Short version: we only email people who ask us to, we never sell or share your address, and you can leave with one click. The chatbot keeps as little as it can and deletes files after 60 days. The details below are the full story.
Who we are
Hej Danmark is an independent, community-run news digest for the international community in Denmark, published at hejdanmark.dk.
The data controller for the newsletter is Hej Danmark, based in Copenhagen, Denmark. For any privacy question you can reach us at hej@hejdanmark.dk.
What we collect, and why
When you subscribe to our newsletter, we collect:
- Your email address — so we can send you the newsletter.
- Your chosen frequency (daily or weekly) — so we send at the pace you picked.
- The date, time and confirmation of your sign-up — our record that you gave consent.
That is all. We do not ask for your name, and we do not build a profile of you. The legal basis for sending you email is your consent (GDPR Article 6(1)(a)), which you give by subscribing and confirming.
Double opt-in
After you enter your address, we send a confirmation email. You are only added to the list once you click the link in it. If you never confirm, your address is discarded. This protects you from being signed up by someone else, and it is our proof that the consent was real.
Who processes your data
We send the newsletter through MailerLite (MailerLite UAB, an EU-based email provider), which stores and processes subscriber data on our behalf as our data processor under a Data Processing Agreement (DPA). Where MailerLite transfers data outside the EU/EEA, it does so under the safeguards required by GDPR (such as Standard Contractual Clauses). We do not pass your address to anyone else, and we never sell it.
How long we keep it
We keep your email address for as long as you stay subscribed. When you unsubscribe, you are removed from the active list. We keep a minimal record of the fact that you once consented and then withdrew, only as long as needed to honour your choice and to meet our legal obligations.
Your rights
Under the GDPR you can, at any time, ask us to:
- see what data we hold about you (access);
- correct it (rectification);
- delete it (erasure);
- restrict or object to how we use it;
- receive a copy in a portable format;
- withdraw your consent — withdrawing it does not affect emails already sent.
To exercise any of these, email us at hej@hejdanmark.dk. If you believe we have mishandled your data, you can complain to the Danish Data Protection Agency, Datatilsynet (Carl Jacobsens Vej 35, 2500 Valby, Denmark).
How to unsubscribe
Every newsletter has a one-click unsubscribe link at the bottom. It takes effect immediately. You can also email hej@hejdanmark.dk and we will remove you.
The chatbot (Ask Hej Danmark)
At hejdanmark.dk/chat/ you can ask questions about living in Denmark. This section covers only the chatbot. For the chatbot, the data controller is Aspen Studio, which runs Hej Danmark. You reach us at the same address: hej@hejdanmark.dk.
What we collect
- Your questions and our answers. Before a question is stored or sent to the services that classify it, the server replaces CPR numbers, email addresses, phone numbers and passport or MitID numbers with placeholders such as [CPR]. Names are not removed automatically, so please leave them out.
- Files you attach (photos or PDFs of letters, contracts, payslips). An AI model reads the file and writes a short summary, which is masked the same way. The file itself is kept for 60 days and then deleted automatically.
- Your account. You sign in with Google or an emailed link through Google Firebase Authentication, which holds your email address. Our own chat records hold only the account id Firebase gives us, your plan and how many questions you have used. They do not hold your email.
- Payment. Subscriptions are paid through Stripe. We never see your card number; we keep only Stripe's customer and subscription ids so we know you have subscribed.
Legal basis: to provide the service you sign up for (GDPR Article 6(1)(b)). Questions about residence permits can reveal your nationality or immigration situation, so please share only what the question needs. Never upload documents you are not allowed to share.
Who processes it for us
| Processor | What for | Agreement |
|---|---|---|
| Cloudflare | Runs the chatbot server, stores conversations and files, and logs requests to the AI models (AI Gateway) for 60 days | Customer DPA |
| OpenAI | Writes the answers, reads attached files, checks messages for abuse. Under its API terms it does not train on this data. | Data Processing Addendum |
| TypeSafe | Sorts each (masked) question by topic and flags off-topic or abusive messages. It never receives your files. | Terms and DPA |
| Google Firebase | Sign-in (Firebase Authentication) | Data Processing Terms |
| Stripe | Subscription payments | Data Processing Agreement |
Some of these companies process data outside the EU/EEA. Where they do, they rely on the safeguards GDPR requires, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
| Data | Kept for |
|---|---|
| Request logs of the AI models (Cloudflare AI Gateway) | 60 days, then deleted automatically |
| Photos and PDFs you attach | 60 days, then deleted automatically |
| Your conversations (masked) | 60 days after your last message in that conversation, or until you delete them |
| Masked questions without any account id, used to improve the answers | No fixed limit; they no longer identify you |
| Your account (Firebase) and plan record | Until you delete your account |
| Payment and invoice records (Stripe) | 5 years, as the Danish Bookkeeping Act requires |
Your rights in the chatbot
The account menu (top right, once you are signed in) has three buttons: Delete all conversations, Delete account (which also deletes your files, cancels your subscription and removes your sign-in), and Manage subscription. Request logs at Cloudflare AI Gateway cannot be deleted one person at a time; they expire after 60 days. For a copy of your data or anything else in the rights list above, email hej@hejdanmark.dk.
AI disclosure
Answers are written by AI from official pages and published Hej Danmark articles, with links so you can check them. They are general information, not legal, tax or financial advice. See the terms of use.
Cookies & the website
The website sets no tracking or advertising cookies. We load fonts from Google Fonts, which means Google receives your IP address to serve them. For traffic statistics we use Cloudflare Web Analytics, a privacy-friendly, cookieless tool: it measures visits in aggregate, sets no cookies, and does not track you across sites or build a profile of you. If you sign in to the chatbot, Firebase keeps your sign-in in your browser’s storage; that is needed for the service and is not used for tracking.
Changes to this policy
If we change how we handle your data, we will update this page and change the “last updated” date above. Material changes affecting the newsletter will be noted in the newsletter itself.