Last updated 12 October 2026
This is a translation of our Danish privacy policy. If the two differ, the Danish version applies.
In short
- No cookies, no analytics and no ads on duckert.design.
- We only store what you give us, for example when you use the contact form or become a customer.
- Our database is in the EU.
- We never sell your data or share it for marketing.
- You can always see, correct or have your data deleted.
Who is responsible for your data
Duckert Design is the data controller for the information described here. If you have questions or want to use your rights, write to us using the contact form.
When you visit duckert.design
The site sets no cookies and stores nothing in your browser. We don't use Google Analytics or any other analytics tools, and we don't load fonts or scripts from other companies. Everything comes from our own server.
The site runs on Cloudflare. As with any website, Cloudflare receives your IP address and information about your browser when you visit. This is needed to show the site and protect it against attacks.
When you send the contact form, chat with Ducki or use the customer portal and the payment page, we keep technical logs so we can find and fix errors. The logs can contain your IP address and browser type, and they are deleted automatically after at most 7 days.
When you use the contact form
We store what you write in the form:
- Name and e-mail
- Phone and company, if you give them
- The package you chose and your message
We only use it to reply to you and to make you a quote if you want one. The message is stored in our inbox in our database in the EU. We keep it as long as it is relevant to our conversation with you, and you can always ask us to delete it.
Legal basis: replying to your enquiry and preparing a possible agreement (GDPR Art. 6(1)(b) and (f)).
When we e-mail each other
When you write to hej@duckert.design, or we write to you, the e-mail goes through AhaSend, an Austrian e-mail service that processes data in the EU/EEA.
- We store the e-mail (sender, recipient, subject and content) in our inbox in our database in the EU. It stays there as long as it is relevant to our conversation with you, and you can always ask us to delete it.
- For e-mails we send, we ask AhaSend to delete the content after at most 1 day and the sending details (recipient, time and status) after at most 30 days.
- How long AhaSend keeps e-mails you send to us follows AhaSend's own policy.
- We don't track our e-mails. We can't see whether you open them or click links in them.
Legal basis: replying to you and fulfilling an agreement with you (GDPR Art. 6(1)(b) and (f)).
When you chat with Ducki
Ducki is an AI assistant. Your messages are sent to Cloudflare Workers AI, which writes the reply. The language model runs at Cloudflare, and we don't store the conversation. It is neither in our database nor in your browser, and it is gone when you close the page.
To prevent abuse, each visitor can send at most 12 messages a minute. For this we use your IP address for about a minute, and it is not stored afterwards.
Please don't write sensitive information in the chat. If you need help with something personal, use the contact form instead.
When you pay (betal.duckert.design)
Payments are handled by Stripe. Your card details go straight from your browser to Stripe and never reach our servers. We never see your card number.
Stripe receives your name, e-mail, address and payment details. Stripe sets its own cookies on the payment page to prevent fraud.
We store what you ordered and paid, when you opened the payment link and when you accepted the terms. We keep payment records for 5 years after the end of the financial year, as the Danish Bookkeeping Act requires.
Legal basis: fulfilling the agreement with you and complying with the Danish Bookkeeping Act (GDPR Art. 6(1)(b) and (c)).
When you are a customer (mit.duckert.design)
If you are a customer, we store the information we need to help you and send invoices:
- Name, e-mail, phone, company, CVR number, address and your website address
- Your subscriptions and payments
- Our own notes about your project
- The support cases you open and our messages to and from you
- When and with which browser you logged in, so you can see your active devices
If you are a business customer, we fetch your company's name, address and public contact details from the Danish Central Business Register (CVR) through the service cvrapi.dk when we create your account. We only send the CVR number there.
Your password is stored with one-way hashing, so not even we can read it. If you use a passkey, we only store the public key. The secret part stays on your device.
We keep your information while you are a customer and delete it when we stop working together. Payment records, however, are kept for 5 years after the end of the financial year, as the Danish Bookkeeping Act requires.
Legal basis: fulfilling the agreement with you and complying with the Danish Bookkeeping Act (GDPR Art. 6(1)(b) and (c)).
Cookies
We only use cookies that are needed for things to work. That's why we don't ask for consent and you see no cookie banner.
| Where | Cookie | Why and for how long |
|---|---|---|
| duckert.design | None | The site sets no cookies. |
| mit.duckert.design | __Host-dd_session | Keeps you logged in to the customer portal. Lasts 14 days or until you log out. |
| mit.duckert.design | __Host-dd_challenge | Only used while you log in with a passkey. Lasts 5 minutes. |
| betal.duckert.design | Stripe's cookies | Used by Stripe to complete the payment securely and prevent fraud. Read more in Stripe's privacy policy. |
Who we share with
We never sell your data. We only share it with the companies we need to run our services, and they may only use it to help us.
| Company | What they do | Where |
|---|---|---|
| Cloudflare | Hosting of our sites, database, Ducki and technical logs | The database is in the EU. Cloudflare is a US company certified under the EU-US Data Privacy Framework. |
| Stripe | Payments, receipts and subscriptions | Stripe Payments Europe in Ireland. Data may also be processed in the US under the EU's transfer rules. |
| AhaSend (TakTek GmbH) | Receives e-mails to hej@duckert.design and sends our e-mails | Vienna, Austria. Data is processed in the EU/EEA. |
Security
All our sites use an encrypted connection (HTTPS). Passwords are stored as hashes, and payment links can't be guessed. Only Duckert Design has access to the customer portal's administration.
Your rights
You have the right to:
- know what we have stored about you and get a copy
- have incorrect information corrected
- have your information deleted when the law no longer requires us to keep it
- restrict or object to our use of it
- receive your information in a common format so you can take it with you
Write to us using the contact form, and we will reply within one month at the latest.
If you are unhappy with how we handle your data, you can complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.
Changes
If we change how we handle data, we will update this page and the date at the top.