Privacy Policy

Last updated: 2 November 2026. Changes in this revision: the Trust Center enquiry form is described in section 1.

This Privacy Policy describes how Responsemate ApS ("Responsemate", "we", "us", or "our") collects, uses, and protects information about you when you use our website at responsemate.dk and our compliance questionnaire automation platform (collectively, the "Service").

Responsemate ApS, CVR 45884422, Kirkeløkken 42, Nørre Søby, 5792 Årslev, Denmark, is the data controller for personal data collected through our website, the forms on it, and our customer relationships. For the content a customer uploads to our platform, Responsemate acts as the data processor on the customer's behalf under a Data Processing Agreement based on the Danish Data Protection Agency's standard contractual clauses, and the customer remains the data controller.

1. Data we collect

When you visit our website

• Server logs: IP address, browser type, pages requested and timestamps, kept by our web server for up to 90 days for security and abuse prevention.
• Statistics, only if you allow it: which pages are read, device and browser type, and an approximate location derived from a shortened IP address (Google Analytics).
• Company identification, only if you allow it: the company a visit comes from, matched from the IP address (Leadfeeder). The two purposes are separate choices in the cookie banner, and nothing is collected until you allow a purpose; see section 8.
• Contact form: name, email address and your message.
• Demo request form: name, work email address, company, and optionally the questionnaire types you handle.
• Trust Center enquiry form: whether you want to join the waiting list or book a demo, name, work email address, company, and optionally your company's website, what you want a trust center to do, whether you have one today and with which tool, and your message.

A form submission is sent to our inbox as an email through Scaleway, a transactional email provider in France. Nothing you enter is stored on the web server.

When you use our platform as a customer

• Account data: Name, email address, company name, role in the workspace, and invoicing information where applicable.
• Knowledge base content: Documents, certificates, and policies you upload to build your workspace knowledge base.
• Questionnaire data: Questionnaire files you import and the answers generated or edited within the platform.
• Activity and AI logs: Who did what in the workspace and when, from which IP address and browser, and the requests sent to the AI model and its replies, kept so that your administrators can audit the workspace.
• Error reports: When something goes wrong, a report with the error, the address of the failing page, the workspace name and the signed-in user's account id (not the name or email address) is sent to our error-monitoring service so we can fix it.
• Voice input: If you dictate to the assistant, the recording is sent once to the AI provider your workspace uses for transcription and is not stored; only the text comes back.

When you use our browser extension

Responsemate for Chrome is an optional extension for Google Chrome. It shows its panel on Microsoft Forms response pages, and on any other page only when you click its icon there. It only acts when you press one of its buttons.

When you import a form, it sends the form's title and questions to your own Responsemate workspace, where they become a questionnaire like any other. When you fill a form, it reads that questionnaire's answers from your workspace and types them into the form in your browser. When you choose to send answers back, it shows you which answers differ and, after you confirm, updates those answers in your workspace. It never submits a form.

The extension keeps your workspace address, its sign-in tokens and which questionnaire belongs to which form in your browser's extension storage, and nowhere else. It sends nothing to Responsemate ApS or anyone else apart from your workspace, and it contains no analytics or tracking. Removing the extension deletes what it stored.

2. How we use your data

• To provide and operate the Service
• To answer your enquiry or arrange the demo you asked for
• To send transactional emails (invitations, password resets, billing notifications)
• To keep the Service secure and to find and fix errors
• To see which pages of our website are read, and which companies visit it, if you allow those purposes
• To comply with legal obligations

We do not use your data for advertising. We do not sell your data. We do not use customer-uploaded content to train AI models, and neither do our AI providers.

3. Legal basis for processing (GDPR)

• Contract (Article 6(1)(b)): Delivering the Service you or your employer has subscribed to, and answering a contact or demo request, which are steps taken at your request before a contract.
• Legitimate interest (Article 6(1)(f)): Server logging for security and abuse prevention; error monitoring; improving our product based on aggregated usage data; keeping the correspondence of a business relationship.
• Consent (Article 6(1)(a)): Website statistics through Google Analytics and company identification through Leadfeeder, two separate purposes that each run only after you allow them in the cookie banner. You can withdraw either consent at any time under "Cookie settings" in the footer. Marketing emails, if we ever send any, would also be based on consent.
• Legal obligation (Article 6(1)(c)): Retaining billing records as required by Danish bookkeeping law.

4. Data retention

• Server logs: up to 90 days.
• Analytics data: the cookie lifetimes are listed in section 8; Google Analytics keeps page-view statistics for 14 months.
• Contact and demo requests: the email stays in our mailbox for up to 12 months after your request has been dealt with, so we can follow up, unless a customer relationship follows.
• Customer account data and workspace content: for the duration of the subscription. After it ends, the customer has 30 days to export its content, after which the workspace is deleted within 30 days and backup copies are overwritten within a further 35 days.
• Error reports: 90 days.
• Billing records: 5 years after the end of the financial year, as required by Danish bookkeeping legislation.

You may ask for earlier deletion at any time by writing to mail@responsemate.dk.

5. Who we share data with

We share personal data only with the service providers we need to run the website and the platform. Each one processes data on our instructions under a data processing agreement. We do not share personal data with anyone for marketing.

For the website:

• DigitalOcean (web hosting, EU data centre)
• Scaleway (delivers the email from the forms on the website, France)
• Google Ireland Ltd. (Google Analytics, only after you allow statistics; data may be processed in the USA)
• Leadfeeder, Liidio Oy (identifies the company a visit comes from, only after you allow company identification, Finland)

For the platform:

• DigitalOcean (application hosting and job queue, Amsterdam, the Netherlands)
• Cloudflare, Inc. (DigitalOcean's content-delivery and TLS edge: every request to the platform passes through it in transit; EU visitors are served from EU points of presence; it stores no content)
• MongoDB Atlas (database and backups, Stockholm, Sweden)
• Amazon Web Services (file storage in Stockholm, Sweden, and text recognition of scanned documents in Dublin, Ireland)
• OpenAI (the fallback AI provider for a workspace that has connected none of its own: transient processing of excerpts and dictated voice recordings in the USA, nothing kept beyond abuse monitoring of up to 30 days; a customer can instead connect its own AI provider, including EU-hosted ones)
• Scaleway (invitation and password-reset emails, France)
• Sentry (error monitoring, Frankfurt, Germany; a report carries the account id, the workspace name and the page address, never the name or email address)

Our Data Processing Agreement and the published sub-processor list name these sub-processors with their addresses, and customers are told at least 30 days before one is added or replaced. Integrations a customer switches on itself, such as Microsoft single sign-on, SharePoint or Slack, send data to that provider under the customer's own agreement with it.

We may disclose data if required to do so by Danish or EU law, or in response to a valid court order.

6. International transfers

The website and the platform are hosted in the European Union. Five of our providers are US companies or may process personal data in the USA: Google (statistics, only with your consent), OpenAI (the platform's fallback AI provider: transient processing of excerpts and dictated recordings for workspaces that have connected no provider of their own, nothing kept beyond abuse monitoring of up to 30 days), Sentry's parent company (remote support of the EU-hosted error monitoring), DigitalOcean, LLC (the hosting company, whose data centre for the platform is in Amsterdam) and Cloudflare, Inc. (the hosting edge, serving EU visitors from EU points of presence). Each is certified under the EU-US Data Privacy Framework, and our agreements with them also include the European Commission's Standard Contractual Clauses. Customers who prefer no AI processing outside the EU can configure the platform to use an EU-hosted AI provider with their own key.

7. Your rights under GDPR

If you are located in the EU or EEA, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Restriction: Request that we limit the processing of your data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact mail@responsemate.dk. We will respond within one month. If your data is in a customer's workspace, we will pass your request to that customer, who decides on it as the data controller. You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, datatilsynet.dk.

8. Cookies

Our website works without cookies. We would like to use two services, for two separate purposes: Google Analytics, to see which pages get read (statistics), and Leadfeeder, to see which companies visit us (company identification). Each is loaded only after you allow that purpose in the banner at the bottom of the page, where you can allow both, decline both or tick the one you accept. Your choices are stored in your browser, and you can change them at any time under "Cookie settings" in the footer. If you decline a purpose, or withdraw your consent later, that service's cookies are removed and the page is reloaded without it. We ask again after 12 months.

Everything this site can store in your browser, cookies and browser storage alike:

Google may process the statistics in the USA under the EU-US Data Privacy Framework and Standard Contractual Clauses. Leadfeeder matches the IP address to a company and shows us the company, not the person. Browsers may shorten the lifetimes above; Safari keeps script-set cookies for at most 7 days. The list was last checked against both providers' documentation on 9 October 2026.

If you allow neither purpose, nothing from either service is loaded and none of its cookies are set.

Our platform, where customers sign in, sets these cookies and storage items. The first three are required for it to work and need no consent; the fourth is asked for.

Inside the platform a signed-in person is asked once whether Google Tag Manager may measure which parts of the product get used; nothing loads before the choice, the choice is kept for 12 months and can be changed under "Cookie settings" in the platform's footer, and the sign-in pages load no analytics at all.

9. Changes to this policy

We may update this policy from time to time. We will notify customers of material changes by email at least 14 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision.

10. Contact

For privacy-related questions or to exercise your rights:

• Email: mail@responsemate.dk
• Responsemate ApS · CVR 45884422 · Kirkeløkken 42, Nørre Søby · 5792 Årslev · Denmark