Privacy and cookie policy

The data controller is For A Fact ApS, CVR 40 58 49 43, Gammel Køge Landevej 55, 2500 Valby, Denmark.

Questions about this policy or your data: support@ci-addon.com.

This policy covers the website ci-addon.com and the user accounts in the CI-Addon app (app.ci-addon.com). When our customers use Smart Embed, form capture or event portals, we process data about their website visitors on the customer's behalf. That is covered by our Data Processing Agreement, and the customer's own privacy policy applies.

Visiting the website. When you visit ci-addon.com, our hosting provider processes technical data such as your IP address, browser type and the pages you request. This is needed to deliver the site and keep it secure. Legal basis: our legitimate interest (GDPR art. 6(1)(f)).

Contacting us. If you email us, we process your name, email address and the content of your message to reply to you. Legal basis: our legitimate interest in answering enquiries (GDPR art. 6(1)(f)).

Visitor statistics. Microsoft Clarity only runs if you accept statistics cookies in the cookie banner. Clarity records how visitors use the site, as heatmaps and session recordings of scrolling and clicks. Text you type into fields is masked. Legal basis: your consent (GDPR art. 6(1)(a)).

Your user account. When you sign in to CI-Addon with your Microsoft account, we receive and store your name and email address. We also store which organisation you belong to, your role (admin or editor), when you joined, and your notification settings. Our authentication provider records technical sign-in data such as the time of sign-in and IP address, for security. We use this data to give you access, to show who is in your organisation, and to send you emails about the service. Legal basis: our legitimate interest in providing CI-Addon to the organisation you work for (GDPR art. 6(1)(f)).

Invitations. When an owner or admin invites a colleague, we store the invited email address, who sent the invitation and when. Legal basis: our legitimate interest in letting customers manage their users (GDPR art. 6(1)(f)).

Activity and acceptance of terms. We log certain actions together with the user who made them, such as changes to the subscription and acceptance of our Terms of Service. This lets customers and us see what was done and by whom. Legal basis: our legitimate interest (GDPR art. 6(1)(f)).

Emails from the service. We send emails to users, for example when a form stops working, about the trial and the subscription, and before data is deleted. Users can turn off form alerts in Settings → Notifications. Emails that are necessary for the agreement, such as deletion warnings, are always sent.

Billing.When your organisation buys a subscription, our billing provider Alunta stores the billing contact's name, email address, company name, address and VAT number. Card payments are handled by Stripe. We never see or store card numbers. Legal basis: the agreement with your organisation and our legal obligation to keep accounting records (GDPR art. 6(1)(b) and (c)).

There are no statistics or tracking cookies in the app.

On the website, we only set cookies that are not strictly necessary if you give your consent. You can change or withdraw your consent at any time, and withdrawing it does not affect processing that took place before.

Vercelhosts the website and the app as our data processor, under a data processing agreement. Both run in Vercel's EU region in Paris, France, and visitors in Europe are served from Vercel's European data centres.

Supabase provides the app's database and sign-in as our data processor, in the EU (Frankfurt, Germany).

Google sends the app's emails from support@ci-addon.com as our data processor.

Alunta (Denmark) handles subscriptions and invoices as our data processor. Accounting data is passed on to our accounting system, e-conomic (Denmark). Stripe handles card payments as an independent data controller.

Microsoft processes your sign-in to the app under your organisation's agreement with Microsoft.

Microsoft Ireland Operations Limited provides Clarity on the website, only if you have given consent. Microsoft acts as an independent data controller for Clarity and may transfer data to the USA under the EU-US Data Privacy Framework and the EU standard contractual clauses. Read more in the Microsoft Privacy Statement.

We do not sell personal data, and we do not use it for advertising.

• Cookies: see the durations in the table above.
• Clarity: session recordings are kept for 30 days, heatmaps and click data for up to 9 months.
• Emails: kept only as long as they are relevant to the enquiry, and deleted no later than 2 years after the last contact.
• Hosting logs: kept by our providers for a short period for operations and security.
• App user accounts and invitations: for as long as the organisation uses CI-Addon. If the subscription ends, the organisation's data is deleted after 90 days, as described in our Terms of Service. User accounts are deleted at the same time unless the user belongs to another organisation. You can ask us to delete your account earlier.
• Invoices and accounting records: 5 years from the end of the financial year, as required by the Danish Bookkeeping Act.

You have the right to access, correct and delete your personal data, to restrict or object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time via Cookie settings.

To use your rights, email support@ci-addon.com. You can also complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.

We update this policy when our use of data or cookies changes. The date at the top shows the latest version.