Kryptoro

Privacy policy

Last updated: 18 October 2026

This policy explains what personal data Kryptoro processes, why we process it, who receives it, how long we keep it, and the rights you have.

1. Who is responsible for your data

Vimi Pussewala Hewage, a Norwegian enkeltpersonforetak (sole proprietorship), org. no. 929 487 125, Blakstadmarka 26, 1386 Asker, Norway ("Vimi", "we", "us") is the controller for the personal data processed in Kryptoro.

For anything about your personal data, including using your rights below, email support@viminorge.com. We have not appointed a data protection officer, as the law does not require one for a business of our size and type.

2. What data we process

Account data
Your email address, the user ID from our sign-in provider, and the session data needed to keep you signed in securely.
Transaction data
The crypto transactions you enter or import: dates, assets, quantities, prices, fees, the names you give exchanges and wallets, and any notes you add. This shows your trading activity and holdings, so we treat it as confidential financial data.
Tax figures and reports
The gains, losses, income and year-end holdings and values in NOK that Kryptoro calculates, and the tax years you finalize.
Subscription and billing data
Your trial and subscription status and your Stripe customer reference. Your card details and billing address are entered on Stripe's pages and held by Stripe — we never see your full card number.
Account access record
A Vimi account record, held by us, with your user ID, whether you have access to Kryptoro, and when and how it was granted.
Technical data
Your IP address, browser and device details, and server logs, processed by Clerk and Vercel to deliver Kryptoro and keep it secure.

Most of this data comes from you. Your subscription and payment status comes from Stripe. If you used our earlier service VimiCrypto, we moved your account and transaction history from it into Kryptoro so that you can keep using it, and we keep a record of corrections made during that move.

We do not ask for your national identity number, bank account details or wallet private keys, and we never need access to your exchange accounts.

3. Why we process it, and our legal basis

Providing Kryptoro
Creating your account, storing your transactions, calculating your tax figures and keeping your finalized reports. Legal basis: necessary to perform our agreement with you (GDPR art. 6(1)(b)).
Subscriptions and payments
Running your free trial and Kryptoro Pro subscription. Legal basis: necessary to perform our agreement with you (art. 6(1)(b)).
Bookkeeping
Keeping records of payments and invoices. Legal basis: our legal obligation under the Norwegian Bookkeeping Act (bokføringsloven) (art. 6(1)(c)).
Security and operation
Protecting accounts, preventing misuse and fixing faults. Legal basis: our legitimate interest in a secure, working service (art. 6(1)(f)).
Moving VimiCrypto customers
Bringing existing VimiCrypto data into Kryptoro. Legal basis: performing our existing agreement with you, and our legitimate interest in continuing your service without loss of data (art. 6(1)(b) and (f)).

Where we rely on our legitimate interest, we have weighed it against your interests and rights, and you can object (Section 8). We do not rely on your consent for any processing, so there is no consent to withdraw.

Providing your account and transaction data is a requirement of our agreement: without it, we can't provide Kryptoro or calculate your figures. Keeping payment records is a legal requirement.

Kryptoro calculates your figures automatically, but it makes no decisions about you that have legal or similarly significant effects (art. 22). What you report to Skatteetaten is your own decision.

4. Who receives your data

We never sell your personal data and never use it for advertising. To run Kryptoro, we use the service providers below. They process data only on our documented instructions under data processing agreements, and may use their own sub-processors under the same obligations. Stripe is also an independent controller for some processing it is legally required to do, such as fraud prevention and anti-money-laundering checks (see stripe.com/privacy).

Clerk, Inc. (clerk.com)
Sign-in, account and session management. Location: USA. Transfer basis: Certified under the EU–US Data Privacy Framework, with the EU Standard Contractual Clauses (Commission Decision 2021/914) as a supplementary basis.
MongoDB, Inc. — MongoDB Atlas (mongodb.com)
Database storage of your transactions, tax reports, subscription status and account record, including encrypted daily backups. Location: Stored in Ireland (EU), on Microsoft Azure's North Europe region. MongoDB, Inc. is a US company and may access the data from the USA for support and operations. Transfer basis: For any access from the USA: certified under the EU–US Data Privacy Framework, with the EU Standard Contractual Clauses (Commission Decision 2021/914) as a supplementary basis.
Vercel Inc. (vercel.com)
Hosting — all traffic to and from Kryptoro passes through Vercel's infrastructure. Location: USA. Transfer basis: the EU Standard Contractual Clauses (Commission Decision 2021/914).
Stripe Payments Europe, Ltd. and Stripe, Inc. (stripe.com)
Payment processing, subscriptions, invoices and the billing portal. Location: Ireland and USA. Transfer basis: Certified under the EU–US Data Privacy Framework, with the EU Standard Contractual Clauses (Commission Decision 2021/914) as a supplementary basis.

To value your transactions in NOK, Kryptoro looks up historical prices and exchange rates from CoinMarketCap and Norges Bank. These lookups contain only an asset and a date — never your identity or your transactions.

You can ask for a copy of the transfer safeguards by emailing support@viminorge.com. We may also disclose data where Norwegian law requires it, for example to a public authority with a lawful request.

5. How long we keep your data

If you might need your figures later, for example for a question from Skatteetaten, keep your own copy of your reports before you delete your account.

6. Security

Your data is encrypted in transit and at rest. Access to it is limited to what is needed to run and support the service, and every request inside Kryptoro is checked against your signed-in account so that you can only see your own data.

7. Cookies

Kryptoro uses only the cookies needed to sign you in and keep your session secure. They are set by Clerk, our sign-in provider. We do not use analytics, advertising or tracking cookies, so we don't ask for cookie consent.

Stripe's checkout and billing pages set their own cookies, needed for payments and fraud prevention, when you use them.

8. Your rights

Under the GDPR, you have the right to:

To use any of these rights, email support@viminorge.com. We will answer within one month. If your request is complex, we may extend this by up to two further months, and we will tell you why. We do not charge for this. Some rights have limits — for example, we must keep bookkeeping records for the period the law requires even if you ask us to delete them.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or Datatilsynet, Postboks 458 Sentrum, 0105 Oslo. You don't need to contact us first.

9. Changes to this policy

We will update this policy when Kryptoro changes, when we start using a new service provider, or when the law requires it. The latest version is always on this page with its date at the top. If a change is material, we will give notice in the app and on this page before it takes effect.