Privacy Policy

Privacy Policy

Last updated: PLACEHOLDER: date this policy is published

This page explains what happens to your data when you use the three enquiry forms on this website. It does not cover anything else, because nothing else on this site collects data about you: there is no login, no account, no newsletter, and no tracking.

1. Who is responsible for your data

The data controller is:

If you have a question about this policy or about data you have submitted, this is who to contact — see section 9.

2. What we collect, and from which form

The site has three forms, all posting to the same handler. Each one collects only the fields it shows you:

• Request access to the library — your email address, and, optionally, a rough band for how many tenants you manage (a preset choice, not free text).
• Suggest a script — your email address, a short description of the script you're suggesting, and, optionally, a longer description of the problem it would solve.
• Project & freelance work — your email address and a free-text description of what you're trying to do.

Every form also has a hidden field named "website" that is invisible to a person and only a bot would fill in. If it's filled in, the submission is silently discarded — nothing is stored, and no notification is sent.

Whichever form you use, we also record, automatically:

• The time you submitted it (UTC).
• Which form you used (access request, suggestion, or freelance enquiry).
• The country your request appears to come from. This is read from a header Cloudflare, our hosting provider, already attaches to every request — no separate IP-lookup service is called. We do not store your IP address itself.
• A Cloudflare request identifier ("cf-ray"). This ties your submission to Cloudflare's own connection logs, which is useful if we ever need to investigate a delivery or abuse problem. It is not, by itself, enough to identify you.

We do not collect anything beyond what's listed above. In particular, we do not run any analytics, and no data from these forms is used for marketing — the forms themselves say so ("No newsletter. I reply personally.").

3. Why we're allowed to process it (legal basis)

• Requesting library access, or freelance/project work. By submitting either of these forms, you're asking us to take steps towards a possible contract for services. Processing your email address and message for that purpose relies on Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. Where no contract follows, the same processing is separately justified by our legitimate interest (Article 6(1)(f)) in being able to reply to a business enquiry someone chose to send us.
• Suggesting a script. This isn't a step towards a contract — it's feedback. We process it under legitimate interest (Article 6(1)(f)): we want to read and evaluate suggestions to improve the product, and the data involved is limited to what you chose to type plus an email address to reply to.
• The automatic technical fields (timestamp, form type, country, Cloudflare request ID). These are processed under legitimate interest (Article 6(1)(f)) in operating the form reliably and securely — for example, working out what went wrong if a submission fails, or spotting abuse.

We do not rely on consent for any of this, because none of it is optional in the way consent-based processing has to be — filling in a form and asking us to act on it is a request, not something we need separate permission to act on afterwards.

4. How long we keep it

PLACEHOLDER: retention period Simon to set a retention period, e.g. "12 months after your enquiry is resolved". As the code stands today there is no automatic deletion job — old rows stay in D1 until someone deletes them. If a fixed period is published here, it needs either a real deletion process behind it or an honest note that deletion is currently manual.

5. Who else sees it

We use two processors, both already part of running this business day to day — we don't hand your data to anyone else, and nothing here is sold or shared for marketing.

• Cloudflare — hosts the site (Cloudflare Pages), stores submissions (Cloudflare D1), and, as our network provider, necessarily logs requests as part of operating that network and keeping it secure. That logging is Cloudflare's own, governed by Cloudflare's privacy policy, not something we configure.
• Microsoft, through Microsoft Graph — when a form is submitted, we use our own Microsoft 365 tenant to send ourselves a notification email containing what you submitted, so we see it promptly. This is the same tenant behind the rest of the business; no separate email-sending service is involved.

If email delivery fails, the submission is still safely stored in Cloudflare D1 — nothing is lost, and no third party beyond the two above gets involved to recover it.

6. Transfers outside the EU/EEA

Cloudflare and Microsoft are both global operators, and data may be processed on infrastructure outside the EU/EEA as part of using their services. Where that happens, it relies on the safeguards those providers maintain for international transfers (standard contractual clauses or equivalent) under their own data processing terms — we have not independently audited where each provider processes this specific data, and PLACEHOLDER: Simon to confirm the Cloudflare account region and the Microsoft 365 tenant region.

7. Cookies and local storage

We do not use cookies, and we do not run any analytics or tracking.

The one thing stored in your browser is your language choice (English or Danish) — kept using your browser's local storage, not a cookie, purely so the site remembers which language you picked. It is not sent to us, is not personal data, and exists only on your device. Because it's strictly necessary for a feature you actively used (the language toggle), it doesn't require consent under the cookie rules either.

No font, script, or image on this site is requested from a third party — everything, including the typefaces, is served from our own hosting. Your browser makes no request to Google, or anyone else, just by visiting this page.

8. Your rights

Under the GDPR, you have the right to:

• Access — ask what data we hold about you.
• Rectification — ask us to correct anything inaccurate.
• Erasure — ask us to delete your data ("the right to be forgotten").
• Restriction — ask us to limit how we use your data while a dispute about it is resolved.
• Objection — object to processing based on our legitimate interest; we'll stop unless we can show a compelling reason to continue.
• Portability — receive your data in a portable format, or have it sent directly to another controller. This applies to the access-request and freelance forms (processed under Article 6(1)(b)); it does not apply to the script-suggestion form, which is processed under legitimate interest.

9. How to exercise your rights

Email PLACEHOLDER: contact email for privacy enquiries with what you'd like done. We'll reply directly — there's no automated system to route this through, and no portal to log into.

10. Complaint to Datatilsynet

If you think we've mishandled your data, you're welcome to raise it with us first, but you don't have to — you can complain directly to the Danish Data Protection Agency:

11. Changes to this policy

If what this site collects or does with it changes, this page will be updated and the date at the top will change with it. We won't quietly narrow your rights or widen what we collect without saying so here.

← Back to the front page