Privacy Policy

1. Who we are

CVR Pilot provides a B2B lead-generation platform at cvrpilot.dk and app.cvrpilot.dk. We are the data controller for the personal data described here – including the dataset of business contacts we build.

• Data controller: CVR Pilot ApS
• CVR no.: 46694562
• Address: Kastanien 8, 2. tv, 7120 Vejle Øst, Denmark
• Privacy enquiries: privacy@cvrpilot.dk

2. Two kinds of personal data

This policy covers two groups: A. platform users (people who create an account – §3) and B. lead/prospect data (business contacts we collect from public sources and make available in the product – §4). If you landed here because your details appear as a lead, §4 and §7 are for you.

There is also C. people in a customer's CRM: contacts, e-mail correspondents, meeting attendees and called parties that a customer stores in CVR Pilot CRM. Here the customer is the controller and we are the processor (§12).

3. Platform users – what we collect & why

We collect no sensitive data, and the service is not directed at children. Card details are entered directly with Stripe and are never seen or stored by CVR Pilot.

4. Lead/prospect data

CVR Pilot finds and qualifies companies and shows publicly available business contact data. We are not an outreach tool – how a customer contacts a lead is the customer's own action and the customer's own responsibility.

• What: business contact data (company name, website, address, public business phone/email, industry and – where publicly listed – a contact person's name and job function, taken from the company's own publicly published information – e.g. structured data on their website); we never infer a name. General company details (info@, switchboard, CVR number) are not personal data. A named individual can object or have their name erased and suppressed – including across backups (§7).
• Sole proprietorships: For sole proprietorships and personally owned small businesses (PMV), business contact data may under the GDPR constitute personal data – unlike limited companies (ApS/A/S), which are separate legal entities. We process this data on the same legal basis (legitimate interests, Art. 6(1)(f)), respect data-subject rights (§7) and marketing protection, and do not resell employees' or owners' private email addresses or mobile numbers without a valid legal basis – we stick to publicly available business master data.
• Sources: public company websites & directories, Google Maps/Places and the CVR register (the Danish Business Authority).
• Legal basis: legitimate interests – Art. 6(1)(f) – for B2B prospect data, supported by a balancing test we maintain.
• Scoring and AI enrichment: we rank and enrich leads automatically (including with language models) from publicly available company information, to assess how relevant the company is as a business lead. The assessment concerns the company – not the person – and we make no automated decisions producing legal or similarly significant effects for an individual (Art. 22). If you are a sole proprietor, you can object to this processing (§7).
• Transparency (Art. 14): because we collect without contacting each individual, we rely on the "disproportionate effort" exemption and publish this policy as our information notice.
• Marketing protection (reklamebeskyttelse) in CVR: companies with marketing protection in CVR stay in the dataset and are marked "Reklamebeskyttet". If we found the company's phone number on its own website and stored where it appears, we show that number, because the protection covers the register's data. Otherwise we show no phone number, the lead says not to make a sales call, and the lead cannot be sent to a CRM.

4a. Employees we find on the company's own website

When a customer searches for particular roles in a company (e.g. purchasing manager or operations manager), we read the company's own website and the company's own job postings on the same domain. If an employee is named there, we store that person on the customer's lead. If you are one of them, this section and §7 are for you.

• What we store: your name and job title, and, if the company printed them next to your name, a direct phone number and a work e-mail on the company's own domain. Also the address of the page where we found you, a short quote from that page and the date. We do not store private e-mail addresses (e.g. gmail.com), photos, home addresses or social-media profiles, and we do not take people from job portals or from any website other than the company's own.
• Source: the company's own website and the company's own job postings on the same domain.
• Purpose: so our customer can call the right person in the company instead of the switchboard.
• Legal basis: legitimate interests, Art. 6(1)(f): our and our customers' interest in selling to businesses. We have weighed it against your interests in our legitimate interest assessment.
• Recipients: the customer that holds the lead. The customer can transfer you to its own CRM or calling system, and from then on the customer is an independent controller for its own use. Text from the page may be part of our AI reading at Anthropic in the US (§6).
• Work e-mail: we mark your work e-mail so the customer can see that it may only be used for marketing if you have said yes (§ 10 of the Danish Marketing Practices Act).
• Retention: you are kept on the customer's lead. If we read the company's website again in the nightly re-read and no longer find you, we mark you as "no longer on the website". You are then not suggested as the person to call, and you are not transferred to the customer's CRM or exported. We do not re-read job postings, so a contact person from a job posting is not marked this way. The data is deleted together with the lead: when the customer deletes the lead or its account, when the account is deleted under the rules in §8 (e.g. a free account inactive for 12 months, after a warning 30 days before), or when you ask for erasure or object.
• We do not write to you: we do not send a message to each person we find. We consider that this would involve a disproportionate effort (Art. 14(5)(b)), and this page is our information to you. The customer who contacts you must tell you the first time where the data comes from and that you can always decline further contact (Art. 14(3)(b) and Art. 21(4)).
• Objection and erasure: use the form in §7 or write to privacy@cvrpilot.dk with your name and the company's website. We erase you as a person, so the company stays, and block you so we do not store you again. If you object to direct marketing, we stop without asking why. If a customer has already transferred you to its own system, the customer is the controller there, and we tell the customer about your request where possible (Art. 19).

5. Outreach from our customers (not from us)

CVR Pilot provides data; we do not send marketing on anyone's behalf. Our customers warrant in our terms that their outreach is lawful (including § 10 of the Danish Marketing Practices Act). A message you receive as a lead was sent by the customer – not by CVR Pilot. You can still exercise your rights with us (§7).

The exception is CVR Pilot CRM: a Growth customer can send e-mail sequences from its own connected mailbox through the CRM. Those e-mails are still sent by the customer, from the customer's address and on the customer's instruction; we provide the tool and process the data as the customer's processor (§12).

6. Who we share data with (sub-processors)

We share personal data only with selected vendors under a data-processing agreement. We do not sell personal data.

Where a vendor processes data outside the EEA, the transfer is covered by SCCs and/or the vendor's Data Privacy Framework certification.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, objection and data portability – and you can withdraw a consent at any time.

• Platform users: the owner of a workspace can export the workspace's data and delete the account in the app, under Settings → Billing and data. If you are a member of a workspace, those buttons are disabled for you. Ask the owner, or write to privacy@cvrpilot.dk.
• Leads / everyone else: use the form below (or write to privacy@cvrpilot.dk) to access, correct, object to, or have your details erased and suppressed from our dataset.

Send a request – we'll email you a link so we know it's you, then handle the request within one month:

We respond within one month. You can also complain to Datatilsynet (the Danish Data Protection Authority).

8. Retention

Active accounts: kept while the account is active. Deleted accounts: removed from the live system immediately on confirmed deletion – except records required by law. Trial accounts without a subscription: the account is locked when the trial month ends. Your leads and setup are then kept for 30 days so you can continue on a plan. If you do not pick a plan, the account and its data are deleted when the 30 days are up. Inactive accounts without a subscription: deleted after 12 months at the latest. Bookkeeping data: per the Danish Bookkeeping Act (typically 5 years). Raw collected lead page text: 90 days, after which the text is deleted automatically. Structured lead data (company details and – where publicly listed – a contact person's name and job function): kept while the company is active and relevant as a business lead, and erased and suppressed immediately on objection or an erasure request (§7). Security access logs (with IP address): 7 days, rolling. Application & error logs: 90 days. Contact-form messages and waitlist sign-ups: 12 months. Closed privacy requests, including the IP address the request was sent from: 12 months after the case is closed. Requests that are never confirmed: 37 days. History of changes to a lead's contact details: 12 months. Run history: 12 months. Call outcomes from Adversus that cannot be matched to one of the customer's leads: 30 days. New companies from the CVR register that we show the customer in the app: normally deleted after 60 days, and always after 180 days at the latest. Backups: encrypted, EU-hosted, kept for 14 days. Copies of the database on the server from before an update are deleted after 30 days at the latest.

When you delete your account (a two-step, email-confirmed process), your workspace data is removed from the live system immediately and your Stripe subscription is cancelled. Residual copies exist only in encrypted backups, which are deleted after 14 days, and in copies of the database on the server from before an update, which are deleted after 30 days at the latest. Because backups are point-in-time snapshots, we keep a separate erasure log that is re-applied whenever a backup is restored – so restoring an older backup never brings deleted data back. The same erasure-and-suppression approach applies to erasure requests for lead/prospect data (§7).

CVR Pilot CRM: records the customer deletes stay in a trash for 30 days and are then purged. When the Growth plan ends, the CRM is locked to read and export for 30 days, then erased. On account deletion the CRM workspace is erased within 30 days, and the workspace's backups are deleted 30 days after it is erased.

9. Cookies

We use a single essential session cookie (__Host-lv_session; HttpOnly, Secure, SameSite=Lax) to keep you signed in. Essential cookies do not require consent. On the signup, login and privacy-request forms we additionally load Cloudflare Turnstile for bot and abuse protection – a third-party service that accesses your device and may set a cookie strictly necessary for that purpose. It is not used for profiling or marketing. Our hosting provider's firewall (Simply.com) may also run a short "Checking your browser" check and then sets the security cookie sc_clearance on cvrpilot.dk (24 hours; Secure). It is strictly necessary to protect the site against attacks and does not require consent. Third-party statistics and marketing cookies are used only after consent, see below.

Statistics and marketing cookies (only with your consent). On cvrpilot.dk a banner asks whether we may use Google Analytics 4 (statistics) and the Meta Pixel (marketing). Neither loads before you say yes, and you can choose the categories separately. Your choice is kept in the cookie cvrp_consent (necessary, 12 months). If you accept, Google sets cookies such as _ga and _ga_* (up to 2 years) and Meta _fbp (3 months). Google and Meta process data in the USA under the EU-U.S. Data Privacy Framework. Legal basis: consent (Danish cookie order § 3 and GDPR Art. 6(1)(a)). You withdraw consent via the Cookies button bottom-right on the page; Google and Meta cookies are then deleted and the page reloads without them.

10. Security

TLS/HTTPS in transit (HSTS), scrypt-hashed passwords, HttpOnly session tokens with expiry and revocation on logout/password reset, strict security headers, tenant isolation, rate-limiting, and automated edge-level blocking of abusive traffic (e.g. request floods) informed by short-lived access logs. In the event of a notifiable breach we notify you and Datatilsynet as required.

11. Google user data (Gmail connection in CVR Pilot CRM)

CVR Pilot CRM (crm.cvrpilot.dk) can be connected to your Google account with "Connect Gmail". We ask for access to your Gmail (scope https://mail.google.com/) and your email address. The access is used solely for the features you enable in the CRM yourself:

• Mail sync: reading messages in your inbox and sent mail so conversations with your customers appear on the right company record, and so email sequences stop automatically when a recipient replies or unsubscribes.
• Sending: sending the emails you write yourself or place in an email sequence from your own address, so they land in your Sent folder.

We store only a refresh token, your email address and the messages needed for the above, on servers in the EU. We do not use Google user data for advertising, do not sell it, and do not share it with third parties other than the sub-processors in section 6 that are necessary to provide the service. Humans at CVR Pilot do not read your email unless you explicitly request support, it is necessary for security purposes, or the law requires it. Google user data is not used to develop or train generalised AI models. You can disconnect at any time under Settings in the CRM or at myaccount.google.com/permissions; the token is deleted immediately and synced messages are deleted under the retention rules in section 8.

CVR Pilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. CVR Pilot CRM (data we process on a customer's behalf)

Customers on the Growth plan also get CVR Pilot CRM at crm.cvrpilot.dk. In the CRM a customer stores companies, contacts, deals, tasks and notes, connects a mailbox so e-mails are filed on the company or contact, sends e-mail sequences, pulls meetings from a calendar, and can log calls through its own Twilio account.

• Roles. For the people in a customer's CRM, the customer is the controller and CVR Pilot ApS is the processor under our Data Processing Agreement. We use CRM data only to run the CRM for that customer. If you are a contact in a customer's CRM and want access, correction or erasure, ask that customer; if you write to us instead, we forward your request to the customer and help them answer it.
• Where the data lives. Each workspace has its own database on a DigitalOcean server in Frankfurt (EU), with nightly backups.
• Mailbox connection. The customer can connect Gmail (Google OAuth, scope https://mail.google.com/, see section 11), any IMAP mailbox, or Microsoft 365. We then read and send e-mail through that mailbox so that sent and received messages are stored on the matching company or contact. A blocklist lets the customer keep chosen senders and domains out of the sync. We never read a mailbox before the customer connects it, and the customer can disconnect at any time.
• Google user data. Section 11 describes the Gmail connection. CVR Pilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Calendar. Meetings are pulled from Calendly (with the customer's personal access token), Google Calendar (OAuth, read-only), Microsoft 365 (read-only) or an iCal feed, so they show on the company or contact.
• E-mail sequences and tracking. Sequence e-mails contain an unsubscribe line. A tracking pixel and click redirects tell the customer whether a message was opened and which links were clicked; we record the time of the event for the customer. The customer is responsible for the lawfulness of its outreach (§5 and the Terms §17).
• Telephony. If the customer sets up its own Twilio account, call logs with number, direction and duration are stored on the company. The customer is Twilio's contracting party.
• API tokens and webhooks. Customers can create API/MCP tokens and outgoing webhooks that send CRM data to systems the customer chooses.
• Deletion. Records the customer deletes stay in a trash for 30 days and are then purged. When the Growth plan ends, the CRM is locked to read and export for 30 days, then erased. When the customer deletes its account, the CRM workspace is erased within 30 days.
• Sub-processors used only for the CRM: Google (Gmail/Calendar API), Microsoft (Graph/Exchange Online) and Calendly, each only when the customer connects it; Twilio only through the customer's own account. See §6.

13. Changes

We may update this policy; material changes are notified by email and/or in the app, and the "Last updated" date changes.