Privacy policy

Nordtally is provided by [Company legal name, CVR], [Registered address] (“Nordtally”, “we”, “us”). We are the controller for the personal data described in this policy.

Questions about privacy go to [privacy contact email]. [State whether a data protection officer has been appointed, and how to reach them.]

• Controller. For your account, your workspace, your use of this website and our emails to you, we decide how and why personal data is processed. This policy applies.
• Processor. When a customer uses Nordtally to measure visits to their website, the customer is the controller and we process the visitor data on their behalf, under the data processing agreement. If you visited a website that uses Nordtally, that website’s privacy policy explains what is collected and how to exercise your rights.

If you visit this website without signing in, we set no cookies and load no third-party analytics, advertising or social media scripts. We measure visits with Nordtally itself, collected by our own server: no tracking script runs in your browser.

When our server delivers a page, it records the page address (query strings removed, except campaign parameters), the referring page (host and path only), your country, your browser and operating system with the major version, and the type of device. Nothing is stored on or read from your device. To count unique visitors within a day, the server combines your IP address and browser with a random salt that is deleted at midnight UTC, so visits on different days cannot be linked. Your IP address is used in memory only, for the country, that daily hash and filtering bots, and is never stored. If your browser sends Global Privacy Control, nothing is recorded, and you can object at any time at nordtally.com/opt-out: opting out stores one cookie, nt_optout, that holds only your choice. We keep these statistics for 25 months, on the basis of our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR).

Our servers process your IP address in memory to deliver pages and to limit abuse, such as repeated failed sign-ins. We do not store IP addresses or full browser user-agent strings in logs, databases or backups. The same rules apply to our own website as to the statistics we collect for customers.

When you create and use an account we process:

• Account details: your name, email address and whether it is verified, and your password, stored only as a salted hash.
• Security details: if you turn on two-factor authentication, the secret for your authenticator app and your backup codes. Sign-in links and reset tokens are deleted when they expire.
• Sessions: a record of each signed-in session with its expiry and a coarse device label, such as “Firefox on Windows”. We do not store the IP address or the full user-agent string with sessions. Expired sessions are deleted every hour.
• Workspaces: the workspaces you belong to, your role in each, invitations you send or receive, and the sites, goals, shared links and API keys you set up. Shared-link tokens, passwords and API keys are stored only as hashes.
• Activity: an audit log of important actions in a workspace, such as inviting a member or changing a site’s settings, with the time and the account that did it.
• Usage: daily counts of events per site, used for fair-use limits and, later, billing.
• Support: what you write to us and our replies.

Purposes and legal basis. We use this data to provide the service you signed up for and keep it secure (Article 6(1)(b) GDPR, performance of a contract), and to protect the service against abuse and keep records of account activity (Article 6(1)(f), our legitimate interest in running a secure service).

We send account email: sign-in links, verification, password resets, invitations, security notices and, if you set them up, scheduled reports with aggregate statistics. These are part of the service (Article 6(1)(b) GDPR).

If you ask us at sign-up to tell you when pricing is announced, we send you that email on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time with the link in the email or by writing to us.

Email is delivered by Sendaro, which uses Amazon SES in an EU region. See the sub-processor list.

We only use cookies that are strictly necessary for features you ask for, so they do not need consent:

We do not sell or share personal data, and we use none of it for advertising. The only recipients are the sub-processors that host the service and send our email, listed on the sub-processor list, and authorities where the law requires it.

Members of a workspace can see each other’s names, email addresses and roles. Workspace owners and admins can see the workspace’s audit log.

All account data and all event data are stored on Hetzner servers in the EU. Account email is sent from the EU through Sendaro and Amazon SES; Amazon’s US parent company is subject to US law, which we disclose on the sub-processor list. We do not transfer personal data outside the EU/EEA. When we add a payment provider for paid plans, we will update this policy before it receives any data.

• Account, workspace and audit data: while your account exists. When you delete your account, we delete it within [period], except what we must keep by law, such as accounting records for paid plans.
• Sessions: until they expire or you sign out. Expired sessions are removed every hour.
• Sign-in links and reset tokens: until they are used or expire.
• Backups: encrypted logical backups are kept for [backup retention period] and then deleted.
• Support messages: [period] after the conversation ends.

You have the right of access, rectification and erasure, the right to restrict processing, the right to data portability and the right to object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time. Most account details can be changed or deleted in the app; for anything else, write to [privacy contact email].

You can complain to Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk), or to the data protection authority where you live or work.

The technical and organisational measures we use for customer data are described in Annex 2 of the data processing agreement. They also protect your account data.

If we change this policy in a way that matters, we will tell account holders by email before the change applies. The date at the top shows the current version.