Privacy Policy

Applicable to: conphora.com (including Conphora Academy) and the Conphora platform (platform.conphora.com, with sign-in on accounts.conphora.com, which our authentication provider Clerk operates for us). The same data controller (section 1) is responsible for all of them.

This privacy policy describes how Conphora ApS (“Conphora”, “we”, “us”) processes personal data when you visit our website conphora.com, sign up for early access/waitlist or for our newsletter and interest updates, contact us, or use the Conphora platform (section 5). This policy has been prepared with the aim of being audit-ready and in compliance with the General Data Protection Regulation (GDPR) and Danish data protection legislation.

1. Data Controller

Conphora ApS Address: Copenhagen, Denmark CVR: 43489968 E-mail: info@conphora.com Phone: +45 71 74 11 12

2. What personal data do we collect?

We only process personal data that is relevant and necessary for the purposes described in section 3. Depending on your use of the site, we may process:

Contact information (e.g. e-mail and, if you provide it yourself, name/company) when signing up for early access/waitlist.
Your e-mail address, language, optional role and chosen interests when you sign up for our newsletter and interest updates (section 4).
Content of enquiries (e.g. e-mail correspondence, information you send to us yourself).
Technical information about your visit (e.g. IP address, device type, browser and timestamp) in server logs and, for a moment, in our web statistics (section 3). From the statistics we receive no IP address, cookie or other identifier of you – only aggregated figures. If you use the Conphora platform, the data we process there (account, company and product data, documents, billing) is described in section 5. We ask that you do not send us sensitive personal data (e.g. health information). If we receive such information inadvertently, we will seek to delete it as soon as possible.

We process personal data for the following purposes: Early access/waitlist: Managing your registration and sending you information about beta, access, updates and launch. Data types: Contact information, company information where applicable, metadata. Legal basis: Consent (GDPR Art. 6(1)(a)) and/or legitimate interest (GDPR Art. 6(1)(f)). Contact and support (help centre requests): Answering your request and following it up. When you use the form at /help/request we process your name, e-mail address, any company name, the topic, subject and text of your request, any files you attach, the page you came from and the language you wrote in, and — for rate limiting and abuse prevention — your IP address. Data types: contact information, the content and attachments of the request, technical metadata. Legal basis: pre-contractual measures or performance of a contract (GDPR Art. 6(1)(b)) where your request concerns a service you use or are considering, otherwise our legitimate interest in answering enquiries addressed to us (GDPR Art. 6(1)(f)); the abuse prevention rests on Art. 6(1)(f). Your request, its messages and its attachments are stored in our application backend (Convex; files in Scaleway object storage in Paris, France), and the confirmation and reply e-mails are sent through Scaleway Transactional Email. The confirmation e-mail contains a signed link to your request: anyone who has that link can read the thread, so do not forward it. We prepare draft answers with the help of an AI model (see section 6); every answer you receive is written or approved and sent by a person. Website operation and security: Operation, troubleshooting, security, prevention of misuse and improvement of the website. Data types: Technical information (e.g. IP address, log data). Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). Statistics (cookieless web analytics): Understanding traffic and use of the website and improving content. We use Plausible Analytics, which sets no cookies and stores nothing in your browser. Plausible processes your IP address and browser signature (user agent) for a moment to count the visit and to derive country, browser and device type; it does not store them, and the daily identifier it derives from them is rotated every 24 hours and cannot be linked back to you. We only receive aggregated statistics. Data types: Aggregated usage data (pages, referrers, country, browser and device type, custom events such as a search or a page view); IP address and user agent, processed momentarily by our processor and discarded. Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) in understanding how the website is used and improving it, weighed against the minimal impact of this momentary processing. No consent banner is shown because Plausible stores nothing on your device and reads no cookies or other stored information; the cookie rules (Article 5(3) of the ePrivacy Directive and the Danish Cookie Order) therefore do not apply to it, and we rely on our legitimate interest for the momentary processing described above. You can object at any time (section 10), and you can exclude yourself from the statistics with the switch in our Cookie Policy. Statistics on the platform: platform.conphora.com uses the same cookieless web statistics (Plausible Analytics; one Plausible site covers conphora.com and the platform). The purpose, the data types and the legal basis are those described above: nothing is stored in your browser for the statistics, your IP address and browser signature are processed for a moment and discarded, and we receive only aggregated figures. We never attach a user, organisation or account identifier, a name or an e-mail address to these statistics, also when you are signed in. You exclude yourself on each site separately: on conphora.com with the switch in our Cookie Policy, and on the platform with the switch under Account settings → Data protection. Your choice is stored in your browser for that site (origin) only, so a choice made on one site does not apply to the other, and it applies only to the browser and device on which you made it.

Purpose: If you sign up for our interest updates (in the website footer, on a regulation guide or article, after a free tool result, in Conphora Academy or on the platform), we send you e-mails about what has changed in the regulations, product families, roles, countries, tools and topics you have chosen to follow. By default you receive one weekly digest; an e-mail is sent immediately only for high-importance changes to a regulation you follow. You can switch to a monthly digest or pause the e-mails at any time. Data types: Your e-mail address (stored lower-cased, together with a hash of it), your language, an optional role, your chosen interests and the page and module where you added each of them, the version of the consent text you accepted with the time and a hash of your IP address, and the delivery events of the e-mails we send you (sent, delivered, bounced, complaint, unsubscribed and – unless you switch it off – opened and clicked). We do not ask for your name. If you have a Conphora account with the same e-mail address, your subscription is linked to it so that your interests and notification settings are managed in one place. Nothing on the website is personalised. Double opt-in, preferences and tracking: We first send you a confirmation e-mail; no updates are sent until you click the signed link in it. Every e-mail contains a one-click unsubscribe link (also as a standard header your mail program can use) and a signed link to your preferences page, where you can change your interests, cadence and language, pause or unsubscribe – without logging in. Our update e-mails contain a small open-tracking image and signed click links, so we can see whether an e-mail was opened and which links were used; you can switch this off on the preferences page, and the confirmation e-mail never contains it. Our e-mails set no cookies. Legal basis: Consent (GDPR Art. 6(1)(a)) for sending the updates; you can withdraw it at any time with the unsubscribe link or on the preferences page. Legitimate interest (GDPR Art. 6(1)(f)) in preventing misuse of the sign-up form (rate limits based on hashed e-mail addresses and IP addresses) and in aggregated statistics on sign-ups, opens and clicks per interest. Measuring whether an e-mail was opened and which links were used is part of the consent you give when you subscribe (GDPR Art. 6(1)(a)). You can switch it off at any time on the preferences page without unsubscribing, and we then send the e-mails without the image and with plain links. Recipients: The data is stored in our own database hosted by Scaleway SAS in the EU (Paris, France), and the e-mails are sent through Scaleway Transactional Email from mail.conphora.com. If your subscription is linked to a Conphora account, the account itself is held by our authentication provider Clerk, Inc., which processes account data in the United States under the EU-U.S. Data Privacy Framework and the European Commission’s Standard Contractual Clauses (see sections 6 and 7 and the Sub-processors page). Your subscription record — your e-mail address, interests, language and the delivery events of our e-mails — is stored in the EU and is never sold or shared for advertising. Retention: Sign-ups that are not confirmed within 14 days are deleted. Your record is kept for as long as you are subscribed; when you unsubscribe, we delete it and keep only a hash of your e-mail address so that we do not e-mail you again. We keep that hash on the basis of our legitimate interest in honouring your unsubscribe (GDPR Art. 6(1)(f)); it cannot be used to contact you or to recognise you anywhere else. Delivery and engagement events are deleted after 13 months. Your rights: Section 10 applies. The quickest ways are the unsubscribe link and the preferences page in every e-mail; for access, rectification or erasure write to info@conphora.com.

5. The Conphora platform

This section describes the processing when you use the Conphora platform (platform.conphora.com): as a user in a customer organisation, as an administrator of one, or as a supplier contact who answers a request. The platform runs on our own servers at Scaleway in Paris, France (application backend, database and file storage); sign-in is provided by Clerk (section 6). Who is responsible for what: Conphora is the controller for your platform account, the administration of your organisation’s subscription, billing, support, notifications and the security of the service. The product data, documents, supplier contacts and other content that an organisation enters or uploads (“customer data”) belong to that organisation: it is the controller, and Conphora processes the customer data only on its instructions, as its processor under our data processing agreement (GDPR Art. 28). If your personal data is part of an organisation’s customer data, for example as a supplier contact or because your name appears in an uploaded document, please address requests about it to that organisation first; we assist it in answering you. Your account: When you sign up we process your first and last name, your e-mail address, your password and the verification of your e-mail address. Clerk, Inc. holds the account and handles the password; we never see or store your password. We also process your organisation memberships and roles, your sign-in sessions (cookies, see our Cookie Policy), your language and time zone, and your notification settings. The e-mails sent during sign-up and sign-in (verification codes, links) are sent by us through Scaleway Transactional Email; we keep a record of each such e-mail (recipient, type, subject, time and delivery status), but not the code or link once the e-mail has been sent. When an administrator invites a colleague, we process the invited person’s e-mail address and role, and the organisation’s Team page keeps an activity log of memberships, role changes, invitations and verified domains with the name and e-mail address of the person concerned. Legal basis: performance of the contract (GDPR Art. 6(1)(b)) where you are the customer yourself; otherwise our and your organisation’s legitimate interest in providing the platform the organisation has subscribed to and in keeping its team administration traceable (GDPR Art. 6(1)(f)). Company and product data: Your organisation’s company profile (company name, address, registration or VAT number, markets, business roles, answers to compliance questions), its products, product attributes, evaluations, steps, comments, supplier records and reporting data. Most of this is information about companies and products, not about persons. Where it contains personal data (for example the name of the user who made a change, a comment, or a supplier contact’s name and e-mail address), it is customer data and is processed as described above. Records show which user created or changed them, so that the organisation can follow its own work. Uploaded and generated documents: Files you upload (test reports, declarations, certificates, technical documentation and similar) and the documents the platform generates for you are stored in the platform’s file storage at Scaleway in Paris, France. They are served only to signed-in members of your organisation, or through a share link that someone in your organisation has created; anyone who has a share link can open the file it points to until the link is withdrawn. To classify documents, read their type, issuer and dates, and match them to your products and requirements, document text is processed by an AI model from Anthropic; product texts are turned into embeddings by Voyage AI to group similar products. Both act as our sub-processors and do not train on the data (see section 6 and our AI Transparency page). The results are suggestions that your organisation reviews; we make no decisions with legal or similarly significant effects on you by automated means alone (GDPR Art. 22). Supplier requests: When an organisation asks a supplier for evidence, we e-mail the supplier contact it has entered (name and e-mail address) with a link that is valid for 90 days, and send one reminder after 7 days if the request is still open. A supplier contact who signs in to answer gets an account with Clerk, processed as described under “Your account”, and the platform links the verified e-mail address to the requests sent to it. Billing: Subscriptions are paid through Stripe. We hold your organisation’s billing details (company name, VAT or CVR number, address, billing e-mail address and an optional phone number), when, by which user and in which version our terms were accepted, the Stripe customer and subscription identifiers, the plan, status and billing period, the amounts of completed checkouts, the invoice events (amount, invoice number and link) and the number of active products used for the metered part of the price. Card and other payment details are entered on Stripe’s pages and held by Stripe Payments Europe, Ltd. (Ireland); we never see or store them, and invoices are issued through Stripe. Stripe processes payment data on our behalf and is also an independent controller for the processing it carries out for its own purposes as a payment service provider, such as fraud prevention and its own legal obligations; see Stripe’s privacy policy. Legal basis: performance of the contract (GDPR Art. 6(1)(b)) and our legal obligation to keep accounting records (GDPR Art. 6(1)(c) and the Danish Bookkeeping Act). Notifications: The platform shows notifications in the app and e-mails them according to your settings (immediately, as a daily brief or as a weekly summary), sent through Scaleway Transactional Email from mail.conphora.com. We keep a record of each e-mail sent (time, status and which notifications it contained). Legal basis: performance of the contract (GDPR Art. 6(1)(b)) and our legitimate interest in telling the people who use the platform about deadlines and changes that concern their work (GDPR Art. 6(1)(f)). You can change or switch off the e-mails in your notification settings. Support: Requests you send from the platform go to the same help centre as described in section 3 (“Contact and support”). They are linked to your account and organisation and are kept for the periods in section 8. Security: Access to an organisation’s data is limited to its members and to the API keys and share links the organisation creates; API keys are stored only as a hash. We process technical data (IP address, request metadata, timestamps) in server logs to run and protect the service, on the basis of our legitimate interest (GDPR Art. 6(1)(f)). Statistics: The platform’s cookieless statistics are described in section 3 (“Statistics on the platform”). Retention on the platform:

Account data and memberships: for as long as you have an account. The Team page’s activity log and our records of sign-in and notification e-mails: for as long as the organisation’s account exists.
In-app notifications: a notification that has been read is deleted 90 days after it was created, an archived one after 30 days, and any other after 365 days at the latest; critical notifications are kept for 365 days.
Customer data (company and product data, documents, supplier records): for as long as the organisation’s subscription runs. After the subscription ends, we delete it within 30 days unless the law requires us to keep it, as set out in our data processing agreement. Copies in backups and in the version history of the file storage are overwritten within a further 30 days and are not restored except to recover the service. Supplier request links stop working after 90 days.
Billing records and invoices: five years from the end of the financial year they belong to (Danish Bookkeeping Act).
Support requests: as in section 8 (12 months after the request is closed).

Your rights on the platform: You can correct your name, e-mail address and password yourself under Manage account, and administrators can manage members, roles and invitations on the Team page. An organisation can export its product data at any time (export links, product feeds and the API), which also serves data portability (GDPR Art. 20). For everything else, including access to or erasure of your account data, write to info@conphora.com (section 10). If your request concerns customer data, we forward it to the organisation concerned and assist it.

We do not sell your personal data. We may share data with trusted vendors (data processors) who process data on our behalf and under our instructions. We enter into data processing agreements where required. Known data processors in relation to conphora.com: Scaleway SAS (France) hosts our website and may process technical information (IP addresses, request metadata) as part of delivering it; for our newsletter and interest updates (section 4) Scaleway also hosts the subscriber database (Paris, France) and sends the e-mails through Scaleway Transactional Email. Plausible Insights OÜ (Estonia) provides our cookieless web statistics; the data is processed in the EU (servers in Germany, Finland and Slovenia operated by Plausible’s European providers), and we receive only aggregated statistics from it. Clerk, Inc. provides sign-in and accounts for Conphora Academy and the platform, and therefore also holds the account that a newsletter subscription may be linked to. The application backend and database for Conphora Academy, the tools, the platform and the help centre’s support requests (Convex, open-source software) run on our own servers at Scaleway in Paris, France; Convex, Inc. remains listed as a sub-processor until the earlier cloud deployments it hosted for us (EU region) have been deleted. On the platform, Stripe Payments Europe, Ltd. (Ireland) handles payments (section 5), and Anthropic, PBC and Voyage AI Inc. process document and product texts for the AI functions (section 5). All process data on our behalf under a data processing agreement; Stripe is in addition an independent controller for its own purposes as a payment service provider (section 5). The full list, including the processors for Conphora Academy and the Conphora platform, is on our Sub-processors page and is updated when we add a service. If you click on external links (e.g. to LinkedIn), you leave our website. The relevant third party is an independent data controller for its own processing.

7. Transfers to countries outside the EU/EEA

Our website hosting, the platform with its database and file storage, our newsletter (all Scaleway, France) and our web statistics (Plausible, Estonia; servers in Germany, Finland and Slovenia) are located in the EU. Where we use vendors outside the EU/EEA (see the Sub-processors page), transfers are made on the basis of the European Commission’s Standard Contractual Clauses (SCC) or the EU-U.S. Data Privacy Framework, or an equivalent lawful transfer mechanism.

8. Retention and deletion

We retain personal data for as long as necessary for the purpose and in accordance with applicable legislation. Indicative retention periods:

Early access/waitlist: until launch/early access has been handled, or until you unsubscribe/withdraw your consent. Thereafter, the data will be deleted or anonymised within a reasonable period.
Newsletter and interest updates: unconfirmed sign-ups 14 days; your subscriber record until you unsubscribe (thereafter only a hash of the e-mail address, for suppression); delivery and engagement events 13 months.
Help centre requests: the request, its messages and our internal notes are kept for 12 months after the request is closed and are then deleted; attachments are deleted with the request. The signed link in our e-mails to you is valid for 90 days from the e-mail it came in; every reply carries a fresh one. Article feedback (“Was this helpful?”) is kept without a name for 24 months.
Other enquiries (e-mail, contact form): 24 months after the conclusion of the dialogue, unless there is a legitimate need for longer retention (e.g. documentation).
Conphora platform: see section 5 (“Retention on the platform”).
Security and server logs: typically retained for a shorter period (weeks/months) for operational and security purposes.

9. Cookies and similar technologies

conphora.com is a static website hosted in the EU. The website only sets technically necessary cookies (e.g. for security, basic functionality such as remembering the language you chose and, in Conphora Academy and on the platform, for signing in). We set no analytics or marketing cookies. Our web statistics come from Plausible Analytics, which works without cookies, stores nothing in your browser and reads no cookies or other information stored on your device; the cookie rules (Article 5(3) of the ePrivacy Directive and the Danish Cookie Order) therefore do not apply to it, and we show no cookie banner. The momentary processing of your IP address and browser signature that Plausible performs to count a visit is described in section 3, rests on our legitimate interest (GDPR Art. 6(1)(f)), and you can object to it at any time (section 10) or exclude yourself from the statistics with the switch in our Cookie Policy. Should we add marketing cookies in the future, these will only be activated after your active consent. Details are in our Cookie Policy. You can manage cookies at any time through your browser settings.

10. Your rights

Under the GDPR, you have the following rights (subject to the limitations provided by law):

Right of access to the personal data we process about you.
Right to rectification of inaccurate or incomplete data.
Right to erasure (“the right to be forgotten”).
Right to restriction of processing.
Right to data portability (where applicable).
Right to object to processing based on legitimate interest.
Right to withdraw consent (if processing is based on consent). Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. You can exercise your rights by contacting us at info@conphora.com. We may request additional information to verify your identity. We answer without undue delay and at the latest within one month; where a request is complex or we receive many, we may extend this by two further months and will tell you why within the first month (GDPR Art. 12(3)). How to exercise your rights on the platform, and what applies when your data is part of an organisation’s customer data, is described in section 5.

11. Complaint to the Danish Data Protection Agency

If you wish to lodge a complaint about our processing of your personal data, you can contact the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk. You can also lodge a complaint with the supervisory authority in the EU member state where you live or work (GDPR Art. 77).

12. Security

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, misuse or alteration. Access to data is restricted to relevant persons and vendors.

13. Changes to this privacy policy

We may update this privacy policy from time to time. The latest version will always be available on conphora.com with an updated date.