you about what you asked for.

    3. Information Sharing and Disclosure

    We may share your information in the following circumstances:

    3.1 With Other Users

    When you submit an RFP or respond to capacity requests, relevant information is shared with the counterparty to facilitate transactions.

    3.2 Service Providers

    We use the following third-party service providers, each of whom has access only to information necessary to perform their functions:

    • Supabase — database hosting and authentication, in Europe (London, United Kingdom; see Section 8)
    • Anthropic — AI document generation (RFP and proposal drafts)
    • Resend — transactional email delivery
    • Vercel — web application hosting
    • Tripletex — invoicing and accounting
    • HubSpot — CRM, marketing email, website forms and analytics. Our account is hosted in HubSpot's EU data centre in Frankfurt (see Sections 6 and 8)
    • LinkedIn — advertising and our company page (see Section 3.5)
    • Google Fonts — the typefaces on our pages. Your browser fetches them from Google, which sees your IP address; no cookies are set

    3.3 Business Transfers

    In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

    3.4 Legal Requirements

    We may disclose information if required by law, court order, or government request, or to protect our rights, safety, or property.

    3.5 LinkedIn

    We have a company page on LinkedIn and use LinkedIn to market our services.

    • Our company page. When you visit, follow or interact with our page, LinkedIn gives us aggregated statistics about our visitors. We cannot see who you are from these statistics. We and LinkedIn Ireland Unlimited Company are joint controllers for this processing. LinkedIn is responsible for informing you and for handling your rights. Read more in LinkedIn's Privacy Policy.
    • Ads. We use LinkedIn ads to reach professionals in the data center and IT industry. LinkedIn decides who sees an ad, based on the targeting we choose, such as job title, industry and location. We receive aggregated reports, not information about individuals.
    • Contact lists. We may upload the email addresses of business contacts in our CRM to LinkedIn, so that our ads reach them on LinkedIn, or so that LinkedIn leaves them out of an audience. LinkedIn matches the addresses with its members and only uses them for this. You can object at any time, and we will remove you from these lists.
    • Website tag. If you accept advertisement cookies, the LinkedIn Insight Tag on our website lets LinkedIn measure our ads and show them to people who have visited us.

    4. Data Security

    We implement industry-standard security measures to protect your information:

    • Encryption in transit (TLS)
    • Encrypted data storage
    • Access controls and authentication: each company can only read its own data, enforced in the database
    • Incident response procedures

    However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

    5. Data Retention

    We retain your information for as long as necessary to provide services and fulfill the purposes outlined in this policy. When you delete your account, we will delete or anonymize your personal information within 90 days, except where required by law or legitimate business purposes (e.g., fraud prevention, financial records).

    • Your account, RFPs, proposals and messages: for as long as your account is active, then deleted or anonymized within 90 days as described above
    • Contacts in our CRM: as long as we have an active customer relationship or ongoing dialogue with you. We review our contacts at least once a year and delete those we no longer have a reason to keep, including contacts who have not responded to us
    • Deal and agreement records: for as long as a fee may still be due under the agreement they belong to, and then with the accounting records below. Aggregated market statistics derived from requests and deals contain no personal data and are kept
    • Support correspondence: 2 years after the matter is closed
    • Server and security logs: up to 90 days, longer only while we investigate an incident
    • Billing and accounting records: 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act

    6. Cookies and Tracking

    We use cookies and similar technologies in the same four categories as our cookie banner:

    • Necessary Cookies (always on): required for the platform to work and stay secure, such as keeping you signed in, and to remember your cookie choice
    • Analytics Cookies (with your consent): HubSpot, on our public website, to understand which pages and campaigns bring visitors to us
    • Advertisement Cookies (with your consent): the LinkedIn Insight Tag, loaded through HubSpot on our public website, to measure our LinkedIn ads and show them to people who have visited us. Set by HubSpot and LinkedIn
    • Functionality Cookies (with your consent): HubSpot, on our public website, to remember your details in forms so you do not have to type them twice

    We also count page views and measure performance with Vercel Analytics, which sets no cookies.

    In the cookie banner you can accept or decline each category, or decline all. If your browser sends a Global Privacy Control signal, we treat it as declining. If you decline, or before you choose, we set no tracking cookies and won't identify you. HubSpot may still log the page view, without cookies. We keep one small cookie to remember your choice. You can change your choice at any time under Cookie settings, which is also in the footer of our public pages. The HubSpot tracking code and the LinkedIn Insight Tag are not used once you are signed in, and never on the platform itself: your requirements, listings, proposals and deal rooms are not shared with HubSpot or LinkedIn.

    When you fill in a form on our public website, for example to join the waitlist or to ask for operator access, what you enter is also stored in HubSpot so that our team can follow up. When you place an RFP, only your name, email and company go to HubSpot. The requirement itself stays on the platform and is not sent to HubSpot.

    7. Your Rights (GDPR)

    Under the General Data Protection Regulation (GDPR), you have the following rights:

    • Access: Request a copy of your personal data
    • Rectification: Correct inaccurate or incomplete data
    • Erasure: Request deletion of your personal data
    • Restriction: Limit how we process your data
    • Portability: Receive your data in a structured, machine-readable format
    • Objection: Object to processing we base on legitimate interests. You can always object to direct marketing, and we will stop
    • Withdraw Consent: Withdraw any consent you have given, at any time, including for cookies

    To exercise these rights, contact us at privacy@capacityconnect.ai

    If you think we handle your personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no. We would like to hear from you first, so we can try to solve it.

    8. International Data Transfers

    We only transfer personal data outside the EEA when it is protected. We rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. Email privacy@capacityconnect.ai for a copy of the safeguards.

    Our database is hosted in London, United Kingdom. The European Commission has decided that the United Kingdom provides an adequate level of data protection, so transfers there need no further safeguards.

    These providers may transfer data to the United States:

    • Anthropic — the AI that drafts RFPs and proposals
    • Resend — the emails we send you
    • Vercel — the hosting of our website and Vercel Analytics
    • Google — Google Fonts, which sees your IP address
    • HubSpot — our account is hosted in its EU data centre, but HubSpot and some of its subprocessors can access data from the United States
    • LinkedIn — LinkedIn Ireland shares data with LinkedIn Corporation in the United States

    9. Children's Privacy

    Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

    10. Changes to This Policy

    We may update this Privacy Policy periodically. We will tell you about significant changes by email or with a notice on the platform before they take effect, and the date at the top shows when it was last changed.

    11. Contact Us

    If you have questions about this Privacy Policy or our data practices, contact us:

    Email: privacy@capacityconnect.ai
    Company: Gridscope AS (org. no. 937 330 324), Sigurd Hoels vei 9, 0655 Oslo, Norway