Privacy policy · Online Erhverv

1. Data controller

Online Erhverv ApS
CVR: DK43216163
Strandvejen 126, 2900 Hellerup
Email: hej@onlineerhverv.dk
Phone: +45 93 94 12 06

Online Erhverv is the data controller for the personal data we collect and process via our platform (onlineerhverv.dk).

Data controller vs. data processor: This policy covers the data for which we are the data controller, that is you as a user and your company's account, payment and usage data. When you use the platform to process data about your own customers (for example chatbot conversations, bookings and jobs), you are the data controller and we are your data processor. That relationship is governed by our data processing agreement.

2. What data do we collect?

2.1 Information you give us

Account information: Name, email, password, phone number, company name, industry
Company data: Opening hours, services, prices, FAQ answers, uploaded documents
Payment information: Processed by Stripe. We receive transaction data (amount, status, time) but never full card details
Position on the way to a job: When an employee taps Start drive, the phone's latest position is stored so the customer and the business can follow the drive. It stops when the employee arrives, starts the job or cancels, and after 3 hours at the latest. No position is collected outside a drive

2.2 Data we collect automatically

IP address, device type, browser, language
User behaviour on the platform (page views, clicks, sessions)
Technical data via cookies: necessary cookies always; statistics and marketing cookies only with your consent (see the cookie policy)
Where you came from when you signed up: campaign (utm parameters), landing page and any partner or referral code. Ad click IDs (gclid/fbclid), Meta's cookie IDs and the referring page are only stored if you have accepted marketing cookies. We do not store your IP address for this purpose.

2.3 Data from integrations

When you connect third-party services (for example Google Calendar, Billy, e-conomic, SimplyBook.me), we synchronise data from these services to your account:

Booking systems: Bookings, client names, times, services
Accounting systems: Contacts, invoices (amounts, status, dates)
Payment systems: Transactions, amounts
Messaging services: Conversations, contact details
Review platforms: Reviews, ratings

This data belongs to you and is processed solely to provide our service to you.

2.4 Chatbot data

When your customers use your AI chatbot (via your website or a chat link), we collect:

Chat messages (questions and answers)
Session ID (anonymous)
Contact details (name, phone) if visitors voluntarily provide them
IP address (for rate limiting)

3. Purpose and legal basis

Purpose	Legal basis
Creating and operating your account	Performance of a contract (Art. 6(1)(b))
Payment and invoicing via Stripe	Performance of a contract (Art. 6(1)(b)) + legal obligation, the Danish Bookkeeping Act (Art. 6(1)(c))
Providing the AI chatbot to your customers	Performance of a contract (Art. 6(1)(b))
Synchronising integration data	Performance of a contract (Art. 6(1)(b)); you activate it yourself
Automatic reminders and sequences (SMS/email)	Performance of a contract (Art. 6(1)(b)) + legitimate interest (Art. 6(1)(f))
Support and troubleshooting	Legitimate interest (Art. 6(1)(f))
Statistics and improving the platform	Legitimate interest (Art. 6(1)(f))
Newsletters and marketing	Consent (Art. 6(1)(a))
Visitor statistics on the website (Google Analytics 4)	Consent (Art. 6(1)(a) and the Danish Cookie Order, cookiebekendtgørelsen). Can be withdrawn under "Cookie settings"
Measuring ads and campaigns (Google Ads, our own campaign and partner cookies)	Consent (Art. 6(1)(a) and the Danish Cookie Order, cookiebekendtgørelsen). Can be withdrawn under "Cookie settings"
Recording which campaign or partner a new customer came from (campaign level, without cookies)	Legitimate interest (Art. 6(1)(f)): being able to settle partner commission and assess our marketing

4. Data processors and third parties

We use the following sub-suppliers to provide our service:

Supabase (EU/Ireland): Database and authentication
Vercel (USA/EU): Hosting and serverless functions
Stripe (USA): Payment processing
Anthropic (USA): AI models (Claude), primary AI provider
OpenAI (USA): Speech-to-text (Whisper) of audio recordings, for example dictated quotes and notes (always), and AI models (GPT) as a fallback when Claude is down
ElevenLabs (USA): AI phone: voice synthesis, recording and transcription of calls. Audio and transcripts are stored at ElevenLabs for 90 days (for calls from 7 October 2026; older calls are deleted on request)
Resend (USA): Email sending (transactional)
Twilio (USA): SMS and phone infrastructure
Google (EU/USA): Google Maps Platform: address autocomplete, geocoding and driving time
Google (EU/USA): Gmail OAuth, Google Calendar and Google Business Profile (only if you connect them)
Sentry (USA): Error monitoring (technical error reports, which may contain information from the action that failed)
Microsoft (EU/USA): Outlook/Microsoft 365 OAuth (only if you connect it)
Make.com (EU): Workflow automation (only if you connect it)
Accounting, payroll and other business systems (for example e-conomic, Dinero, Billy, Salary, Zenegy, Planday, Apacta): only if you connect them yourself

For US providers, we ensure a lawful transfer via the EU Standard Contractual Clauses (SCC) and/or the EU-U.S. Data Privacy Framework.

Statistics and ads (only with your consent)

Google Ireland Ltd. (EU/USA): Google Analytics 4 (statistics) and Google Ads (conversion measurement). Only loaded once you have accepted the category in question.

5. Retention and deletion

We only keep personal data for as long as is necessary for the purpose. Specifically:

Account data: As long as your account is active. After cancellation, the account and related data are deleted automatically within 12 months
Chatbot conversations: Deleted automatically after 12 months
The AI phone's transcripts and audio recordings: Deleted automatically after 90 days (audio recordings at ElevenLabs for calls from 7 October 2026)
Position during a drive: The coordinates are removed when the drive ends (arrived, job started or cancelled). If the drive expires after 3 hours, the position is no longer shown and is deleted at the next daily clean-up
Integration data: Deleted when the integration is disconnected or when the account is deleted
Payment and bookkeeping data: 5 years under the Danish Bookkeeping Act (bogføringsloven)
Support requests: Up to 24 months

6. Your rights

You have the right to:

Access your personal data
Have inaccurate information corrected
Have your data deleted ("the right to be forgotten")
Restrict the processing
Object to processing
Receive your data (data portability)
Withdraw consent

You can complain to the Danish Data Protection Agency (Datatilsynet) if you believe we process your data in breach of the rules.

7. Automated decisions and AI

We do not make decisions that have legal effects or similarly significant effects for you based solely on automated processing (GDPR Article 22). AI is used as a tool, for example to prepare quotes, answer in chat or answer calls, but a human can always step in, and significant actions are approved by a human. Read more on our AI transparency page, including which models we use and how you can always get in touch with a human.

8. Security

We use technical and organisational security measures, including:

Encryption of data in transit (TLS) and at rest
Encryption of integration tokens with AES-256
Row Level Security in the database (access to your own data only)
Rate limiting on all public API endpoints
Access control with role-based authorisation

9. Children

Our platform is not aimed at children under 18. We do not knowingly collect information from children.

10. Changes

We may update this policy if our data processing or the law changes. The latest version is always available on this page.