Privacy policy

Draft, last updated 20 October 2026. Læs på dansk

Data controller: Grumsen Development ApS (contact: contact@grumsendev.com). This is a translation of the Danish privacy policy; if they differ, the Danish version applies.

Your account

We store your name, your email address, a one-way hash of your password (never the password itself), your API keys (hashed), the companies you monitor, your webhook URLs and your notification settings. We use this information to run your account and to send the emails you ask for (confirmation, password reset, change notifications). Legal basis: performance of our agreement with you (GDPR Art. 6(1)(b)).

To limit abuse, we count requests per IP address. The address is stored only as a one-way hash and for no more than two days.

Emails are sent via Postmark (ActiveCampaign, USA, covered by the EU-US Data Privacy Framework). The website runs at Vercel (EU region) and the database at Hetzner (EU). A frozen copy of the previous database at Microsoft Azure (EU region) will be deleted no later than 31 October 2026.

You can delete your account under Konto → Indstillinger (Account → Settings) after confirming with your password. Your own saved lists are deleted, also when they are shared with a team. Teams with other owners continue; if you are the last owner, you can transfer ownership or confirm that the team is dissolved. Other members’ own lists then become private. Public register data is not deleted with your account. You can also contact us for help.

When you save a selection in Min radar (My radar), we store your chosen criteria (selection, industry and area) with your account. You can remove it again in Min radar. New matches can be included in your weekly email if it is switched on.

Min radar continuously compares your selections and monitored companies with new register and accounts data. Updates, read/hidden status and source information are stored with your account for no more than 90 days. When you remove a selection or a monitored company, its updates are deleted. The weekly radar email is on by default for confirmed accounts. Existing email opt-outs are kept, and you can switch the digest off under Konto → E-mails og radar; signing in does not change your opt-out. The first check happens seven days after activation, and an email is sent only when there are new updates. While it is on, CVR notifications are collected in the weekly email. Emails from saved lead lists are controlled separately.

The Firmaradar app

The app uses the same account and the same information as the website; everything in this policy also applies to the app. You sign in with your email and password. Creating an account, resetting your password and deleting your account happen on firmaradar.dk.

When you sign in, we store an app session with your account: one-way hashes of the app’s access keys (never the keys themselves), the device name the app reports, and when the session was created and last used. A session expires 60 days after it was last used and is deleted when you sign out, choose “sign out everywhere”, change or reset your password, or delete your account. The keys themselves are stored on your device so you stay signed in, and are removed when you sign out.

What you do in the app (following companies and owners, saving companies, notes and selections, marking updates as read) is stored with your account as on the website. To limit abuse, we count sign-in attempts per IP address and email address, and requests per account, in short time windows. The app shows no ads, and we do not use information from the app to track you across other companies’ apps or websites. We do not sell any information.

Legal basis: performance of the agreement about your account (GDPR Art. 6(1)(b)) and our legitimate interest in protecting the service against abuse (Art. 6(1)(f)).

Private notes, radar choices and feedback

Saved companies store the CVR numbers you choose, together with your private notes, your own status and any next step with a date. This information is not shared with your team and is not used as register facts or to infer purchase intent. Reminders are shown on the page; no reminder email is sent. You can delete each entry or the whole account. We also store your choice to hide the getting-started guide.

Your chosen radar and CVR change types and any accounts thresholds are stored with the account. Feedback and survey answers you send yourself are linked to the account, can be read by administrators and are deleted after no more than 90 days or together with the account. If you choose so in a survey, we may contact you personally about a user interview. This does not sign you up for marketing. We do not use your private notes in visitor statistics or newsletters.

Profile drafts and access agreements

Private profile drafts store your own descriptions, links and any logo. They can be seen by you and Firmaradar’s administrators and are not shown publicly. You can delete the draft and its access requests under Konto → Virksomhedsprofil. We keep earlier access requests, the price shown, status and time-limited access grants, and a log of changes, as a history of access agreements. An expression of interest is not a payment agreement or a marketing sign-up. The information is stored with the account and deleted when the account is deleted.

Public company profile and payment

When you ask to represent a company, we store your stated role, your reason and the administrator’s basis for the check, decision and time. Submitted profile versions are stored separately from the draft, so only approved content is published, at your explicit choice. We keep no more than three submitted versions per profile. The public presentation and logo are visible to everyone; check notes and drafts are private. Hiding removes the presentation from Firmaradar’s public pages but cannot remove copies others have already saved.

Profile owners can see total profile views and clicks on contact, website and service links for their own profile. They cannot see visitors’ identities or individual visits. The measurement uses our own visitor statistics with the same privacy choices and 90-day deletion. Administrators’ and profile owners’ own visits while signed in are left out.

If you choose a paid subscription, we send your name, email and an internal account reference ID to Stripe. Card and billing details are entered at Stripe; we do not store card numbers. We store customer, checkout and subscription IDs, product/CVR, the accepted terms version and time, payment status, the confirmed access period and any payment disputes. We also store when a checkout session was first created, so we can follow the flow until payment is confirmed. A necessary cookie can remember the page you came from for one hour, so you can continue after payment. It is sent only to our payment page and not to Stripe. Stripe handles payments and invoices under its own privacy terms. You must end running subscriptions before self-service account deletion; contact us if you need help. Deleting the account does not delete invoices that must be kept by the payment provider.

Ugens Firmaradar (weekly newsletter)

The newsletter is optional and requires a separate sign-up. It contains company news, tips and news about Firmaradar’s features, also when you have no personal radar updates. If your personal radar digest is on, it is included in the same weekly email. Creating an account or signing in does not sign you up for the newsletter. You can sign up under Konto → E-mails og radar.

We store your choice, the time, where you signed up and the version of the text you accepted, as well as the latest unsubscribe and send. The information is stored with your account. You can withdraw your consent via the unsubscribe link in every newsletter or under Konto → E-mails og radar. Legal basis for the newsletter: your consent (GDPR Art. 6(1)(a)). Postmark handles the unsubscribe link and tells us about unsubscribes and delivery blocks. Unsubscribing does not affect account and security emails or your separate choice for personal radar updates. We do not record opens or individual clicks in the newsletter.

Newsletter and free guides (Imprint)

Some public pages, including company, industry, report and guide pages and the front page, have a box where you can sign up for our newsletter and get a free guide or checklist. The box is provided by Imprint, our own newsletter platform, run by Grumsen Development ApS, so the data controller is the same. The list is separate from Ugens Firmaradar and from any account you have: signing up here does not change your account settings, and unsubscribing from one does not affect the other.

The box is loaded from newsletter.grumsen.dev. It sets no cookies and stores nothing in your browser. When the box is shown, Imprint counts one view without identifying you; as with any request, the server receives your IP address and browser information. Only when you sign up do we store your email address, the consent text you saw and its version, the time and the page you signed up from (with any referring page and campaign tags), as well as IP address, browser information and approximate country and region from the hosting environment as documentation of consent. You then get an email with a confirmation link (double opt-in); we send the guide and the newsletter only after you have confirmed.

Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw your consent at any time via the unsubscribe link in every email. Imprint runs at Vercel (EU region), and emails are sent via Postmark. Unlike Ugens Firmaradar, Imprint records opens and clicks per recipient, so we can see which emails and links are used. When you unsubscribe, sending stops; the documentation of consent and unsubscribe is kept. You can also ask us to delete your information.

Getting started and email coordination

The “Kom godt i gang” (getting started) series is on for new accounts created via sign-up and, from 6 October 2026, also for existing accounts that have not unsubscribed from it before. After you confirm your email (for existing accounts from 6 October 2026), we can send no more than three tips in the first 14 days. You can unsubscribe in every email or under Konto → E-mails og radar, and unsubscribing applies from then on. Tips are chosen based on whether you have followed a company, saved a selection, created a lead list or saved a company in your private collection, and whether you have already chosen lead-list notifications. A completed action stops the reminders that are no longer relevant. We do not treat missing visitor statistics as a sign that you are inactive.

We store the consent text, version, time and source, as well as the start, end and any unsubscribe, with the account. Legal basis for the getting-started series: your consent (GDPR Art. 6(1)(a)). You can unsubscribe in every getting-started email or under Konto, where you can also unsubscribe from both the series and the newsletter. A normal sign-in does not restart the series, and existing accounts are not signed up automatically.

To coordinate messages and avoid duplicates, we store planned and attempted sends, category, the provider’s message ID, status and any delivery or bounce report in our database. Details are deleted after 90 days; unresolved send IDs for running digests are kept until the outcome is known, so a clean-up does not cause duplicates. We do not store email content in the send log. Delivery blocks and complaints stop optional product emails across categories. All account-linked information is deleted with the account.

Visitor statistics

We collect visitor statistics ourselves to understand where visitors come from and which public pages and features are used. The statistics are stored in our own database and are not sent to an external analytics service. They include page views, referring domains, campaign tags, device type and country, when our hosting environment provides it.

We do not use analytics cookies or a persistent ID in your browser. The server creates a pseudonymous statistics key from the IP address, browser information and UTC date with a secret key. The statistics key changes every day; raw IP addresses and full browser information are not stored in the visitor statistics. Shared networks can be counted as the same visitor. We respect the browser’s Do Not Track and Global Privacy Control. Statistics records are deleted after 90 days by a daily clean-up.

We filter search texts, phone numbers, private account pages and confirmation and reset links out of the measurement. Name, email address and account ID are not part of the visitor statistics. A source can follow internal navigation for up to 30 minutes via the daily statistics key. Administrators can separately see account information, creation date, confirmation status and the number of saved lists, monitored companies and active API keys as part of running the service.

Ads from Google

Some public pages on the website show ads labelled “Annonce” (ad) from Google AdSense. The ads are delivered by Google Ireland Limited, which is an independent data controller for the processing in connection with the ads. We show only Google’s “limited ads”: they are not targeted based on you or your earlier visits, and Google does not use cookies or other storage in your browser for the ads. Google receives the technical information that any request to Google’s servers gives, including IP address and browser information, and uses it to deliver and count the ads and to prevent fraud and abuse. Read more in Google’s description of ads and Google’s privacy policy. We receive no information about you from Google beyond total revenue figures. Radar Pro shows no ads, and the app shows no ads.

Use of your account

We also measure whether accounts are used again after they are created, and which radar updates are shown, opened or lead to a company being followed. For this we store the account ID, active UTC days and whether the pricing page was shown that day, as well as the time of the first view, open and follow action on an update. We do not store a list of the pages an account visits. This information is stored in our own database for no more than 90 days and is deleted with the account. Administrators see total measurements of activation and return visits.

Do Not Track and Global Privacy Control switch off the measurement of active days and update actions. The time of the account’s first saved searches, first monitored company and first lead list, first company in the private collection and an explicit choice of lead-list notifications are kept as part of the account’s use of the features until the account is deleted. We do not use email open pixels. The account measurements are not linked to the daily visitor keys or to external analytics services.

Your rights

You can ask for access, rectification, erasure or a copy of your information, and you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).