Privacy Policy

Last updated: October 2026

Who we are

Casa Inferno is an Italian pizza restaurant at Vestregata 2, 9008 Tromsø. We are the data controller for the personal data collected through this website. If you have questions about privacy, contact us at post@casainferno.no.

In short

We collect as little as possible. We never sell data on, and we don't use it for advertising. Analytics tools are only loaded after you've given consent in the consent banner — if you choose "Decline", no analytics will run. You can change your mind at any time (see "Consent" below).

What we collect, why, and for how long

• Contact form (contact page): Name, email address, phone number (optional), subject and your message — and for some subjects also date/time/number of guests or position/availability. If you submit a job application, you can also upload a CV and photos. The message is sent as an email to the restaurant via Brevo (see data processors), and you receive an automatic confirmation by email. Legal basis: steps prior to entering into an agreement and our legitimate interest in responding to inquiries (GDPR Art. 6(1)(b) and (f)); for job applications, your consent (Art. 6(1)(a)). You must tick a box confirming you accept this privacy policy before the form can be submitted. Retention period: inquiries are kept in our email inbox for as long as necessary to follow up the matter, normally up to 12 months; job applications are deleted no later than 6 months after the position has been filled, unless you consent to us keeping them longer.
• Newsletter: Email address and time of consent. The list is run by Brevo. Sign-up is confirmed with double opt-in (you receive an email you must confirm). Legal basis: consent (Art. 6(1)(a)). Retention period: until you unsubscribe — every newsletter has an unsubscribe link, and you can also contact us.
• Table booking: Name, phone number, email address and reservation time. Handled by DinnerBooking. Legal basis: performance of a contract (Art. 6(1)(b)). Retention period: reservation data is automatically deleted 30 days after the reservation date.
• Gift cards: Payment and contact information upon purchase. Handled by Diggecard. Legal basis: performance of a contract (Art. 6(1)(b)) and bookkeeping obligations. Retention period: in accordance with Diggecard's and the Accounting Act's requirements (up to 5 years).
• Analytics (consent only): With your consent, we use PostHog, Microsoft Clarity and Vercel Web Analytics to understand how the site is used and to improve it. These may process IP address, device and browser information, pages visited and interaction with the site (Microsoft Clarity may create anonymised recordings of how pages are used). The tools may set cookies or similar identifiers in your browser after you have given consent. Legal basis: consent (Art. 6(1)(a)). Retention period: according to each provider's standard retention; you can withdraw your consent at any time.
• Spam and bot protection: The contact form and newsletter sign-up use Cloudflare Turnstile to distinguish humans from bots (on the newsletter it only loads once you click into the email field). Cloudflare may receive IP address and technical browser information. To prevent abuse, we also count the number of submissions from the contact form and newsletter sign-ups per IP address and per email address within short time windows. The counters are stored at Sanity only as pseudonymised keys (a one-way code generated from the address, not the address itself) and are deleted automatically. Legal basis: legitimate interest in preventing abuse (Art. 6(1)(f)). Retention period: the counters are automatically deleted after a maximum of 4 days.
• Game leaderboard: The optional "Pizza Runner" game on the take-away page lets you save a nickname (up to 8 characters) and a score on a public leaderboard. We store the nickname, the score and the time the entry was saved at Supabase. Only the nickname and score are shown on the leaderboard. Feel free to pick a nickname that doesn't identify you. To prevent cheating and abuse, we also count the number of saved scores per IP address. The counter is stored at Sanity only as a pseudonymised key and is deleted automatically. Legal basis: legitimate interest in a fun feature and in preventing abuse / your choice to participate (Art. 6(1)(f)). Retention period: the entry is stored until you ask us to delete it. The counter is automatically deleted after a maximum of 2 days.
• Technical storage in the browser: We store your language choice, consent choices and any access code locally in your browser (localStorage). This is technically necessary and contains no personal data. Legal basis: legitimate interest in a functioning website (Art. 6(1)(f)). Retention period: until you clear your browser data (normally up to 1 year).

Cookies and local storage

Before you make a choice in the consent banner, no analytics or tracking cookies are set. If you accept analytics, PostHog, Microsoft Clarity and Vercel Web Analytics may set cookies or similar identifiers. We never use cookies for advertising. The exception is the gift card shop: if you click “Buy gift card”, Diggecard's shop is loaded, and Diggecard, Stripe and Google may then set their own cookies. In addition, we use the browser's localStorage for technically necessary functions (language choice, consent choice and access status).

Consent — and how to withdraw it

Analytics only run if you have clicked "Accept". You can change your choice at any time: open consent settings. If you choose "Decline" after previously having accepted, the page reloads so that no analytics continue in that session. For the newsletter, you withdraw your consent via the unsubscribe link in the email or by contacting us.

Data processors and third parties

We use the following data processors. All are bound by data processing agreements under GDPR Art. 28. For providers outside the EEA, transfers are based on the European Commission's standard contractual clauses (SCC).

• Brevo (Sendinblue): Newsletter and email from the contact form. EU (France). Privacy policy.
• Vercel: Hosting of the website and Vercel Web Analytics (aggregated, cookie-free visitor statistics). USA. Privacy policy.
• PostHog: Product analytics (consent only), EU hosting (eu.i.posthog.com). Privacy policy.
• Microsoft Clarity: Usage analytics and anonymised session recordings (consent only). Microsoft, USA. Privacy policy.
• Cloudflare: Turnstile bot protection on the contact form and newsletter sign-up. USA. Privacy policy.
• Sanity: Content management system (CMS) that delivers text and images on the site. Sanity receives technical requests (IP address, timestamp) when content is loaded. Sanity also stores the temporary, pseudonymised counters that protect sign-up from abuse (deleted after a maximum of 4 days). Privacy policy.
• Supabase: Database for the game's leaderboard (nickname, score and timestamp). EU. Privacy policy.
• DinnerBooking: Table reservations (name, phone, email). Privacy policy.
• Diggecard: Gift cards (payment and contact information). Privacy policy.
• Google Fonts: Fonts are loaded from Google's servers; Google may receive your IP address when loading. Privacy policy.
• jsDelivr / unpkg: Open CDNs that deliver JavaScript libraries; receive technical requests when the page is loaded. jsDelivr.

Your rights

Under the GDPR, you have the right to access, rectify and erase data about you ("the right to be forgotten"), to restrict or object to processing, to data portability, and to withdraw consent. You can also lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority).

Send your request to post@casainferno.no. We respond within 30 days.

Changes

We may update this policy in the event of changes to our services or the law. The date of the last update is shown at the top.

Contact

Casa Inferno
Vestregata 2, 9008 Tromsø
post@casainferno.no
+47 77 68 09 95