Privacy Policy

Last updated: 25 September 2026 · Courtesy translation — the Danish version prevails.

Danadresse is operated by LynBro ApS (CVR 46321499, Rødovre Parkvej 276, 2610 Rødovre, Denmark, info@lynbro.dk), which is the data controller. This policy explains what data we collect, how we use it, and your rights.

What do we collect?

Account: email, name (optional), CVR (optional), company name (optional).
API keys: we store only an HMAC-SHA256 hash of your key — never the full key.
API calls: we log the number of calls per key, day and channel (API/MCP) for billing and abuse prevention, plus a technical device fingerprint (a hash of stable request headers) and source IP counts used to enforce the one-key-one-device policy. We do not log the content of your searches.
Cookies: one strictly necessary session cookie (da_session) for login and one (lb_consent) remembering your cookie choice. Google Analytics and our A/B-test cookie are loaded only if you consent in the cookie banner — before that, no request goes to Google at all. Legal basis: your consent (GDPR Art. 6(1)(a) and the Danish cookie order §3), which you can withdraw at any time via Cookie settings. Full list: cookie policy. No ad trackers, no data resale.
Payment data: handled by Stripe — we store only their customer/subscription IDs. We never see card details.

Processors and sub-processors

Stripe (payments, EU entity, DPA in place).
Hosting in the EU (Germany) — all application data stays in the EU.
Google Analytics — Google Ireland Ltd. (only with your consent; anonymised IP). Google may transfer data to Google LLC in the USA under the EU–US Data Privacy Framework (adequacy decision, GDPR Art. 45).
Cloudflare Turnstile — Cloudflare, Inc. (bot protection on the sign-up and log-in forms, no tracking cookies; legitimate interest, Art. 6(1)(f); EU–US Data Privacy Framework).
Email delivery via an EU-hosted SMTP relay (transactional mail only).

A data processing agreement (DPA) is available for Enterprise customers on request.

Security & abuse prevention

To keep the service fast, reliable and safe for everyone, we run server-side security logging. When a request looks hostile — a vulnerability scan, an injection attempt, credential stuffing or large-scale scraping — we record the source IP address together with the request path, method, timestamp and user-agent, and may temporarily block that address.

This is deliberately separate from our website analytics (which stores no IP and needs no consent). The legal basis here is our legitimate interest in ensuring network and information security and preventing abuse — expressly recognised by the GDPR (Article 6(1)(f) and recital 49). These security records are kept for up to 90 days and are used only to protect the service — never for marketing or profiling. You have the right to object: write to privacy@lynbro.dk.

Where is your data stored?

All servers run in the EU. Address data itself is public (CC BY 4.0 from Klimadatastyrelsen). Application data never leaves the EU. The only exceptions are Google Analytics (only with your consent) and Cloudflare Turnstile on the sign-up/log-in forms — see processors above.

How long do we keep it?

Account: until you delete it.
API call logs: 30 days for billing, then aggregated monthly.
Security logs (abuse/attack events, including IP): up to 90 days.
Bookkeeping records (invoices, payments): 5 years as required by the Danish Bookkeeping Act.
Backups: 14 days rolling.

Your rights

Under the GDPR you have the right of access, rectification, erasure, data portability and objection. Write to privacy@lynbro.dk. You can also complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.

Cookies

Strictly necessary: da_session (login, 24 hours) and lb_consent (your cookie choice and proof of consent, 12 months). With your consent to statistics: Google Analytics (_ga, _ga_*) and our A/B-test cookie da_ab_cta. If you reject, Google's script is never loaded and no analytics data is sent. You can change your choice at any time via Cookie settings. Details: cookie policy.

Contact

LynBro ApS · Rødovre Parkvej 276, 2610 Rødovre, Denmark · CVR 46321499 · privacy@lynbro.dk

← Back to danadresse.dk