Datenschutzerklärung

Calco ApS is the data controller for the information we process about you as a customer, including your contact details and account details.

For the end-customer and employee data you enter into the service yourself (for example the names and addresses of your own customers), Calco is a data processor. This means that you are the data controller for that information and that we process it solely on your instructions under our data processing agreement.

Calco ApS
CVR 46543319
Paradisæblevej 4, 2500 Valby
Kontakt: info@calcoapp.dk

• Account details: email, password (hashed), company name and language choice
• API key for your chosen order system (Apacta today; Minuba and Ordrestyring coming soon): stored encrypted via AES-256 (pgcrypto) and decrypted only for API calls
• Billing data: handled by Stripe, we store only a customer ID
• Usage log: a log of your use of the service, including IP address and timestamps, for operations and troubleshooting
• The content you submit for offer generation: task description, images, documents (such as PDFs), as well as customer name and address, price lists and historical offers

• GDPR art. 6(1)(b): processing necessary to perform the contract with you
• Art. 6(1)(c): legal obligation, including retention of accounting records under the Danish Bookkeeping Act
• Art. 6(1)(f): legitimate interest in secure and stable operations, protection against misuse and ongoing improvement of the product

We process your data to deliver the service, bill you correctly and improve the product. We do not sell your data to third parties.

• Supabase (database and hosting) - EU
• Cloudflare (hosting and CDN) - EU/global
• Anthropic PBC (US) - used for AI offer generation and receives the task description, the images and documents, the customer name and address, the price lists and historical offers you submit. Anthropic does not use the data for model training and retains it only briefly in accordance with Anthropic's applicable terms.
• Stripe (payments) - EU/US
• Resend (email delivery) - EU
• The order system provider you choose (Apacta today; Minuba and Ordrestyring coming soon) - EU. Acts as a sub-processor only if you connect a system from the dashboard.

Transfers to the US (Anthropic and Stripe) take place on the basis of the European Commission's Standard Contractual Clauses (SCC) and/or the recipients' participation in the EU-US Data Privacy Framework.

• Account data is deleted no later than 30 days after your customer relationship ends
• Invoice and accounting data is kept for 5 years as required by the Danish Bookkeeping Act
• Files attached for quote generation (images and PDFs) are kept for up to 90 days and used to improve the quality of quote generation, after which they are deleted automatically
• Operational logs are kept for up to 12 months

You have the right to access, rectification, erasure and data portability, as well as the right to object (art. 21) and to restriction of processing (art. 18).

We respond within 1 month. Write to info@calcoapp.dk to exercise your rights.

You can lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.