Privacy policy
Last updated: 28 July 2026
Courtesy translation. This is an English rendering of our Danish policy, provided for convenience. The Danish version is the legally binding one and prevails in the event of any discrepancy: naevnt.dk/privatlivspolitik.
Who we are
cakecv.work, Matthæusgade 48A, 1666 København V, Denmark. CVR 46181727. Email: hej@naevnt.dk.
We are the data controller for the personal data we process about you.
The short version
Nævnt measures whether AI services — ChatGPT, Gemini, Perplexity, Google AI — mention companies.
We measure companies, not people. What we send to the AI engines is company names, competitor names, city and industry. We never send your email address, your IP address or your account details to OpenAI, Google, Perplexity or DataForSEO.
What we process
When you create an account
- Your email address (from your account or your Google sign-in)
- Your password — never in plain text. Our login system (Supabase) stores only an encrypted (hashed) imprint that cannot be turned back into the password. We cannot see it and we cannot tell it to you. If you sign in with Google, we hold no password for you at all.
- Your session, so you stay signed in
When you run a free AI check
- Your email address
- The name of the company you're checking, and its category
- A hashed version of your IP address — we never store your IP in the clear. We use it solely to prevent abuse of the free check.
- If you arrived from an ad, we store the ad ID (e.g. Google's gclid) and the campaign source (utm), so we can measure what our marketing costs. We don't share it.
When you use the product
- Information about your company: name, domain, category, competitors, city. This is company data, not personal data.
- The results of your scans: what the AI engines answered, who was mentioned, and which sources they used.
Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Delivering the service: scans, score, recommendations | Contract (Art. 6(1)(b)) |
| Running your free AI check and showing you the result | Contract / pre-contractual (Art. 6(1)(b)) |
| Preventing abuse of the free check (hashed IP) | Legitimate interest (Art. 6(1)(f)) |
| Measuring our marketing (ad ID / utm) | Legitimate interest (Art. 6(1)(f)) |
| Sending you marketing | Your consent (Art. 6(1)(a)). You can withdraw it at any time. |
| Security and debugging | Legitimate interest (Art. 6(1)(f)) |
We only send you marketing if you have explicitly said yes. The report from your free check is not marketing — it's the thing you asked for.
Who we share with (processors)
| Who | What they process | Where |
|---|---|---|
| Supabase | Database and sign-in (email, session) | EU (Stockholm) |
| Vercel | Website hosting | EU/global |
| Railway | Our scanning engine | EU |
| OpenAI (ChatGPT) | Prompt text — no personal data | USA |
| Google (Gemini) | Prompt text — no personal data | USA/EU |
| Perplexity | Prompt text — no personal data | USA |
| DataForSEO | Prompt text for Google AI Overviews — no personal data | USA |
| Google Workspace | Our support mailboxes | EU/USA |
| Amazon Web Services (SES) | Sending reports and login links by email | EU (Stockholm) |
| Sentry | Technical error reports — no personal data | EU |
Some of these sit outside the EU/EEA. Those transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework.
The thing that matters: the only thing we send to the AI engines is company names.
We look companies up in the CVR register (the Danish Business Authority) — a public register of companies.
We do not sell your data. To anyone. Ever.
How long we keep it
| Data | How long |
|---|---|
| Your free check (email, company, ad ID/utm) | 12 months |
| The hashed IP from your free check | 30 days — then we delete it |
| Your account and company data | Until you delete your account |
| The AI answers from your scans | 24 months |
| Security logs | 12 months |
When you delete your account, we delete your data. It can take up to 30 days for it to disappear from our backups as well.
Cookies
We use only the cookies that keep you signed in — no tracking, no analytics, no third parties.
These are session cookies from our login system (Supabase), set on our own domain; see the full list on the cookies page. No Google Analytics, no tracking pixels, no advertising cookies, no third-party tracking. That's why we don't ask you for cookie consent — a strictly necessary cookie doesn't require it.
Error monitoring. When something breaks, we send an error report to Sentry (Functional Software, Inc.) — our data processor, with data stored in the EU. The report contains the technical fault: what broke, where in the code, and which page. We do not send your email, your CVR number or the contents of your forms — those are stripped automatically before the report leaves us. This is not tracking: no cookie is set, and we don't follow you from page to page. The basis is legitimate interest (Art. 6(1)(f)) — keeping the service running.
Your rights
You have the right to:
- see the data we hold about you
- have it corrected if it's wrong
- have it erased ("the right to be forgotten")
- restrict how we process it
- receive your data in a machine-readable format
- object to our processing of it
- withdraw your consent at any time
You can delete your account directly in the app under Settings → Delete account. You can also write to hej@naevnt.dk and we'll do it for you.
We respond within 30 days.
If you're unhappy with how we handle your data, you can complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby — datatilsynet.dk.
Changes
If we change this policy materially, we'll say so before the change takes effect.
Contact
cakecv.work · CVR 46181727 · Matthæusgade 48A, 1666 København V, Denmark · hej@naevnt.dk