Privacy Policy
Plain-language explanation of what we collect, why we collect it, and what your rights are under the GDPR.
Short version: we collect the data you give us when you order an enclosure (account, contact, project files) plus a few essential cookies to keep you signed in. We never sell your data. You can ask us to export or delete everything you’ve created.
1. Who we are
Enclovo is operated by Podovo ApS (CVR: 41 65 03 70), Dallvej 4, 9200 Aalborg, Denmark. We are the data controller for the personal data described below. You can reach us at hello@enclovo.com.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Email, hashed password, first name, last name | So you can sign in and we know who to contact about your order |
| Profile | Company, phone, address (optional) | Pre-filled when you submit a quote — only used for delivery and invoicing |
| Project data | Configurations, holes, materials, uploaded files | So we can produce the enclosure you designed |
| Order data | Quote ID, status history, prices, invoice references | To run our business — invoicing, production, support |
| Technical | IP address, browser, session cookies | Security, fraud prevention, debugging |
3. Legal basis
We process personal data on the following legal bases under GDPR Art. 6:
- Contract (Art. 6(1)(b)). Account, profile, project and order data are needed to deliver the service you signed up for.
- Legal obligation (Art. 6(1)(c)). Invoices and order records are kept for at least five years to comply with Danish accounting law (Bogføringsloven).
- Legitimate interest (Art. 6(1)(f)). Limited technical data (logs, security events) is processed to keep the service safe and debug issues.
- Consent (Art. 6(1)(a)). Optional cookies and any marketing emails are only sent if you opt in.
4. How long we keep it
- Account & profile: for as long as your account is active. Delete it any time from /account/profile.
- Quotes and orders: kept for at least 5 years from submission to comply with Danish bookkeeping law.
- Saved drafts: deleted when you delete the draft, or 24 months after your last edit if you never come back.
- Technical logs: rolling 90-day window.
5. Who we share data with
We use a small list of carefully chosen sub-processors to run the service. We do not sell your data, and we don’t share it for advertising purposes.
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase (database, auth) | Stores your account, configurations and quotes | EU (Frankfurt) |
| Vercel (hosting) | Serves the website and runs API endpoints | EU + US (edge cached) |
| Resend (transactional email) | Sends signup, password reset and order emails, and delivers contact-form submissions to us | EU + US |
| E-conomic (accounting) | Generates and sends invoices when you accept a quote | EU (Denmark) |
| Adobe Fonts (Typekit) | Serves the site’s typeface from Adobe’s servers — your IP address is sent to Adobe when the font files load | US (EU Standard Contractual Clauses) |
Where data is processed outside the EU (e.g. Vercel’s edge network, Resend, Adobe Fonts), it is covered by the EU Standard Contractual Clauses.
6. Your rights
Under the GDPR you can, at any time:
- Ask for a copy of the data we hold about you (right of access).
- Have inaccurate data corrected (right of rectification).
- Ask us to delete your data (right of erasure) — except where we’re legally required to keep order records.
- Get your data in a portable format (right of data portability).
- Object to processing based on legitimate interest.
- Withdraw consent at any time (e.g. for marketing emails).
Email hello@enclovo.com and we’ll respond within 30 days. If you’re unhappy with our response you can complain to Datatilsynet, the Danish Data Protection Agency.
7. Cookies
We only set strictly necessary cookies by default (session, theme preference). Optional analytics or marketing cookies are opt-in via the cookie banner. Full breakdown: Cookie Policy.
8. Security
Passwords are hashed with industry-standard algorithms; data in transit is protected with HTTPS; data at rest is encrypted by our hosting providers. Access to production data is limited to two named engineers and audit-logged. We notify affected users without undue delay if a breach affects their data.
9. Changes
We’ll post material changes to this policy here and bump the "last updated" date at the top. If the change affects you materially we’ll also send an email.
10. Contact
Questions about this policy or your data? hello@enclovo.com.
