Privacy notice

Version of 13 September 2026. Earlier versions are available on request.

This notice explains how Lauridsen Software, trading as Livery, processes personal data when you use liveryhq.com or a website hosted through it. It is written to be read, not to be survived.

Who is responsible

Rights requests and privacy questions: privacy@liveryhq.com. We have not appointed a data protection officer, because none of the Article 37 conditions apply to a company of this size and kind; the address above is still a real route to a person.

Two different roles

This matters more than it sounds. For your own account data we are the controller. For the business records you research and the client sites you build, you are the controller and we are your processor, acting on your instructions under the data processing agreement, which forms part of your contract with us.

What we process, and why we are allowed to

• Account data — name, email, a hashed password, the organisation name. Lawful basis: performance of a contract (Art. 6(1)(b)).
• Business records from OpenStreetMap, the Danish CVR register and equivalent public sources — company name, registration number where available, address, trade, and publicly listed contact details. Lawful basis: legitimate interests (Art. 6(1)(f)) in business-to-business prospecting, assessed and documented before the feature shipped. A copy of that assessment is available on request.
• Website health checks — we fetch the public homepage of a business that has one, to classify whether it works. We honour robots.txt, we fetch once, and we store the classification and the evidence for it rather than the page. Lawful basis: legitimate interests.
• Site content and images supplied by you or your client, to host the site. Lawful basis: contract; and as your processor where the content is your client’s.
• Enquiries submitted through a published site’s contact form, passed to the business they were addressed to. Lawful basis: the site owner’s legitimate interests, as their processor.
• Security and billing records — sign-in events, audit logs, invoices. Lawful basis: legitimate interests in securing the service, and legal obligation for accounting records.

Sole traders are people

An enkeltmandsvirksomhed is a natural person, so its business contact details are personal data and carry the full set of rights below, even though the context is commercial. We treat every lead record that way rather than trying to tell the two apart, because the register does not reliably say which is which.

Where the data is, and what leaves the EEA

This section was wrong until 13 September 2026. It said the data lived in the EU. Part of it does not, and saying otherwise was the more serious of the two problems. What is actually true:

• The database — Supabase, in us-east-1 (Virginia, United States). This holds accounts, lead records, site content and enquiries. It is outside the EEA.
• The application — Vercel. It receives every request, including IP address and user agent.

Transfers to the United States rely on the EU–US Data Privacy Framework where the recipient is certified, and on the European Commission’s Standard Contractual Clauses together with the supplementary measures in each provider’s data processing terms where it is not. You may ask us for a copy of the relevant clauses and the transfer impact assessment.

We consider the database’s location a defect rather than a design decision, and intend to move it to an EU region. This notice will say so when it has happened, and not before.

Who else processes it

The complete list is kept on its own page, because it changes and because you are entitled to be told when it does: sub-processors. Each entry says what actually reaches it and where it is.

What a visitor to a generated site discloses

Typefaces are served from our own deployment rather than from Google Fonts, so reading a Livery site tells Google nothing. There is no analytics, no advertising pixel and no tracking script, on this site or on any site it generates.

One exception, named rather than left implicit: a generated site that shows a map embeds it from Google Maps, which discloses the visitor’s IP address to Google when that section loads. Remove the map section and the site contacts nobody but its own server.

Automated decisions and AI

Site copy is drafted by a large language model — see how AI is used. Lead scoring ranks businesses by how likely they are to need a website. Neither produces a decision with legal or similarly significant effects on a person within the meaning of Article 22: a score changes the order of a list a human then works through, and drafted copy is reviewed and published by a person. Nothing is published automatically.

Cookies

Four strictly necessary cookies, and one third-party script that only loads if you open the checkout. The detail, including why you are not asked to consent, is on the cookie page.

How long we keep it

• Lead records — until you delete them, or 24 months without activity.
• Site content — for the life of the subscription.
• After cancellation — a site is archived for 12 months so it can be restored, then deleted.
• Enquiries from contact forms — 24 months, then deleted.
• Audit and sign-in logs — 24 months.
• Invoices and accounting records — five years from the end of the financial year, because the Danish Bookkeeping Act requires it. This one survives an erasure request, and that is lawful.

Your rights

You may request access, rectification, erasure, restriction and portability, and you may object to processing based on legitimate interests — including the lead research described above. Where you object, we stop unless we can show compelling grounds that override your interests, and for direct marketing there is no such override: an objection ends it.

Write to privacy@liveryhq.com. We answer within one month, extendable by two further months for complex requests, in which case we tell you inside the first month. There is no charge unless a request is manifestly unfounded or excessive.

You can complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk, or to the supervisory authority where you live or work.

If something goes wrong

A personal data breach that is likely to risk your rights is reported to Datatilsynet within 72 hours of us becoming aware of it, and to you without undue delay where the risk is high. If you are a controller and we are your processor, we tell you without undue delay so that you can make your own notification — the clock is yours, not ours.

Security reports: security@liveryhq.com.

Children

Livery is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 16, and will delete such an account if we learn of it.

Taking your content with you

A business whose site we host can export its full content at any time from the client portal, and you can export every site you have built. Neither requires our permission and neither requires the account to be paid up. We do not hold content hostage against payment.

Changes

When this notice changes materially we date it and tell account holders by email before the change takes effect. The date at the top is the date of the version you are reading.