# Privacy notice. > How Naborly ApS collects, uses, and protects your personal data under GDPR and Danish law. Version 2026-09-05. Effective 5 September 2026. [Web page](https://naborly.io/legal/privacy) · [Dansk](https://naborly.io/da/legal/privacy) · [All pages for agents](https://naborly.io/llms.txt) · [All legal documents](https://naborly.io/legal) This notice explains how Naborly ApS handles personal data when you use Naborly. It applies to the people who use the employee app at app.naborly.io, the administrators who manage an organisation at admin.naborly.io, and visitors to naborly.io. Naborly is a benefits platform: your employer or membership organisation connects you to a curated set of benefits from other organisations in the network. ## 1. Who is responsible for your data Naborly ApS, Copenhagen, Denmark, is the data controller for the personal data described here. For privacy questions, data requests, or to reach the person responsible for data protection, contact [sander@naborly.io](mailto:sander@naborly.io). Where your employer or membership organisation decides which of its people may join and configures its own account, that organisation acts as an independent controller for those decisions. Naborly is the controller for operating the platform itself. ## 2. The data we collect - **Account and identity**: Your name, work email address, preferred language, and the organisation you belong to. Most of this comes from your organisation or from you when you first sign in. - **Preferences you tell us**: The categories you choose during setup and how strongly you weight them, so your feed reflects what you care about. You can change these at any time. - **How you use the app**: Records of the benefits you view, save, and redeem, and similar activity, so the platform works and so your feed and reminders stay relevant. - **Approximate location, if you provide it**: A home or work area you set to find benefits nearby. We round this to roughly 100 metres before storing it, and we never share it with partner organisations. - **Communications**: Emails and in-app notifications we send you, and your preferences for them, including whether you opted in to non-essential messages. - **Technical data**: Standard information your device sends, plus essential cookies and local storage needed to keep you signed in. See the [cookie policy](/legal/cookies) . ## 3. Why we use it, and our legal basis We use your data to run the platform: to sign you in, show you a relevant feed, let you save and redeem benefits, send the notifications you expect, and keep the service secure. The legal basis is performance of the arrangement that gives you access through your organisation, and our legitimate interest in operating, securing, and improving the service. We personalise your feed from the preferences you declare and from your activity. This keeps a small, curated set relevant to you. It does not make decisions with legal or similarly significant effects about you. You can adjust or reset your preferences at any time. Where we rely on consent, such as optional notifications or non-essential cookies, you give it freely and can withdraw it at any time without affecting your use of the platform. ## 4. What we never do We do not sell your personal data. We do not share your identity or contact details with the partner organisations whose benefits appear in your feed. Partners receive only counts, never a name, an email address, or a record of what one person did. Counts are suppressed below a threshold so a single person’s activity is not readable from a small number. The threshold is five people in most organisations, and two in organisations with fewer than twenty members, because at that size a threshold of five would hide everything. We name the smaller figure rather than claim a guarantee it does not support: a count of two tells you more in a team of four than in a team of four hundred. ## 5. What your organisation can see Your employer or membership organisation sees who is on its team and how the platform is being used across the organisation, under the same thresholds as above. It does not see what you individually viewed, saved, or redeemed. ## 6. Service providers who process data for us We work with a small set of providers who process data on our instructions under data processing agreements: hosting and database (Supabase), application hosting and delivery (Vercel), transactional email (Resend and Amazon SES), error monitoring (Sentry), maps for the nearby view (MapTiler), and the AI services we use to prepare and translate the editorial content shown in the app (Anthropic and Voyage AI). Billing between Naborly and organisations is handled through Stripe and involves organisation billing contacts rather than members. Two more run the machinery rather than the product: Inngest, which runs our background jobs and therefore handles the contents of the notifications we send, and Upstash, which holds the short-lived counters that stop the platform being abused. Our database and application hosting run in the EU. Some of the other providers are established outside the EU and EEA. Where that is the case, the transfer relies on an approved safeguard: either the European Commission’s Standard Contractual Clauses, or an adequacy decision such as the EU-US Data Privacy Framework where the provider is certified under it. For the current list of providers, what each one handles and where it is established, write to [sander@naborly.io](mailto:sander@naborly.io) and we will send it. ## 7. How long we keep it We keep your account and preference data while you have access through your organisation, and for a limited period afterwards so the experience is consistent if you return. Records required for accounting are retained for five years in line with the Danish Bookkeeping Act (Bogføringsloven). We remove or anonymise activity data on a rolling basis once it is no longer needed for the purposes above. If you want the current schedule, with the period that applies to each kind of data, write to [sander@naborly.io](mailto:sander@naborly.io) and we will send it. ## 8. Your rights Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. Where we rely on consent, you can withdraw it at any time. To exercise any of these, contact [sander@naborly.io](mailto:sander@naborly.io) and we will respond within the time the law allows. If you believe we have handled your data incorrectly, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk. ## 9. How we protect it Data is encrypted in transit and at rest. Each organisation’s data is isolated at the database layer, so one organisation cannot read another’s, and access is limited to what each role needs. Administrative access to the platform sits with the two people who run Naborly. ## 10. Children Naborly reaches people through their employer or membership organisation and is not directed at children. There is no direct-to-consumer signup: an account exists because an organisation gave someone access. We do not knowingly collect personal data from children. If you believe a child has an account here, write to [sander@naborly.io](mailto:sander@naborly.io) and we will remove it. ## 11. Changes to this notice If we change how we handle your data, we will update this page and the effective date above, and tell you in advance where the change is significant. ## 12. Contact For anything in this notice, or to make a data request, contact [sander@naborly.io](mailto:sander@naborly.io).