Privacy
Version 3 (19 October 2026). Superhelt AS, organisation number 928 053 555 MVA, Røsslyngstien 10B, 6530 Averøy, Norway, is the controller for account data, payment references, support enquiries, information from the contact form, technical operation and security data about players and sign-in, and operation of DisplayStation. Contact: hello@displaystation.app.
This notice exists in Norwegian and English. If they conflict, the Norwegian text prevails.
Account and contact data
When you create an account, the account service stores your name, email address, company name, organisation number, language choice and a hash of the password. The password itself is not stored. The purpose is to give you access to the account and the subscription. The basis is that the processing is necessary to take steps toward and perform the contract. We also record email verification and acceptance of the business terms. If the account has more users, we store each user's name, email address and role. The sign-in account remains available after a subscription ends so you can manage invoices or restart. You can request account deletion by email; data needed for legal obligations is handled separately.
The contact form stores name, email address, topic, number of screens, message and language so we can reply. The form is protected against automated abuse with Cloudflare Turnstile. Notifications of submissions are sent to Superhelt via Resend. Incoming email to hello@displaystation.app and hei@displaystation.app is stored in order to handle support, and is forwarded to Superhelt's support inbox through a support email provider. Messages may contain personal data you send us. Do not send personal data from customer content to support by email.
Content you create
Views and media you save while signed in are stored on your account. The demo keeps its own session and is not written to an account. Hosted views, media and screen configurations are deleted automatically and permanently 14 days after paid access or the trial ends. Local player caches must be cleared on the device. For personal data in customer content, the customer determines the purpose and Superhelt AS processes it to deliver the service. Our standard data-processing agreement is entered into together with the subscription terms when you accept the terms. Account owners can export account data, content and files under Profile. Do not upload sensitive personal data.
Sources you connect
RSS feeds and calendars (iCal) you connect are fetched by Superhelt so they can be shown on your screens. We cache titles, times, summaries and calendar events. Pages you place in a view load from their own sites. Those sites apply their own terms. DisplayStation does not control them.
Browser storage
The site stores a language choice in the browser. After you sign in, the account service sets a session cookie and a logged-in hint. The demo uses session storage and a separate temporary store so it stays apart from the account. The browser player stores the screen setup and a device credential locally. Some administration screen choices are stored in the browser. Details are on the cookies and local storage page. This storage is used to run the site, the account and the demo. Cloudflare Web Analytics is used on the website. There is no advertising storage.
Payment
When you continue to pay, DisplayStation sends the account, the license choice, the amount, the currency, the email address and the name to Stripe. Card numbers are entered on Stripe's page. Stripe is the controller for the card data it collects. In Stripe's customer portal the customer may also enter address and organisation or VAT number. The license is recorded when Stripe reports the payment as paid. The return page is not treated as proof of payment. Payment references and accounting documentation are retained separately when required by law; the 14-day content-deletion rule does not override those duties.
Hosting, logs, and the player service
Customer content is stored with Cloudflare in the USA (database Cloudflare D1 and files in Cloudflare R2) and processed in Cloudflare's global network where it is delivered and protected. Superhelt does not promise storage in Norway or the EEA. The transfer is secured with the EU–US Data Privacy Framework and the European Commission's standard contractual clauses (SCC), as described in the data-processing agreement. Database recovery points (Cloudflare D1 Time Travel) are kept for up to 30 days. Operational logs (Cloudflare Workers Logs) are kept for up to 7 days.
Superhelt is itself the controller for technical operation and security data about players and sign-in. The device registry (device ID, model, connection status and timestamps) is kept while the device exists on the account. Player heartbeats (state, software version and network type) are kept for up to 14 days. IP addresses are only hashed, for rate limiting. Superhelt uses this data to operate, secure and troubleshoot the service and protect it against abuse. Which views are assigned to which screens is customer content and is governed by the data-processing agreement, not this operational processing.
Transactional email to the customer's users (for example email verification, receipts, terms notices and password reset) is sent via Cloudflare Email Service. The sender is noreply@displaystation.app. Resend is used only to notify Superhelt's own inbox (hello@displaystation.app) when someone submits the contact form.
Language
If you have not chosen a language, the site may read a country code from Cloudflare's trace endpoint to choose Norwegian or English. It does not ask for precise location. After you choose a language, that choice is stored in the browser and the trace request is not repeated for that choice.
Transfers
Customer content is stored in the USA as set out above. Cloudflare and Stripe can also process data outside Norway, including in the United States, because they operate hosting, delivery, protection and payment. Do not assume that all processing takes place in Norway or the EEA.
Your requests
You can ask for access, correction, deletion, restriction, or a copy by writing to the contact address, and account owners can export account data, content and files under Profile. We handle privacy requests within the applicable statutory deadlines. We may need to verify your identity before disclosing or deleting account data. You can also complain to the Norwegian Data Protection Authority, Datatilsynet.
Cloudflare Web Analytics is used on the website. This page does not say that no data is sent: account data, payment data, and hosting data are sent to the services named above.