LEGAL

PRIVACY POLICY

Last updated: 29 August 2026

This Privacy Policy explains how Norehill Solutions AB processes information when you visit the PINGDORA website.

This policy describes the website as it operates today. Features that are planned but not yet publicly available, including AI chat and persistent memory, are clearly identified as future features.

1. Who we are

PINGDORA is operated by:

Norehill Solutions AB
Organisation number: 559375-7155
Norehillsvägen 21
134 92 Tynningö
Sweden

Norehill Solutions AB is the data controller for the processing described in this Privacy Policy.

For privacy questions or requests concerning your personal data, contact: art@norehill.com

2. What PINGDORA does today

PINGDORA is currently a public entertainment and content website featuring idol profiles, music, videos, artwork, galleries and stories from the PINGDORA universe.

There is currently:

• no user account system;
• no user login;
• no public AI chat integration;
• no stored AI chat history;
• no AI memory database;
• no public connection to an AI/LLM provider.

The website creates a randomly generated anonymous identifier in your browser. At present, this identifier is stored locally and is not used to identify you personally, create an advertising profile about you or send information about you to an AI provider.

PINGDORA uses Google Analytics 4 (GA4) to understand how visitors use the website. Google Analytics is activated only after you give consent through our cookie/privacy controls.

3. Information we process

Privacy preferences

The website stores your privacy and cookie choices in your browser so that it can remember whether you have accepted or rejected optional technologies such as analytics.

Anonymous browser identifier

PINGDORA generates a random anonymous identifier and stores it in your browser using localStorage.

The identifier is currently stored only in your browser and is not currently associated with an account, name, email address, chat history or AI memory.

It is intended to allow future PINGDORA functionality to recognise the same browser without requiring an account.

If you clear your browser's site data or localStorage, the identifier may be deleted and a new identifier may be generated on a later visit.

The PINGDORA anonymous browser identifier is not intentionally sent to Google Analytics as a Google Analytics User-ID, user property or analytics event parameter.

Technical browser storage

PINGDORA may use localStorage, sessionStorage, cookies or similar browser technologies where technically necessary to maintain privacy preferences, site functionality, interface state or temporary application state.

Necessary browser storage is separate from optional analytics.

Analytics data

If you consent to analytics, PINGDORA uses Google Analytics 4 (GA4) to collect information about how the website is used.

This may include information such as:

• pages viewed;
• interactions with website features;
• approximate geographic information;
• device and browser information;
• referring website or source;
• session and usage information; and
• analytics identifiers stored in or associated with your browser.

We do not intentionally send your name, email address, private messages, AI conversation content or AI memories to Google Analytics.

Google Analytics remains disabled until you provide the required analytics consent.

Hosting and technical requests

PINGDORA is hosted using Microsoft Azure Static Web Apps.

When you access the website, Microsoft Azure processes technical network requests necessary to deliver and secure the website. Such requests may include information such as your IP address, requested URL, timestamp, browser or user-agent information and other technical network information.

PINGDORA does not currently use Azure Application Insights for application analytics or monitoring.

4. Legal basis for processing

Where personal data is processed to deliver, operate and secure the website, Norehill Solutions AB relies on its legitimate interests under Article 6(1)(f) GDPR.

Browser storage that is strictly necessary for providing requested functionality may be used without analytics consent where permitted under applicable electronic communications and privacy rules.

For Google Analytics, we rely on your consent under Article 6(1)(a) GDPR.

Where required, analytics cookies and similar non-essential technologies are used only after you have provided consent.

You may withdraw your analytics consent at any time through Cookie Settings. Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

5. Cookies and browser storage

PINGDORA uses cookies and browser storage for necessary website functionality and, with your consent, analytics.

Necessary browser storage may include:

• your cookie/privacy preference;
• a randomly generated anonymous browser identifier;
• temporary interface or session state.

Google Analytics may set analytics cookies or use similar technologies only after you have consented to analytics.

A separate Cookie Policy provides additional information about the cookies and browser storage used by PINGDORA.

You can use Cookie Settings to manage optional technologies and withdraw analytics consent.

Clearing your browser's cookies and site data may also remove locally stored PINGDORA preferences and identifiers.

6. Google Analytics

PINGDORA uses Google Analytics 4 (GA4), a web analytics service provided by Google.

Google Analytics helps us understand how visitors use PINGDORA, for example which pages are visited, how visitors reach the website and how visitors interact with website features.

Google Analytics is activated only after you consent to analytics through our cookie/privacy controls.

If you reject analytics, Google Analytics remains disabled.

Where configured, Google Analytics may use cookies or similar browser technologies to distinguish browsers and sessions and measure website usage.

We configure Google Analytics for website analytics and do not intentionally send names, email addresses, private messages, AI conversation content or AI memories to Google Analytics.

The PINGDORA anonymous browser identifier is kept separate from Google Analytics and is not intentionally used as a Google Analytics User-ID or analytics identifier.

Analytics consent is separate from PINGDORA's core functionality. Rejecting analytics will not prevent you from accessing the public website.

GA4 user-level and event-level data retention is configured for 2 years (default GA4 setting).

Google may process analytics information using infrastructure located outside the EU/EEA. Where required by applicable data protection law, international transfers are subject to appropriate safeguards.

You can withdraw your analytics consent at any time using Cookie Settings.

7. PINGDORA AI Chat and Persistent Memory

Current status: not publicly available.

PINGDORA is being developed to allow visitors to interact with virtual idols using artificial intelligence.

The planned functionality may eventually include text or voice conversations that can continue across visits and memory that allows an idol to recognise a returning visitor.

These features are not currently publicly available.

At present:

• PINGDORA does not provide a public AI chat service;
• no public visitor messages are sent to an AI model;
• no public AI conversation history is stored;
• no persistent AI memories about public visitors are stored;
• the anonymous browser identifier is not currently connected to an AI conversation or AI memory.

Before AI chat or persistent memory becomes publicly available, this Privacy Policy will be reviewed and updated to explain the actual implementation, including:

• what conversation data is processed;
• which AI and infrastructure providers receive data;
• what information is stored;
• how persistent memory works;
• the purposes and legal bases for processing;
• applicable retention periods;
• international data transfers and safeguards, where applicable; and
• how users can exercise their privacy rights in relation to conversation and memory data.

AI and analytics

PINGDORA intends to keep AI conversation content separate from website analytics.

Conversation messages, AI prompts, AI responses and persistent memories will not intentionally be included in analytics event names, event parameters, URLs, page titles or user properties.

Rejecting analytics will not prevent or degrade access to AI chat functionality when that functionality becomes publicly available.

Sensitive information

When AI chat becomes publicly available, users should avoid submitting information they would not want processed or stored, particularly highly sensitive personal information.

This may include health information, financial information, government identifiers, precise location information, information about other people, or information revealing matters such as political opinions, religious or philosophical beliefs, ethnicity or sexual orientation.

PINGDORA is an entertainment experience. It is not intended to provide medical, legal, financial, emergency or crisis services.

8. Who receives information

PINGDORA currently uses service providers that help us operate and understand use of the website.

These include:

• Microsoft — for website hosting through Microsoft Azure Static Web Apps.
• Google — for Google Analytics 4, but only where you have consented to analytics.

These providers may process technical or analytics information as necessary to provide their respective services.

PINGDORA does not sell personal data.

No public AI/LLM provider currently receives PINGDORA conversation data because public AI chat has not yet been launched.

9. International processing and transfers

PINGDORA uses cloud and analytics services provided by Microsoft and Google.

Microsoft Azure Static Web Apps uses globally distributed infrastructure. Google may also process analytics information using infrastructure located in different countries.

As a result, certain personal data may be processed outside Sweden and, depending on the service and circumstances, outside the EU/EEA.

Where GDPR requires safeguards for transfers of personal data outside the EU/EEA, applicable contractual or other lawful transfer mechanisms used by our service providers apply.

10. Data retention

We retain or allow processing of information only for as long as necessary for the relevant purpose, subject to applicable legal requirements and the operation of our service providers.

Privacy choices

Your privacy choices remain in your browser until they expire, are changed, or you clear the relevant browser/site data.

Anonymous browser identifier

The anonymous PINGDORA identifier remains in your browser until the site's localStorage is cleared or the identifier is otherwise removed.

Temporary session information

Temporary session information normally remains only for the relevant browser session or until removed by the browser or application.

Google Analytics

GA4 user-level and event-level data retention is configured for 14 months.

Certain aggregated reporting information may be retained differently as part of the operation of Google Analytics.

AI conversations and memories

No public AI conversations or persistent AI memories are currently stored because public AI chat is not yet available.

Azure

Technical information processed by Microsoft as part of providing Azure services is handled according to Microsoft's applicable service terms, security practices and retention arrangements.

11. Your rights

Depending on the circumstances and applicable law, the GDPR gives you rights concerning your personal data.

These may include the right to:

• request access to your personal data;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• receive certain personal data in a portable format where applicable; and
• withdraw consent where processing is based on consent.

You can withdraw your analytics consent through Cookie Settings.

To exercise your other privacy rights or ask questions about the processing of your personal data, contact art@norehill.com.

Because PINGDORA currently has no user accounts and the PINGDORA anonymous identifier is stored only in your browser, Norehill Solutions AB may not be able to identify information as belonging to you from your request alone.

We will not attempt to identify you unnecessarily solely for the purpose of responding to a privacy request.

You also have the right to lodge a complaint with a data protection supervisory authority.

In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY).

12. Children

PINGDORA does not currently impose a specific minimum age for viewing the public website.

The website does not currently provide user accounts or publicly available AI chat functionality.

Before interactive AI functionality intended for, or likely to be used by, children is introduced, PINGDORA will assess the applicable requirements and update its privacy information and safeguards where necessary.

13. Changes to this Privacy Policy

We may update this Privacy Policy when PINGDORA changes or when our processing of personal data changes.

In particular, this policy will be reviewed and updated before public AI chat or persistent AI memory is introduced and when material changes are made to analytics or other data-processing functionality.

The date at the top of this Privacy Policy indicates when it was last updated.