IMPRINT (E-HANDELSLOVEN § 7) & GDPR ARTICLES 13, 14 & 21 PRIVACY POLICY

Spurvik · EyeTea Solutions ApS (CVR: 37093378)

Last updated: 4 November 2026 · Applies to spurvik.com, spurvik.dev and console.spurvik.com

1. Data Controller & Statutory Imprint (E-handelsloven § 7)

• Legal Entity (Data Controller): EyeTea Solutions ApS (incorporated in Denmark, 15 September 2015)
• Company Registration (CVR): CVR 37093378 • P-nr. 1020736689
• Contact: EyeTea Solutions ApS · CVR 37093378 · Mosevråvej 106, Håstrup, 7000 Fredericia, Denmark · hello@spurvik.com
• Managing Director: Anders Nathaniel Refslund

Individual business contact

• What we do: Nathaniel Refslund (EyeTea Solutions ApS) may send you a single personal email or LinkedIn message because of your business role, e.g. CTO, Head of Product, or CEO. Each message is written and sent by hand. There are no automated sequences, and you get no follow-up unless you reply.
• Data we use: your name, role, company and work email address or LinkedIn profile. Nothing else.
• Where we got it: only from information you or your company published, such as the company's website or your own professional profile. We record the source and date. We do not guess or construct email addresses, and we do not buy lists.
• Why we may do this: our legitimate interest in contacting businesses about EU AI rules relevant to their work (GDPR Art. 6(1)(f)).
• How long we keep it:
  • If you don't reply, we delete your details within 6 months.
  • Working lists used to prepare messages are deleted within 30 days.
  • If you reply, we keep the correspondence as long as the conversation is relevant, and at most 12 months after the last contact.
• Who sees it: only Nathaniel. Our email and LinkedIn providers carry or host the messages (see Section 3 below). We don't share or sell it.
• Your rights:
  • You can object at any time. Reply "stop", or write to hello@spurvik.com, and we won't contact you again.
  • We keep your email address and its domain on a suppression list so that you are not contacted again (Art. 6(1)(f) GDPR). This list is used only for that purpose.
  • You can also ask for access, correction or deletion, or complain to Datatilsynet (www.datatilsynet.dk).

2. Categories of Personal Data, Sources (Art. 14 GDPR) & Legal Bases

When you interact with spurvik.com, spurvik.dev or console.spurvik.com, activate a plan, use the platform or EU console or website assistant (rule-based demo), or correspond with us professionally, we process:

• Professional Contact & Account Details: Name, role, company name, and work email address. Where not provided directly by you (Art. 13 GDPR), limited professional contact details are obtained from information published by you or your company, or via a mutual professional introduction (Art. 14(2)(f) GDPR).
• Technical SDK & Audit Metadata: Project identifiers, keyed HMAC-SHA256 digests (pseudonymised; under the GDPR, keyed hashes of personal data remain personal data and are protected accordingly; we do not store raw end-user prompts), and human-oversight review records (reviewer identifier, decision reason, and console/API source).
• Website assistant and demo (/api/chat, /api/platform). The assistant is a rule-based demo; no AI model or AI provider is used. Your question is processed only to produce the answer, and the answer sent to your browser includes keyed HMAC-SHA256 digests of the question. Our code does not store or log the question or the answer. To protect the service against abuse, your request headers, including your IP address, are checked by Vercel's bot protection (Vercel BotID). Your IP address is also held in server memory to limit request rates, normally for about one minute after your last request and at most until the server instance restarts; our code never writes it to storage. Vercel's request logs record your IP address and the requested page and are kept for up to 30 days. Basis: Art. 6(1)(f) GDPR (running and securing the demo).
• Upgrade and activation requests (console.spurvik.com/api/v1/upgrade): When you ask to activate Pro or Team in the console, we store your work email, your application URL or domain, the plan and billing interval you chose, its list price, the page you sent the request from, the request status, the time of the request, the workspace it applies to and, once applied, the activation time. Payment is covered under Billing (Stripe Managed Payments, shown at checkout as “Sold through Link”) below. We use this only to handle your request and set up your plan. Your IP address is held briefly in server memory to limit repeated requests and is not stored with the request. Basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). Kept while your workspace is active; deleted on request or when the workspace is closed. A fixed period for requests that are not activated is (planned).
• Billing (Stripe Managed Payments, shown at checkout as “Sold through Link”). Paid plans are sold through Stripe's merchant of record service (Sold through Link, LLC). Stripe is the seller of the payment transaction and handles checkout, card payment, VAT, invoices, fraud checks, disputes, refunds and cancellation of the payment, as its own controller under Link's Terms and Privacy Policy, which are linked at checkout. We never see or store your card details. Stripe shares with us what we need to set up your plan. We store your Stripe customer and subscription IDs against your organisation, your plan and its status, and Stripe's payment notifications (ID, type and time). Basis: Art. 6(1)(b) GDPR (your contract with us for the Service). Payment notifications are kept for 90 days (planned). Transfers to Stripe, LLC (USA) are covered by the EU–US Data Privacy Framework, with Standard Contractual Clauses as a fallback.
• Legal Bases (Art. 6(1) GDPR):
  • Art. 6(1)(b) GDPR (Contract / Pre-Contractual Steps): Responding to inquiries, handling upgrade and activation requests, provisioning workspace credentials (where access has been granted), and operating customer workspaces.
  • Art. 6(1)(f) GDPR (Legitimate Interests): Individual 1:1 business contact as described above; suppression list: We keep your email address and its domain on a suppression list so that you are not contacted again (Art. 6(1)(f) GDPR). This list is used only for that purpose. Also: B2B relationship management following introductions or events, and service security (including automated bot prevention on our live demo and website assistant (rule-based demo)).
  • Art. 6(1)(a) GDPR (Consent): Where you have asked to receive newsletters or updates.
  • Art. 6(1)(c) GDPR (Legal Obligation): Compliance with the Danish Bookkeeping Act (Bogføringsloven).

3. Processors, Service Providers and Other Recipients

We use the following technical service providers and processors (standard GDPR Art. 28 Data Processing Addenda with cloud processors are being finalized / governed by each provider's standard European DPA terms). Stripe is listed for transparency only: as merchant of record it is the seller and an independent controller, not our processor:

• Vercel Inc.: web hosting, global edge routing (requests may pass through Vercel edge locations outside the EU, including the US), automated bot protection (Vercel BotID), serverless function execution configured for Frankfurt (fra1), and DNS for spurvik.com, console.spurvik.com, and spurvik.dev.
• Neon Inc.: Managed PostgreSQL database hosted in AWS eu-central-1 (Frankfurt, Germany), with US parent entity control-plane metadata.
• Resend (email sending and receiving): Email sent to or from @spurvik.com and @spurvik.dev addresses is sent and received through Resend, configured in AWS eu-west-1 (Dublin, Ireland), with US parent-entity metadata and fallback infrastructure, with access by Resend's US entity, Resend (Plus Five Five, Inc., USA), which participates in the EU–US Data Privacy Framework, with Standard Contractual Clauses as a fallback (see section 4). Resend keeps message logs for its operational retention period unless we delete them earlier via its API or after an objection.
• Google Ireland Limited / Google LLC (Gmail): Google Workspace is not used for @spurvik.com mail. Where 1:1 personal business outreach is sent or received via refslund@gmail.com, Google Ireland Limited / Google LLC acts as an independent service provider for consumer Gmail without a processor DPA; transfers to the United States are covered by Google's certification under the EU–U.S. Data Privacy Framework (DPF).
• LinkedIn Ireland Unlimited Company: Where 1:1 messages are sent on LinkedIn, LinkedIn Ireland acts as an independent controller for its own platform.
• Stripe (Sold through Link, LLC): merchant of record (seller) for Pro and Team payments and its own independent controller for checkout and payment data, not our processor. See Billing above.

4. International Data Transfers (GDPR Chapter V)

Where sub-processors or their parent companies are established in the United States (Vercel Inc., Neon Inc., Resend), transfers of personal data outside the EEA are safeguarded under the EU–U.S. Data Privacy Framework (DPF) adequacy decision (Art. 45 GDPR) and the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, Module Two/Three) (Art. 46(2)(c) GDPR). For email, transfers go to Resend (Plus Five Five, Inc., USA), which participates in the EU–US Data Privacy Framework, with Standard Contractual Clauses as a fallback. Stripe (Stripe, LLC, USA, and its affiliate Sold through Link, LLC): where we pass your email address to Stripe to open checkout, the transfer is covered by Stripe, LLC's certification under the EU–US Data Privacy Framework, with Standard Contractual Clauses in Stripe's Data Transfer Addendum as a fallback (stripe.com/legal/dta). Copies of the applicable transfer safeguards may be requested at hello@spurvik.com.

5. Cookies & Browser Storage

spurvik.com and spurvik.dev set no cookies and store no data in browser storage (localStorage or sessionStorage). On console.spurvik.com, signing in sets one strictly necessary session cookie (spurvik_session, HttpOnly, SameSite=Lax, up to 30 days) to keep you signed in (exempt from consent under cookiebekendtgørelsen § 4).

6. Retention Periods, Automated Decisions & Data Subject Rights (Arts. 15–22 GDPR)

Console data (account details, SDK event metadata and review records) is kept while your workspace is active, and deleted on request or when the workspace is closed; plan-based retention periods are (planned). Upgrade and activation requests are kept on the same basis.

For individual business contact, if you do not reply we delete your details within 6 months; working lists used to prepare messages are deleted within 30 days; if you reply, we keep the correspondence as long as the conversation is relevant and at most 12 months after the last contact. We keep your email address and its domain on a suppression list so that you are not contacted again (Art. 6(1)(f) GDPR). This list is used only for that purpose. Suppression entries are kept for as long as needed to honour your objection, reviewed every 24 months. Opt-out addresses are kept on a suppression list so we don't email you again. Accounting records are retained for 5 years plus the current financial year under Bogføringsloven § 12. We do not carry out automated decision-making or profiling under GDPR Article 22. You have the right to request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object (Art. 21) by contacting hello@spurvik.com or by writing to EyeTea Solutions ApS · CVR 37093378 · Mosevråvej 106, Håstrup, 7000 Fredericia, Denmark. You may lodge a complaint with the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk).

← Return to Spurvik · Developer docs · Terms