Privacy Policy

In short: we collect as little as possible, we never sell your data, and we use no tracking or advertising cookies. Here's exactly what happens with data on soge.dk.

1. Data controller

LynBro ApS, CVR 46321499, Rødovre Parkvej 276, 2610 Rødovre, Denmark ("we") is the data controller for personal data processed on soge.dk and in the Soge API. Contact: info@lynbro.dk.

2. What we process

• Account: email, password (hashed), optionally phone number and CVR number.
• Billing: handled by Stripe — we never store card details, only subscription and invoice status.
• Operations & security: IP address, browser/User-Agent and request logs — used to keep the service up, prevent abuse and meter API quota. See section 4.

3. Purposes and legal bases

We process data to provide the account, the API and billing (contract, GDPR art. 6(1)(b)); for security and abuse prevention — rate limiting, key/device/IP binding (legitimate interest, art. 6(1)(f)); and for bookkeeping (legal obligation, art. 6(1)(c)).

4. Analytics, operations and security

Visitor analytics (cookieless): we don't use Google Analytics or any third party. Statistics are kept on our own server as anonymous totals (pageviews, an approximate unique-visit count via a daily salted hash, country, browser type). Your raw IP address is never stored in analytics, and no cookie is set — so no consent is required.

Operations and security: to keep the service running and stop abuse (bots, scraping, attacks), the server briefly processes IP address and request details in operational and security logs. The legal basis is legitimate interest (art. 6(1)(f); recital 49: processing for network and information security is a legitimate interest). These logs are deleted on a rolling basis.

5. Data from public registries

Site content (vehicles, companies) comes from public registries — the Danish Motor Registry (DMR) and CVR/Virk. Information about persons (e.g. company ownership) is shown as it appears in CVR, which is public by law. Advertising protection (reklamebeskyttelse) is respected. Corrections must be made in the source registry (Virk/Motorregistret); for questions about how data is displayed here, contact us.

6. Recipients and processors

We use suppliers who may only process the data on our instructions and under a data processing agreement:

• Contabo GmbH — hosting of servers and database (Germany, EU).
• Our own mail server (hosted by Contabo GmbH, Germany, EU) — sending login, account and receipt emails.
• Cloudflare, Inc. (Turnstile) — bot protection on login, sign-up and forms (USA).
• OpenAI, L.L.C. — automated moderation of the text of reviews you submit yourself (title and text only, not your contact details) (USA).

Stripe Payments Europe Ltd. processes payments as an independent controller (stripe.com/privacy). Maps use tiles from the OpenStreetMap Foundation and CARTO; your browser sends your IP address directly to them. Otherwise we only disclose data where the law requires it or where it is necessary to establish, exercise or defend legal claims. We do not sell personal data.

6a. Transfers outside the EU/EEA

Cloudflare, Stripe and OpenAI are, or have group companies, in the USA. Transfers rely on the European Commission's EU-US Data Privacy Framework decision (for certified companies) and/or the EU Standard Contractual Clauses (GDPR Art. 45-46). The OpenStreetMap Foundation is in the United Kingdom, which has an EU adequacy decision. You can get a copy of the relevant safeguards by contacting us.

7. Cookies

We only use strictly necessary cookies: login session, CSRF protection, language choice and light/dark theme. No tracking, analytics or marketing cookies — so no consent is required and there is no cookie banner. The full list is in the cookie policy.

8. Retention

Account data is kept for as long as the account exists. Invoice data is kept for 5 years (Danish Bookkeeping Act). Operational and security logs are deleted on a rolling basis (typically within a few weeks).

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Where you have given consent, you can withdraw it at any time. These rights can be limited, e.g. where we must keep invoice data under the Bookkeeping Act. Write to info@lynbro.dk — we reply within one month and may ask you to confirm your identity.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22). The AI moderation of reviews only decides whether a text is published, sent for manual review or rejected as spam.

10. Complaints

You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk. We would like to hear from you first so we can put things right.

11. Security and changes

We protect data with an encrypted connection (HTTPS), hashed passwords, access control, security updates, backups and logging. If a personal data breach occurs, we handle it under Art. 33-34. We may update this policy; the current version and date are always shown on this page.