01Encrypted connections
Every connection to our websites, the app and our servers uses HTTPS. Our sites tell browsers to use HTTPS only (HSTS).
02Encrypted backups
Database backups are encrypted before they leave the server and are copied to a separate server. They are deleted after up to 30 days.
03Limited access
Each part of our system can reach only the data it needs, and our databases aren’t reachable from the internet. Staff access to our systems is limited to the people who need it. Changes to access, codes, payments or offers are made by script and recorded in an audit log.
04Logs without personal data
Our logs and error reports leave out names, email addresses, health values, food text, addresses, codes and passwords. Account ids are hashed. Error reports stay in our own error monitoring, on our own servers.
06Photos and AI
Before a meal photo goes to our AI provider, we remove its location data. We never send your name, email or other personal details with an AI request.
07Payments
Payments on galaxyxplore.com are handled by Stripe, which is certified to PCI DSS, the card industry’s security standard. App purchases are handled by Apple and Google. We never see or store card numbers.
08Partners under contract
Every company that processes personal data for us does so under a data processing agreement (GDPR Art. 28). The privacy policy lists them.
09If something goes wrong
If a breach puts personal data at risk, we report it to Datatilsynet within 72 hours of finding it, and tell you without undue delay if the risk to you is high.
Think something is wrong? Report a suspected incident through the contact form.
Keeping your data safe is part of the job, not an extra.
Back to top