Privacy policy

Last updated: 1 October 2026

This privacy policy explains how Sequence collects, uses, stores and protects personal data when you visit sequence.no, contact us, or use Sequence as a client. Sequence is operated by Coupler Oslo AS. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) as implemented in Norway through the Personal Data Act (personopplysningsloven).

1. Who is responsible

The data controller is Coupler Oslo AS ("Coupler", "Sequence", "we", "us"), Oslo, Norway.

• Organisation number: 924777060
• Registered address: Torggata 8, 0181 Oslo, Norway
• Data protection officer (DPO): Sigurd J. Vik (CEO)
• Privacy contact: [email protected]

2. What data we collect and why

We collect only the personal data we need for the purposes below.

• Enquiries and early-access requests. Email address (and any name, company or message you provide) when you contact us or request early access through the website. We use it to answer you and to follow up on your request.
• Investor information page. To open the chat on the investor page you sign in with your email address, and we process the questions you type. We use them to provide the chat and to review and improve it. Answers are generated with Google's Gemini API.
• Clients and business contacts. Name, job title, work email, phone number and company details for people we work with. We use it to deliver Sequence, manage the relationship, invoice and meet accounting obligations.
• Advertising account data. For advertisers who give us access, data from their Google Ads accounts, as described in the section "Google user data" below.
• Technical data. IP address, browser and device information and the pages requested, which our hosting provider processes in server logs to deliver and protect the site.

We only send marketing email to people who have asked to receive it, and you can unsubscribe at any time.

3. Legal basis

We rely on the following bases under Article 6 of the GDPR.

• Contract (Art. 6(1)(b)) — to take steps at your request before a contract and to deliver Sequence to our clients, including reporting on and managing advertising campaigns.
• Legitimate interests (Art. 6(1)(f)) — to respond to enquiries and early-access requests, provide the investor chat, run and secure our website, and manage business relationships. We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — for example bookkeeping and accounting requirements.
• Consent (Art. 6(1)(a)) — for marketing email, and for any non-essential cookies if we ever introduce them. You can withdraw consent at any time.

4. Google user data

This section applies to data we receive from Google through Google OAuth and the Google Ads API.

• What we access and why. Sequence uses the Google Ads API, through Google OAuth, to read Google Ads account, campaign and performance data for advertisers who have given Coupler access, so Coupler can report on and manage their campaigns.
• Scope. Coupler only requests the Google Ads scope: https://www.googleapis.com/auth/adwords.
• How we use it. Data is used only to provide those services. It is not sold, not used for advertising, and not shared with third parties except as needed to provide the service or as required by law.
• Security. OAuth tokens are stored encrypted in Google Cloud Secret Manager.
• Revoking access. You can revoke access at any time at https://myaccount.google.com/permissions. You can also ask us to delete the data we hold by writing to [email protected].

Coupler's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Cookies and similar technologies

sequence.no does not use cookies or tools for analytics, advertising or tracking, and has no cookie banner. If that changes, we will ask for your consent first and update this policy.

The investor information page embeds a chat served from app.sequence.no. After you sign in with your email address, it sets one strictly necessary session cookie to keep you signed in. It is not used for tracking and does not require consent. Our hosting providers may also set strictly necessary technical cookies to deliver and protect the site.

The site loads fonts from Google Fonts, so your browser sends a request, including your IP address, to Google's servers when a page loads.

6. Who we share data with

We do not sell personal data. We share it only with service providers acting on our behalf, and with authorities where the law requires it.

• Google (Google Ads API, Google Cloud including Secret Manager, Gemini API, and Google Fonts)
• Railway (website and API hosting)
• Postmark (email delivery)
• Supabase (database for the Sequence application)

Some of these providers may process data outside the EU/EEA, for example in the United States. Where they do, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.

7. How long we keep data

• Enquiries and early-access requests: up to 24 months after our last contact, then deleted
• Investor chat sign-ins and questions: up to 24 months, then deleted
• Client and contact records: for the duration of the relationship and three years afterwards, then deleted
• Accounting records: five years, as required by the Norwegian Bookkeeping Act (bokføringsloven)
• Google Ads data and OAuth tokens: until access is revoked or the engagement ends, then deleted within 30 days
• Server and hosting logs: no longer than 30 days

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where the law allows;
• object to processing based on legitimate interests, and to direct marketing;
• restrict processing and receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

To use these rights, write to [email protected]. We will respond within one month.

You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no, if you believe we process your personal data unlawfully.

9. Security

We use technical and organisational measures to protect personal data, including encryption in transit (HTTPS), encryption of OAuth tokens in Google Cloud Secret Manager, access limited to authorised team members, and the security controls of our hosting providers.

10. Changes to this policy

We may update this policy. The date at the top shows when it was last revised.

11. Contact

Coupler Oslo AS (org. no. 924777060), Torggata 8, 0181 Oslo, Norway
Email: [email protected]