Government Data Request Policy

Seam is operated by Banana for Scale AS, a Norwegian limited liability company. This policy sets out how we handle requests from public authorities — police, regulators, courts, or national security bodies — for data belonging to the merchants who use Seam or to their customers.

1. Every request is reviewed for legality

We do not comply with a request simply because it arrives. Before any data is disclosed, we review whether the request is legally valid: whether it comes from an authority with jurisdiction over Banana for Scale AS, whether it is properly served, whether it cites a lawful basis, and whether it is specific rather than open-ended. Requests from outside Norway and the EEA are expected to come through a mutual legal assistance treaty or an equivalent recognised channel. A request that fails this review is not actioned.

2. We will challenge unlawful requests

Where a request appears unlawful, overbroad, improperly served, or inconsistent with GDPR or Norwegian law, we will object to it and, where necessary, seek legal counsel and contest it through the appropriate authority or court. We will not treat a questionable request as valid for convenience.

3. We disclose the minimum necessary

Where we are legally compelled to disclose, we disclose only the specific data covered by the request and nothing further. We do not hand over an entire account record, an entire store history, or unrelated data belonging to other merchants because it was convenient to export. Where a narrower response satisfies the legal obligation, we provide the narrower response.

4. We document every request

We keep a written record of each request received: the requesting authority, the date, the legal basis cited, the data sought, our legality assessment, any objection raised, what was ultimately disclosed, and who made the decision. These records are retained so that our handling can be audited.

5. We notify affected users where we can

Where we are not legally prohibited from doing so, we notify the affected merchant before disclosing their data, so they have the opportunity to seek their own legal remedy. Where a gag order or statutory restriction prevents notice, we notify as soon as that restriction lapses.

6. What we actually hold

The scope of any request is limited by how little we store. Seam holds aggregated store metrics, generated summary text, merchant settings, and access tokens for connected services. We do not store individual customer records, and we do not store personal data about people who saw or clicked a merchant’s ads. Details are in our Privacy Policy.

7. Contact

Legal requests should be directed to banana@bananaforscale.biz. Requests sent by other channels may not reach the person responsible for reviewing them.