What this site collects. And what it does not.

1. Who is responsible

[COMPANY NAME], [REGISTERED ADDRESS], VAT number [VAT NUMBER], is the data controller for this website. Write to [CONTACT EMAIL] about anything on this page.

2. What we collect, and why

When you visit the site

The site is hosted by Cloudflare. To send you a page and protect the site from attacks, Cloudflare processes your IP address, the address you asked for, your browser type and the time of the request. We do not keep access logs ourselves. Legal basis: our legitimate interest in running a secure website (GDPR Article 6(1)(f)).

The fonts are served from our own domain, so no font request goes to a third party.

Your cookie choice

When you answer the cookie banner, your browser stores the answer (yes or no to analytics, and the date) so we do not ask on every page. It is kept in your browser's local storage, not in a cookie, for 12 months, and it is never sent to us or anyone else. This is necessary to respect your choice, so it needs no consent.

Google Analytics, only if you say yes

If you accept analytics, we use Google Analytics 4 to count visits and see which pages people read. Nothing is loaded from Google before you accept. With your consent, Google Analytics collects:

• the pages you view and the page you came from
• your approximate location (country and city, worked out from your IP address; Google does not store the IP address itself)
• your device type, operating system, browser and screen size
• a random identifier stored in the cookies _ga and _ga_LNV75KPPFG, which lasts up to 13 months

We keep detailed event data for 2 months and user-level data for 14 months; after that only totals remain. Google's advertising features and Google signals are switched off, and nothing is used for advertising. Legal basis: your consent (GDPR Article 6(1)(a), and the Danish cookie rules). You can withdraw it at any time under Cookie settings at the bottom of every page; that deletes the analytics cookies.

Google Ireland Limited processes this data for us. Google may transfer it to the United States. Google LLC is certified under the EU–US Data Privacy Framework, and Google's data processing terms include the EU standard contractual clauses.

When you ask for a shop check or contact us

We use the details you give us (your company, your name, work email, your industry, how many shops, when you want a robot running, the job you want covered, and anything you write) to answer you and arrange the visit. We also record that you ticked the consent box, and when. Legal basis: taking steps at your request before a possible agreement (GDPR Article 6(1)(b)), or our legitimate interest in answering business enquiries (Article 6(1)(f)). We keep an enquiry for [RETENTION PERIOD] after our last contact, unless it leads to an agreement.

The form is stored in a database run for us by Supabase, in the EU. To stop the form being flooded, we also store a scrambled (hashed) version of your IP address with it; the address itself is never stored.

When you sign up for emails

On the marketplace page you can ask to hear when it opens, and on the news page you can sign up for news and guides. We store your work email, the business name if you give it, which list you joined, the time, and a hashed IP address. We use them only to send you what you signed up for: a confirmation straight away, then the emails for that list. Legal basis: your consent (GDPR Article 6(1)(a)).

You can withdraw at any time. Every email has an unsubscribe link, the unsubscribe button in your mail app works too, or write to [CONTACT EMAIL]. After you unsubscribe we keep only your address and the date you left the list, so that we never email you on that list again.

When you ask for the investor pitch

On the investor page we ask for your name, email, LinkedIn profile URL and, if you give it, your fund or firm. We use them to email you a link to the pitch, to know who has read it, and to follow up. Each time the link or the pitch is opened we record the time and a hashed IP address. Legal basis: our legitimate interest in knowing who reads a confidential pitch and in talking to prospective investors (GDPR Article 6(1)(f)). We keep a request for [RETENTION PERIOD] after our last contact.

Opening the link sets one cookie, __Host-lb_inv, for 30 days. It only says that your browser may open the pitch. It is strictly necessary for the service you asked for, so it is set without the cookie banner, and it is never used for analytics.

3. Who else sees it

Only the services named above, acting on our instructions: Cloudflare for hosting, Supabase for storing what you send us through a form, Resend for sending the investor pitch email and the emails you signed up for, and Google for analytics if you accepted it. We do not sell personal data, and we do not share it for advertising.

Supabase and Resend each work for us under a data processing agreement that is part of their terms. Supabase Pte. Ltd. is based in Singapore and keeps the form data on servers in Ireland; if it is reached from outside the EU, the EU standard contractual clauses in that agreement apply. Resend (Plus Five Five, Inc.) is based in the United States, so your email address and the emails we send you pass through the US, and for the pitch email so does your name. Resend is certified under the EU–US Data Privacy Framework, and its agreement also includes the EU standard contractual clauses.

4. Your rights

You can ask to see the data we hold about you, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time, and doing so does not affect what happened before. Write to [CONTACT EMAIL]. We answer within one month.

If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk, or to the authority where you live.

5. Changes

When this policy changes, the date at the top changes with it. If we start collecting something new, the cookie banner asks you again.