EqtstoryPrivacy

Privacy notice

Your information.

How Eqtstory handles personal data. Provider and retention details identified below will be completed before customer accounts are activated.

1. Who is responsible

Eqtstory is responsible for the account, service-administration and security processing described here. Contact roa@copfm.dk for privacy questions or requests. This notice is dated 24 October 2026.

2. Accounts, invitations and support

We process your name, email address, organisation, workspace memberships, roles, account identifiers, sign-in records and terms-acceptance record to provide and protect the service. We also process invitations, support correspondence and commercial-use requests. You supply most of this information; an organisation administrator may supply your email and workspace role when inviting you. Where an enabled sign-in provider is used, we receive the account details it shares for that sign-in.

3. Why we use this information

We use account and workspace information to provide the service you request, on the basis of performance of a contract or steps taken at your request before a contract. For employees and other organisation users, we rely on our legitimate interests in providing the organisation’s requested service. Our legitimate interests also include securing the service, preventing misuse, answering enquiries and understanding how published embeds are used. Where applicable, we retain information to meet legal obligations. Account creation is not consent to marketing; any optional marketing consent must be requested separately and may be withdrawn.

4. Workspace content and public embeds

We store chart configurations, uploaded datasets, calendar preferences and publication records so that workspaces and embeds function. Workspace members can see information according to their assigned access. Published embeds expose the content chosen for publication to their viewers. Where an organisation uploads personal data for its own purposes, that organisation determines its lawful use; appropriate data-processing terms must be in place before using the pilot for that purpose. Please use non-personal sample data during evaluation.

5. Embed usage and technical records

Published-embed reporting records the embed identifier, the publishing hostname when available, approximate load counts and first/last-seen times. This reporting table does not store viewer IP addresses, user-agent strings or full page URLs. Separately, hosting, authentication and security services may process IP addresses, request details and technical logs to deliver and protect the service. Browser referrer rules and blockers can limit hostname reporting; it is not a complete list of publication locations.

6. Service providers and international transfers

We use service providers for hosting, database storage, authentication and email delivery. They process the account information, content, connection records or messages needed for their role. Some pages load fonts, charts or other resources from external content-delivery services, which receive connection information such as an IP address when your browser requests those resources.

The final application host, enabled email provider, processing locations and any international-transfer safeguards must be confirmed before customer-account activation. We do not promise that all processing stays in the EU. Where processing outside the EEA requires safeguards, the operator must establish an applicable legal transfer mechanism and make information about it available on request. We do not sell account details.

7. Browser storage

The service uses browser storage for sign-in sessions, local workspace preferences, saved selections and pending invitation state. Storage needed to sign in or remember an explicitly requested setting is used for that function. These notices do not authorise advertising or optional analytics tracking. Any such future tracking must receive its own assessment and, where required, prior consent.

8. How long information is kept

Account and workspace records are kept while needed to provide the requested service and resolve account, security or publication issues. When you leave, we assess what can be deleted and what remains necessary for an organisation’s continuing workspace, legal obligations or a specific dispute. Invitation validity is limited; expiry does not by itself mean the invitation record has been erased. Technical logs and backup copies have separate provider/configuration-dependent retention periods. Before customer-account activation, we will document those periods, deletion responsibilities and backup expiry rather than promise automatic deletion that has not been configured.

9. Your rights and choices

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where consent is the legal basis, you may withdraw it without affecting earlier lawful processing. Email roa@copfm.dk; we may need proportionate identity verification. We normally respond within one month and explain any lawful extension. You may complain to Datatilsynet or another competent supervisory authority.

10. Required information and automated decisions

Email and authentication details are needed to sign in; name and organisation details are needed to set up and administer a workspace. Without the required account information we cannot provide an account, but public demos remain available. Eqtstory does not use automated decisions producing legal or similarly significant effects about you. We update this notice when our actual providers or processing arrangements change.