Legal
Privacy Policy
Last updated: 10 August 2026
Draft — pending legal review
- This page is a working draft prepared ahead of launch. It has not yet been reviewed by qualified legal counsel and should not be relied on as legal advice or a final compliance statement.
This policy explains what personal data Sanctora collects when you use this website or submit the discovery-call form, why we collect it, and what rights you have over it.
1. Who controls your data
The data controller is Sanctora. Full corporate identification details are published on our Legal Notice page. For any privacy question, contact hello@sanctora.ai.
2. What we collect
When you submit the discovery-call form: full name, work e-mail, company name, phone number, company size, the area you need help with, your intended timeline, and the free-text project brief you provide.
When you set cookie preferences: a single consent record (which categories you accepted, and when) — see our Cookie Policy for details.
Standard hosting logs collected by our infrastructure provider (IP address, user agent, timestamp) for security and abuse prevention.
3. Why we process it (legal basis)
Form data is processed under Art. 6(1)(b) GDPR — to take steps at your request prior to entering into a contract, and to respond to your enquiry.
The strictly-necessary cookie-consent record is processed under Art. 6(1)(f) GDPR (our legitimate interest in recording your choice, and our obligation to honour it).
Any optional analytics or marketing cookies are processed only under Art. 6(1)(a) GDPR (your explicit, opt-in consent) — see the Cookie Policy.
4. Who else sees it
We use the following processors, each bound by a data processing agreement:
- Resend — delivers the discovery-call form submission to our inbox by e-mail.
- Vercel — hosts this website and processes standard connection/server logs.
[Draft note: confirm the final sub-processor list and, wherever data may leave the EU/EEA, the transfer safeguard relied on (e.g. Standard Contractual Clauses) before launch.]
5. How long we keep it
[Draft: exact retention period to be confirmed before launch — e.g. form submissions are deleted or anonymised no later than 24 months after your last contact with us, unless a longer period is required to establish, exercise, or defend legal claims.]
6. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, or port your data, and to object to our processing of it. To exercise any of these rights, contact us at hello@sanctora.ai.
You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk) or your local supervisory authority.
7. Changes to this policy
We may update this policy as the site and our processing activities evolve. Material changes will be reflected on this page with a new "last updated" date.