Privacy Policy

Last updated: 5 October 2026 · v1.0

This policy explains how Apitite processes personal data. It has two parts. Part A covers you as a customer or visitor of apitite.net. Part B covers people whose information appears in the CVR company data we publish.

Data controller

Kastrup Concepts
CVR no. 38072781
Vestergade 49B, 8000 Aarhus C, Denmark
gkn@kastrupconcepts.dk

Part A: Customers and website visitors

What we process, why, and for how long

Data	Purpose	Legal basis	Retention
Account data: first name, last name, email, password (stored only as a bcrypt hash), API key, account timestamps	Creating and running your account, logging in, authenticating API calls	Contract, GDPR art. 6(1)(b)	Until your account is deleted
Subscription data: plan, status, billing period, Stripe customer and subscription IDs	Managing your subscription and payments	Contract, art. 6(1)(b), and legal obligation under the Danish Bookkeeping Act, art. 6(1)(c)	Accounting records for 5 years after the end of the financial year. Other data until your account is deleted
Usage data: number of requests per API per day	Enforcing plan quotas, operating and improving the Service	Contract, art. 6(1)(b)	Deleted together with your account
Technical logs, which may include IP addresses and request details	Security, troubleshooting and preventing abuse	Legitimate interest, art. 6(1)(f)	90 days
Connected applications: OAuth grants for AI assistants and other tools you connect through the MCP server	Letting your chosen tools call the Service on your behalf	Contract, art. 6(1)(b)	Until you revoke access or delete your account
Service emails: account activation and password reset	Delivering messages you need to use the Service	Contract, art. 6(1)(b)	Not stored by us after sending
Analytics: pages visited, device and browser information, approximate location	Understanding how the website is used	Consent, art. 6(1)(a)	According to Google Analytics' retention settings, at most 14 months
Emails you send us	Answering your enquiry	Legitimate interest, art. 6(1)(f)	As long as needed to handle the enquiry

We never receive or store your card details. Payments are handled entirely by Stripe.

Cookies and local storage

Name	Type	Purpose	Duration
`NEXT_LOCALE`	Cookie, necessary	Remembers your language choice	1 year
`apitite_consent`	Cookie, necessary	Remembers your cookie choice	6 months
`apitite_token`, `apitite_userId`	Local storage, necessary	Keeps you logged in	Until you log out
`_ga`, `_ga_*`	Cookie, analytics	Google Analytics statistics	Up to 2 years

Necessary cookies and storage do not require consent. Analytics cookies are only set with your consent. You can change or withdraw your choice at any time under "Cookie settings" at the bottom of every page. We ask again after 6 months.

Part B: People who appear in the CVR data

Apitite publishes data from the Danish Central Business Register (CVR), which is maintained by the Danish Business Authority (Erhvervsstyrelsen). This section explains how we process personal data about people who appear in that register. We have not collected this data from you directly.

Whose data: persons registered in CVR as legal owners of a company, and owners of sole proprietorships.
What data: name, ownership and voting shares and the date they took effect, as registered in CVR. For sole proprietorships, the company name and business address, which may include the owner's name and home address.
Purpose: making public company information available through an API, so it can be used for things like due diligence, credit assessment and business analysis.
Legal basis: legitimate interest, GDPR art. 6(1)(f). The data is public by law under the Danish Companies Act, and our interest, and that of our customers, is to give structured access to it.
Source: the CVR register, via Erhvervsstyrelsen's public data distribution.
Recipients: our API customers.
Changes: if we start publishing other roles from CVR, such as directors or board members, we will update this section first.
Retention: we mirror the register. When information is changed or removed in CVR, our copy follows at the next update.
Advertising protection: we keep the advertising protection (reklamebeskyttelse) flag from CVR, and our terms forbid customers from using the data for direct marketing to protected persons or companies.

You can object to our processing at any time. If you believe information about you is wrong, it must be corrected in CVR through Erhvervsstyrelsen. We will then update our copy.

Processors and transfers

We use the following processors. All have data processing agreements with us.

Processor	Service	Location
Microsoft (Azure)	Hosting, databases, logging and email delivery	EU (West Europe)
Stripe	Payment processing	EU and USA
Google	Website analytics	EU and USA

Transfers to the USA are covered by the EU-US Data Privacy Framework and, where relevant, the EU Standard Contractual Clauses.

Customers who connect an AI assistant to the Service decide themselves which provider to use. That provider is not our processor.

Security

Passwords are stored only as bcrypt hashes. All traffic is encrypted with TLS. Access to production databases is restricted to named administrators through Microsoft Entra ID.

Your rights

You have the right to:

access the personal data we hold about you;
have incorrect data corrected;
have your data deleted;
restrict our processing;
receive your data in a portable format;
object to processing based on legitimate interest;
withdraw your consent at any time, without affecting processing that has already taken place.

You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

Changes to this policy

We will update this policy when our processing changes. The date and version at the top show the latest change. We notify customers by email of material changes.