What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data (display name, email, password hash) | Providing your account: writing, editing and reporting reviews | Contract (GDPR art. 6(1)(b)) |
| Reviews, ratings and reports you submit | Publishing reviews and moderating the platform | Contract; legitimate interest in a trustworthy review platform |
| Proof-of-purchase files (receipts, emails, correspondence) | Verifying that a reviewer actually dealt with the company | Legitimate interest; deleted immediately after the decision (see below) |
| Company claim data (work email, domain) | Verifying company profile ownership via domain email | Contract |
| Contact-form messages (your email, optional name, message) | Answering your question or request | Legitimate interest in responding; consent where you ask us to act |
| Technical logs (IP, user agent) in session records | Security: keeping accounts signed in safely, abuse prevention | Legitimate interest |
We collect nothing else, and we never require more data than a feature needs.
Reviews are public, but only under your username
Reviews are published under the username you choose, and nothing else. Your email address and your real name are never displayed publicly, never attached to a review, and never shared with the companies being reviewed. We built it this way deliberately: reviewing services in this category shouldn't require exposing who you are. Two things follow from that. First, pick a username that doesn't identify you if you want to stay unidentifiable; that part is in your hands. Second, understand that by publishing a review you are yourself making public, under that username, the fact that you've used the service concerned. Do not put personal data, yours or anyone else's, in review text; moderation removes it where we spot it.
Special handling for proof-of-purchase files
Files uploaded to verify a review can contain personal data, including about third parties (for example company staff named in an email exchange). They are viewable only by the site operator during verification, and are deleted permanently as soon as the verification decision is made, in either direction. What we keep is only the outcome: verified yes/no, the date, the method and who checked it. See how we verify reviews.
Deleting your account
You can delete your account from the account page at any time. Your account data (name, email, credentials, sessions) is deleted. Published reviews stay online, because they are part of the public record other consumers rely on. They are re-attributed to "Anonymous (Deleted User)" and are no longer linked to any account data. You can delete individual reviews yourself before deleting the account if you don't want them to remain.
Cookies, analytics and anti-spam
We use only strictly necessary cookies: session cookies, plus an 18+ confirmation cookie if the site shows an age gate. The cookies page lists them. Traffic analytics use Cloudflare Web Analytics, which is cookieless and does not track individuals across sites. The contact form is protected by Cloudflare Turnstile, a cookieless captcha that checks your browser for signs of automation; Cloudflare processes the request data needed for that check as our processor.
Advertising and affiliate links
The site runs no advertising. Some pages may carry affiliate links, meaning links to a company that pays us a commission if you sign up or buy after clicking one. Using an affiliate link does not involve us sharing your personal data with anyone. It takes you to that company's own site, which sees your visit as it would any other and applies its own privacy policy and cookies. Any tracking that credits the referral is done by the company you land on, not by us. Commission never affects a score, a ranking or an editorial verdict. Our terms set out the full disclosure. If we ever introduce advertising technology that uses cookies or similar identifiers, we will update this policy and the cookies page first and ask for consent where the law requires it.
Who processes your data
The site runs on Cloudflare (hosting, database, file storage, captcha, analytics). Transactional email (password resets, claim confirmation codes, contact-form delivery) is sent via Resend. Both act as data processors under data processing agreements; transfers outside the EU/EEA are covered by the EU–US Data Privacy Framework and/or standard contractual clauses. We do not sell personal data, and we do not share it with the companies being reviewed. A company never learns a reviewer's email or account details from us.
When we disclose data
We disclose personal data outside the processors above only when required by law or a valid order from a competent authority (legal basis: legal obligation, GDPR art. 6(1)(c)), or where necessary to establish, exercise or defend legal claims, for example if a review or account becomes the subject of a legal dispute (legitimate interest). Where the law allows it, we tell the affected user before disclosing.
Security
Traffic is encrypted in transit (TLS). Passwords are stored only as salted hashes. Proof files live in private storage readable only by the site operator. Access to production data is limited to the people who run the site. No system is perfectly secure; if a breach ever puts your data at risk, we will notify affected users and the supervisory authority as the GDPR requires.
Automated decisions
We use software to help screen reviews for spam and rule violations, but no review is rejected and no account is terminated by automation alone. A human makes those decisions. We do not use automated decision-making with legal or similarly significant effects.
Retention
- Account data: until you delete your account.
- Proof files: until the verification decision, then deleted.
- Reviews: indefinitely (anonymized if the account is deleted; removed if moderation or an upheld report requires it).
- Reports and moderation records: as long as needed to run and document moderation.
- Contact-form messages: until the matter is resolved, then routine mailbox retention.
- Session logs: for the lifetime of the session record.
- Backups: residual copies of deleted data may persist in database backups for a limited period before the backup cycle purges them; backups are used only for disaster recovery, never to restore deleted accounts into the live site.
Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Use the contact form and choose "Privacy / data request". We answer within a month. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or your local supervisory authority.
Age requirement
This site is for adults (18+). If the site shows an age gate, your confirmation is stored as a cookie for one year. We do not knowingly process data of minors; if you believe a minor has an account, tell us via the contact form and we will delete it.
Changes
Material changes to this policy will be indicated by the effective date above.