Privacy policy for Bobilvei
This is a translation. The Norwegian version applies.
Last updated: 23 October 2026
Status as of October 2026: Bobilvei is under development and has not launched. This policy describes the service as it is today. We will update it before we start using new features that process personal data. Where something is planned and not yet in use, this is stated expressly.
1. Who is the controller?
David Vang AS (org. no. 937 809 263) is the controller for the processing of personal data described in this policy. Bobilvei is a digital marketplace that connects motorhome owners with renters for the rental of motorhomes between private individuals.
Contact:
- David Vang AS, org. no. 937 809 263
- Business address: Vallefaret 21, 0663 Oslo
- Email: hei@bobilvei.no
- Enquiries about privacy and your rights: personvern@bobilvei.no
- Website: bobilvei.no
2. What personal data do we process?
2.1 Account information (all users)
- Name
- Email address
- Password. It is never stored in plain text, only as a hash.
- When the account was created
- Which notices of changed terms we have sent you, and when
You must give your name, email address and password to create an account. Without them we cannot enter into a contract with you.
The service is not aimed at children. To rent a motorhome you must be at least 21, and to rent one out you must be of legal age (18). We do not ask for your date of birth; you confirm your age when you send a request or publish a listing.
2.2 Owner information (motorhome owners)
- The address where the motorhome is picked up, and any pickup instructions you write. They are shown only to you and to a renter with a confirmed booking. The website shows an approximate location on the map and in search.
- That you have confirmed that you are of legal age and own the motorhome, and when you did so. This is stored every time you publish a listing, also when a listing that has been paused is published again.
- That you accepted the owner terms when you published a listing: which version, when, and that you were logged in. This is stored to be able to show what was agreed.
2.3 Listing and booking data
- Listing descriptions, prices, minimum number of nights and location
- The motorhome's make, model, model year, length and number of berths, equipment and rules for the rental, and what you yourself write in free text
- What you write in the listing about how the handover takes place
- Dates, number of travellers, amounts, status and payment references for requests and bookings
- That the renter has confirmed being at least 21 and holding a valid driving licence, and when
- That the renter asked for the service to start before the 14-day withdrawal period ends, and when (angrerettloven § 22). This is stored on the request to be able to show that the right of withdrawal lapsed when the owner confirmed
- Which trips you have hidden on My account
- Photos you upload to a listing.
2.4 Payment information
We do not store card numbers or bank details for payments. All payment processing takes place through Stripe, which is a certified PCI DSS Level 1 provider. We store only references to Stripe transactions. You give your card details directly to Stripe, and you must provide them to be able to send a request.
2.5 What other users see about you
- Before a booking is confirmed, the other party sees your first name and the first letter of your last name.
- Once a booking is confirmed, the owner and the renter see each other's full names, even if the booking is later cancelled. The renter then also sees the address where the motorhome is picked up and the owner's pickup instructions.
- On the listing and on the owner's profile, we show the owner's first name and the first letter of their last name, when the owner became a member, how quickly the owner usually replies, and the reviews of the motorhome (see section 2.7). Whether the owner has set up payouts is also publicly available.
- Email address and phone number are not shown to other users.
2.6 Technical data and analytics
- IP addresses and session data (for authentication and security)
- Error logs when errors occur (may contain pseudonymous reference IDs – see Sentry below)
- Visitor statistics via Plausible Analytics: We measure how many people visit the website and which pages are popular. When you open a page, Plausible receives the page's address, which page you came from, browser type and screen size, and your IP address. The IP address is used to count visits and is not stored: Plausible creates an anonymous code that changes every day, so a visit cannot be followed from one day to the next. Plausible does not use cookies. The data is stored in the EU. See section 8 and the cookie policy.
- Error monitoring and performance measurement via Sentry: Technical errors are logged automatically, and for about one in ten page views we measure how long the page takes. The data may contain the page's address, browser information, the action that triggered the error and reference IDs (booking, listing, payment or account ID). IP addresses and cookies are not sent. Sentry data is stored within the EU (Frankfurt) and deleted after 30 days.
2.7 Ratings and reviews
After a rental period, the renter and the owner can rate each other. So a rating or review of you comes to us from the person you rented from or rented out to, not from you yourself. This applies to all confirmed bookings that were not cancelled before or on the pickup day. The deadline is 14 days after the last day of the rental period. The review and the rating are both kept hidden until both have been submitted, or until the deadline has passed. They cannot be changed afterwards.
The renter's review of the motorhome and the trip
- We store: 1–5 stars, an optional comment, the time and which booking it concerns.
- It is shown publicly on the listing and on the owner's profile, together with the renter's first name, the first letter of their last name and the month it was written.
- The owner is shown on the listing and on the profile with their first name and the first letter of their last name.
The owner's rating of the renter
-
We store: 1–5 stars overall, 1–5 stars for cleanliness, care of the motorhome and returned as agreed, an optional comment, the time and which booking it concerns.
-
It is not shown publicly. Renters have no public profile.
-
The renter can read the rating themselves, including the comment, once it is visible.
-
An owner sees the average (overall and for each of the three categories) and the number of ratings, without comments and without showing who gave them, and only while the renter has a request awaiting a reply from that owner.
-
A rating of a renter is deleted when it is three years old.
Only genuine reviews. A review can be written only by a party to a confirmed rental that was not cancelled before or on the pickup day, and only once the rental period is over. We show all reviews. We do not pick and choose, do not sort by content and do not remove reviews for being negative. Content that breaks our rules may be hidden (see the terms).
The rules are the same for private and business owners.
We do not use ratings to decline, sort or filter users automatically. It is the owner who decides whether a request is approved.
2.8 Account created when you post a listing or send a request
You do not need to create an account in advance. If you start a listing or send a request without being logged in, we create an account for you with the name, email address and phone number you give in the form.
- You must confirm your email address. We send you an email with a link. The link is valid for 24 hours, and you can ask for a new one. Once you have confirmed, you choose a password. We never send passwords by email.
- Nothing goes any further until you have confirmed. A listing is not published, and a request is not sent to the owner. Nor do you pay until the email address is confirmed. Once you have confirmed your email address, the listing you asked to have published is published (you choose the password right after), and a request you see again and send yourself; only then does the owner receive it.
- If you do not confirm within 7 days, we delete the account and everything that belongs to it: the information about you, the draft listing with its photos, and the request (which motorhome, the dates and the number of guests). The deletion runs once a day, so the account is normally deleted within 8 days. The same applies to an account you created in the usual way but never confirmed.
- Has someone else given your email address? Then you may receive a few emails from us. Ignore them. The account and the information are deleted automatically after 7 days if the email address is not confirmed, and no one can log in to the account without confirming from your inbox.
- Does your email address already have an account? Then we create nothing. If someone sends a request with your address without being logged in, you receive an email asking you to log in to complete it, at most three a day. The request is deleted after 7 days if you do not complete it.
- While you wait to confirm, we store a cookie on your device so that you can continue with your listing. It applies only to your draft listing, and it is deleted when you confirm your email address or after 7 days. See section 8.
- We store that you accepted the terms: which document, which version, when, and whether you were logged in. If you complete the request after logging in, we store that you accepted them once more, with the version that applied then. We do this to be able to show what was agreed.
- We store which emails we have sent you about the account: what type of email and when, not the content. We do this so that you do not receive the same email twice, and to limit how many emails can be sent to one address.
3. Legal basis for the processing
| Purpose | Legal basis | Provision |
|---|---|---|
| Creating and managing a user account | Contract | GDPR Art. 6(1)(b) |
| Storing which trips you have hidden on My account | Contract (the user account) | GDPR Art. 6(1)(b) |
| Creating an account from the listing form or the request form and confirming the email address | Contract, and steps taken at your request before entering into a contract | GDPR Art. 6(1)(b) |
| Phone number, to reach you about your listing, request or booking (see section 2.8) | Contract | GDPR Art. 6(1)(b) |
| Storing when you accepted the terms (when you publish a listing, in the forms in section 2.8, and when you complete a request logged in) | Legitimate interests (being able to show what was agreed) | GDPR Art. 6(1)(f) |
| Storing that you asked for the service to start before the withdrawal period ends, and when (angrerettloven § 22) | Legal obligation (angrerettloven § 22 requires that we can show you asked for it) | GDPR Art. 6(1)(c) |
| Carrying out bookings and payments | Contract | GDPR Art. 6(1)(b) |
| Storing that you have confirmed your age and driving licence (renter) or that you own the motorhome (owner) | Contract | GDPR Art. 6(1)(b) |
| Retention of accounting data | Legal obligation | GDPR Art. 6(1)(c), bokføringsloven (the Norwegian Bookkeeping Act) § 13 |
| Visitor statistics (Plausible) | Legitimate interests (knowing which pages are used) | GDPR Art. 6(1)(f) |
| Error monitoring and performance measurement (Sentry) | Legitimate interests (finding and fixing errors) | GDPR Art. 6(1)(f) |
| Preventing misuse: counting requests per IP address or account (Upstash) | Legitimate interests (protecting the service and its users) | GDPR Art. 6(1)(f) |
| Public reviews of the motorhome and the trip | Legitimate interests | GDPR Art. 6(1)(f) |
| Ratings of renters, shown to the owner when there is a request | Legitimate interests | GDPR Art. 6(1)(f) |
Legitimate interests for ratings and reviews. Someone considering renting a motorhome has an interest in knowing how earlier rentals have gone. The owner, who lends a valuable vehicle to a stranger, has an interest in knowing whether earlier owners have had problems with the renter. Bobilvei has an interest in the marketplace being trustworthy. We have weighed these interests against the privacy of the person being rated, and limited the processing accordingly (see section 2.7). You can ask to see this assessment by contacting us.
4. Who receives the data
4.1 Data processors (providers that process data on our behalf)
| Provider | Purpose | Where | Data |
|---|---|---|---|
| Supabase | Database, login and storage of photos | Frankfurt, EU. Supabase is a company outside the EEA; transfers are made on the EU standard contractual clauses (SCC) | All application data |
| Vercel | Hosting of the website | The functions run in Frankfurt. Routing and static files are served from Vercel's network in several countries. Vercel Inc., USA; transfers on the EU standard contractual clauses (SCC) under Vercel's data processing agreement | Requests to the website, access logs |
| Stripe | Payment | Ireland and the USA. Stripe transfers data to Stripe, LLC in the USA; transfers on the EU–US Data Privacy Framework and SCC | The payment, with references to the listing, the renter and the dates |
| Resend | Email from the service. Resend keeps sent emails and logs for up to 30 days | USA (Plus Five Five, Inc.); transfers on SCC and the EU–US Data Privacy Framework | Email addresses, email content |
| Plausible Analytics | Visitor statistics without cookies | EU (Plausible Insights OÜ, Estonia) | See section 2.6 |
| Sentry | Error monitoring and performance measurement | Error data is stored in Frankfurt. Functional Software, Inc., USA; transfers on the EU–US Data Privacy Framework and SCC | See section 2.6 |
| TomTom | Maps and address search | EU/EEA, with sub-processors outside the EEA on SCC | Address searches you type in, and your IP address when the map loads |
| Upstash | Protection against misuse (counting of requests) | EU (Frankfurt). Upstash, Inc., USA; transfers on the EU–US Data Privacy Framework and SCC | IP address or user ID |
| Domeneshop | Our email addresses (hei@, support@, personvern@ and david@bobilvei.no) | Domeneshop AS, Norway | Email you send us |
We have data processing agreements with the providers in the table. You can find out more about the basis for a transfer, or get a copy of the standard contractual clauses, by contacting us.
4.2 Other recipients
- The other party to a request or booking sees what is set out in section 2.5.
- Everyone who visits the website can see listings, what is said about the owner in section 2.5, and reviews of motorhomes (see section 2.7).
- Stripe processes card details, and information to prevent fraud, as an independent controller under its own terms.
- Google. Email you send to hei@, support@, personvern@ or david@bobilvei.no is forwarded to the same Gmail account and read there. Google processes it under its own terms, and we do not have a data processing agreement with Google for this account. This is temporary: we will move the email to a service with a data processing agreement before launch.
- Skatteetaten (the Norwegian Tax Administration). Platforms that facilitate the rental of vehicles are required to report the owners' income (see section 5). We do not collect information for this yet.
- Public authorities when we are required to by law.
5. DPI/DAC7 – reporting to Skatteetaten
Platforms that facilitate the rental of means of transport are required to report the owners' income to Skatteetaten every year (skatteforvaltningsloven (the Tax Administration Act) § 7-11 and skatteforvaltningsforskriften (the Tax Administration Regulations) § 7-11). This also applies to Bobilvei.
We do not collect information for this yet. Before we do, we will update this policy and notify the owners. The rules then require us to collect name, address, national identity number (fødselsnummer) and the bank account number for payouts, and to keep the information for at least five years after the end of the income year.
6. Retention periods
| Data category | Retention period |
|---|---|
| Account information | Until the account is deleted |
| Account whose email address has not been confirmed | 7 days after it was created. The account and everything that belongs to it is then deleted |
| Request waiting for you to complete it | 7 days |
| When you accepted the terms | As long as the account exists |
| That you asked for the service to start before the withdrawal period ends (stored on the request) | As the booking |
| Emails we have sent you (at Resend) | Up to 30 days |
| Record of notices we have sent you about changed terms (which notice and when) | As long as the account exists |
| Record of other emails we have sent you about the account (type and time) | As long as the account exists |
| Log from the nightly review of accounts with an unconfirmed email address (account ID, not name or email address) | 90 days |
| Booking and payment data | 5 years after the end of the financial year (bokføringsloven § 13) |
| Which trips you have hidden on My account | As long as the booking is stored, or until you show the trip again |
| Reviews of the motorhome and the trip | As long as the account of the person who wrote the review exists. When the account is deleted, the review is kept without a name |
| Ratings of renters | 3 years. Also deleted when the renter's account is deleted |
| Email you send us | Until the matter is closed, and at most 2 years |
| Error logs (Sentry) | At most 30 days |
| Counters that limit how often a form can be sent (IP address or account ID, at Upstash) | A few minutes: the counter expires with its time window |
| Log of requests to the website (address, time, IP address, browser type, at Vercel) | One day |
| Login sessions (IP address and browser type, at Supabase) | Until you log out or the session expires, and after that for as long as Supabase keeps it; see Supabase's privacy policy |
| Time of emails we have sent about a booking (in the booking log) | As for the booking |
| Plausible visitor data | Aggregated; no personally identifying data is stored |
When an account is deleted, we delete what we are not required to keep. Bookings and payments must remain in the accounts for five years. They are then kept without your name, email address and phone number.
7. Your rights
You have these rights under the GDPR and personopplysningsloven (the Norwegian Personal Data Act):
- Right of access – You can ask for a copy of the personal data we hold about you.
- Right to rectification – You can ask for incorrect information to be corrected.
- Right to erasure – You can ask for your data to be deleted. We must keep bookings and payments in the accounts for five years (see section 6).
- Right to restriction – You can ask for your data to be stored but not used, for example while we look at an objection from you.
- Right to data portability – You can ask to receive the data you yourself have given us, in a machine-readable format.
Right to object. Where we process data on the basis of legitimate interests (visitor statistics, error monitoring, protection against misuse, ratings and reviews, see section 3), you can object to the processing. We will then assess the matter in light of your situation.
Ratings and reviews. You can read everything that has been written about you as soon as it is visible (see section 2.7). If you believe that a rating or review of you is incorrect or breaks our rules, you can ask us to look at it. We hide it while we look into the matter. We do not remove a rating or review just because it is negative. If you want a review you have written yourself to be removed, you can ask for that.
How to do it: Write to personvern@bobilvei.no from the email address your account is registered with, and say what you are asking for. We may ask you to confirm who you are. We reply without undue delay and at the latest within one month. If the matter is complex, we may extend the deadline by up to two months. You will then be told so, and why, within the first month. It costs nothing.
8. Cookies and analytics tools
We use only strictly necessary cookies: login/session handling (Supabase), and two fraud-prevention cookies from Stripe that are set when the payment page loads. When you open a map, the map stores map images in the browser's cache. In our assessment, this does not require consent under ekomloven (the Norwegian Electronic Communications Act) § 3-15. If you start a listing without an account (section 2.8), one more of the same kind is added: a cookie (__Host-bv_wizard) that lets you continue with your draft listing before you have confirmed your email address, for at most 7 days. If you open a link from us in an email, there is also one of the same kind (__Host-bv_link), which shows that the button on the page was pressed on bobilvei.no, for at most one hour.
Plausible Analytics is our analytics tool. It sets no cookies, stores nothing on your device and does not retrieve anything stored there. What Plausible receives when you open a page is set out in section 2.6. Ekomloven § 3-15 applies not only to cookies but to all storage on, and retrieval from, your device. Our assessment is that Plausible does neither, and that consent is therefore not required. The assessment is our own.
We currently use no marketing or tracking cookies. If this changes, we will obtain consent in accordance with ekomloven § 3-15 before such cookies are used.
See our separate cookie policy for details.
9. Security
This is how we protect your data today:
- All traffic between you and the service is encrypted (TLS/HTTPS).
- The database is in the EU (Frankfurt) and has row-level access rules. A logged-in user can read only their own data and what is public.
- Bookings, account details and payout details can be changed only by the server, not directly from a browser.
- Passwords are never stored in plain text, only as a hash.
- Card details are processed by Stripe and are not stored by us.
- Error messages are cleaned before they are sent to error monitoring: IP addresses, cookies and the content of forms are not included.
- We do not collect national identity numbers, bank account numbers or vehicle registration numbers today.
10. Personal data breaches
If we discover a personal data breach, we report it to Datatilsynet (the Norwegian Data Protection Authority) within 72 hours, unless the breach is unlikely to result in a risk to you or others. If the risk is high, we notify you directly, without undue delay.
11. Right to complain
If you believe that we process your personal data in breach of the rules, you can complain to Datatilsynet:
- Complaint form and guidance: datatilsynet.no
- Phone: 22 39 69 00
Feel free to contact us first, and we will try to put it right.
12. Changes to this privacy policy
We update this policy before we start any new processing of personal data. If the change is significant for you, we will tell you by email or on My account. If we need your consent for something new, we ask first. The date of the last update is shown at the top.