Privacy policy

Calco ApS is the data controller for the information we process about you as a customer, including your contact details, account details and your use of the service.

For the end-customer and employee data you enter into the service yourself (e.g. names and addresses of your own customers, emails in a connected inbox and quotes you send), Calco is a data processor. This means you are the data controller for that information, and we only process it on your instructions under our data processing agreement.

When we use combined patterns across customers to improve the service, Calco is an independent data controller for that processing. See the section "Improving the service".

Calco ApS
CVR 46543319
Paradisæblevej 4, 2500 Valby
Kontakt: info@calcoapp.dk

• At sign-up: company name, trade, email, password (stored only as a hash) and language. Before you can create quotes: CVR number (or equivalent organisation number), country, the contact person's name and phone number
• How you found us: if you arrived through an ad or a link, campaign data (e.g. utm parameters, Meta and Google click IDs, referring page and landing page) is stored locally in your browser and linked to your company when you create an account
• Billing data: handled by Stripe, we only store a customer ID
• The content you submit for quote generation: task description, images, documents (e.g. PDF, DXF, Excel and Word), the customer's name and address, price files and previous quotes
• Corrections you make to quotes (including drafts that are never sent), so Calco can learn how your company prices work
• Operational log: an audit log of actions in your account (who, when, what was changed, plus IP address and browser details) and error reports from the app, for operations, security and troubleshooting
• Access details for systems you connect yourself (order management, accounting and inbox). See the section "Integrations"

When you dictate a task in the app, we use the phone's own speech recognition. If the phone supports on-device recognition, it happens locally. Otherwise the audio is processed by the phone's operating system (Apple on iPhone, Google on Android) under their terms. Calco only receives the finished text, never the audio. The feature is not available in the web version.

When you send a quote, your customer receives a personal link with a random 32-character key. The link works for 60 days. If you send a new version of the quote, the old link is replaced.

• When the link is opened, we record the time of the first and latest view and the number of views. We do not store the customer's IP address on viewing
• On acceptance we store the time, the customer's IP address, acknowledgement of the information about the right of withdrawal and any consent to work starting before the withdrawal period has expired
• On rejection we store the time, the IP address and the reason the customer writes
• The page does not show your purchase prices, internal fields or the customer's email
• 90 days after the link has expired, we automatically delete the quote content on the link, the IP addresses and the reason for rejection

The quote page uses Cloudflare Web Analytics (without cookies) and may show an aerial photo of the address, fetched from Dataforsyningen.

You can connect Calco to your order management or accounting system: Apacta, Minuba, Ordrestyring, Kompas4, e-conomic, Dinero, Billy or Fortnox. When you transfer a quote, we send the quote's title, text and lines as well as the customer's name, CVR, address, email and phone (what the system needs to create the customer). We fetch customers, products and status back so they can be shown in Calco.

API keys and access tokens are stored encrypted with AES-256 and a key that is not kept in the database. They are only decrypted when we call the system. If you disconnect, we delete the stored keys.

You can give Calco access to read new customer enquiries in your company inbox, so they can become quotes. Calco can only read, never send, delete or change emails.

• Microsoft 365 / Outlook: you sign in with Microsoft and grant the access "offline_access User.Read Mail.Read". Calco only reads the Inbox folder. The access token is stored encrypted with AES-256. If you disconnect, we delete the token
• Google Workspace / Gmail: your Workspace administrator grants Calco read access (gmail.readonly) to a specific mailbox. We store no access token for you. If you disconnect, we stop reading
• From each new email we store the sender's name and email, subject, the email text (at most 12,000 characters), information about attachments and Calco's assessment of the enquiry (e.g. address and task). The text is sent to Anthropic to assess whether the email is a job
• Enquiries from the inbox are kept for as long as your account is active and are deleted with it

Calco's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you ask us to fetch your price file, we send an email to the wholesaler from prisfiler@calcoapp.dk with your company name, CVR number, the contact person's name and a reference code. The first request is sent with your email in copy, and we ask the wholesaler to confirm your customer number. We only send once you have signed a power of attorney in Calco and we have checked your CVR number.

Price files are stored in our storage in the EU and used to calculate your own quotes. In addition, Calco uses anonymous, aggregated price data to show estimated purchase prices for items a company does not yet have in its own price file. An estimate is only calculated from the data of at least 3 different companies, as a median, and no one can see another company's prices, discounts or which companies are included.

With Calco Connect you can share part of a job with another company that uses Calco. This requires both companies to have accepted the connection. The partner only sees what you share: the description of the sub-task (without your prices), the images you choose, the address, the deadline and any mark-up. The partner does not see your other lines, prices or customers. You only see the lines the partner sends back.

Each company is the data controller for the information it shares and receives. Calco is a data processor for both. If you invite a company that does not use Calco, we store the invitee's name, email, phone and CVR, and the invitation expires after 30 days.

You can choose to connect your Calco user to ChatGPT (OpenAI) or Claude (Anthropic). You set up the connection with your own OpenAI or Anthropic account and approve it in Calco. You can disconnect at any time under Integrations in Calco, and access stops immediately.

While the connection is active, ChatGPT or Claude sends what you ask for to Calco - for example a job description for a quote or a product lookup. Calco sends the answer back: the quote title, number of lines and total, products and prices from your price files, or the status of your sent quotes. Cost prices are only sent if your user may see them in Calco. The connection cannot send quotes to customers and cannot change prices or settings.

What is exchanged between you and ChatGPT or Claude is processed by OpenAI or Anthropic under the terms you have with them as a user of their service. They are not Calco sub-processors for that part. You are responsible for being allowed to share the information - for example customer names and addresses - with the service you have chosen. Calco keeps a short log of the calls (user, tool, time and whether the call succeeded) for operations and security.

Calco primarily learns from your own company's corrections, and that learning is only used in your own company.

In addition, we use combined patterns across customers to improve the service for everyone: which wholesaler product matches a quote line, and which lines tradespeople in the same trade typically add or remove. A pattern is only used if at least three independent companies have confirmed it. Prices, customer names and addresses are not included, and a new trade pattern only becomes a rule once a Calco employee has approved it. This processing is based on our legitimate interest in improving the service (Art. 6(1)(f)), and you can object by writing to info@calcoapp.dk.

For internal quality testing of the calculations, we may use quote lines (product names, quantities and selected products). They are only used internally and are not shared.

• GDPR Art. 6(1)(b): processing necessary to perform the agreement with you
• Art. 6(1)(c): legal obligation, including retention of accounting records under the Danish Bookkeeping Act
• Art. 6(1)(f): legitimate interest in secure and stable operation, protection against misuse, measuring how people find Calco and ongoing improvement of the product
• Art. 6(1)(a): consent to the Meta Pixel on our website (see the cookie policy)

We process your data to deliver the service, invoice you correctly, keep the service secure and improve the product. We do not sell your data to third parties.

• Supabase Inc. (USA) - database, login and file storage. Data is stored in the EU (Frankfurt, Germany)
• Cloudflare Inc. (USA) - hosting of website and web app, network and anonymous visitor statistics. Global network
• Anthropic PBC (USA) - quote calculation and assessment of inbox emails. Receives task description, images, documents, the customer's name and address, price file matches and previous quotes. Processed in the USA. See "Anthropic"
• Resend Inc. (USA) - sending emails, e.g. quotes to your customers and requests to wholesalers
• Stripe (Ireland, parent company in the USA) - payment and subscription
• Expo / 650 Industries Inc. (USA) - push notifications to the app and app updates
• Telegram (United Arab Emirates) - internal operational alerts to Calco's team, which may contain the company name and the user's name, email and phone
• Google (Ireland/USA) - calendar invitation when you book onboarding, and reading Gmail only if you connect it
• Microsoft (Ireland/USA) - reading the Outlook inbox, only if you connect it
• Meta Platforms (Ireland/USA) - Meta Pixel and hashed sign-up data, only if you have given consent on our website
• Order management and accounting systems, only if you connect them: Apacta (Denmark), Minuba (Denmark), Ordrestyring (Denmark), Kompas4 (Denmark), e-conomic and Dinero (Visma, Denmark), Billy (Denmark) and Fortnox (Sweden)

• The Danish Business Authority (CVR register) - CVR number lookup and search, with cvrapi.dk as fallback. From our server
• Dataforsyningen and Datafordeleren (the Danish state) - addresses, BBR building data, plot area and aerial photos. From our server. Address search in company settings happens directly from your browser
• Brønnøysundregistrene (Norway) - organisation number lookup. From our server
• Kartverket (the Norwegian state) - address lookup to calculate travel for Norwegian companies. Only street, house number, postcode and town are sent - never names. From our server. Address data © Kartverket (CC BY 4.0)
• OpenStreetMap Foundation (Nominatim, United Kingdom) - address lookup to calculate travel for Swedish companies. Only street, house number, postcode and town are sent - never names. From our server. The UK has an EU Commission adequacy decision. Map data © OpenStreetMap contributors (ODbL)

Supabase, Cloudflare, Anthropic, Resend, Stripe, Expo, Google, Microsoft and Meta are US companies or have US parent companies, and Telegram (United Arab Emirates) are located outside the EU. Transfers are based on the European Commission's Standard Contractual Clauses (SCC) and, where the recipient is certified, the EU-US Data Privacy Framework.

We only send what is needed to calculate the quote or assess the email, and we send no user IDs. Under Anthropic's commercial terms, data sent through their API is not used to train models. Anthropic retains data according to their applicable retention terms. We do not have a zero data retention agreement.

• Account data is deleted no later than 30 days after your customer relationship ends
• Invoice and accounting data is kept for 5 years as required by the Danish Bookkeeping Act
• Files you upload for quote generation are kept for 90 days so you can recalculate the quote, and are then deleted automatically
• Quote links: content, IP addresses and rejection reasons are deleted automatically 90 days after the link has expired
• Enquiries from a connected inbox, the audit log and error reports are kept for as long as your account is active and are deleted with the account
• Sign-ups that were never completed (without CVR and without activity) are deleted after 7 days

Data is sent encrypted (HTTPS). Each company's data is separated in the database by access rules, so a company can only see its own data. Access keys to connected systems are stored encrypted with AES-256.

If a personal data breach occurs, we notify the Danish Data Protection Agency within 72 hours where we are the data controller. Where we are the data processor, we notify you without undue delay so you can meet your own obligations.

You have the right of access, rectification, erasure and data portability, as well as the right to object (Art. 21) and to restrict processing (Art. 18). If you have given consent, you can always withdraw it.

We respond to your request within 1 month. Write to info@calcoapp.dk to exercise your rights.

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk.