Privacy policy
Last updated: 6 November 2026
Here you can read what information we process when you use LovAPI, why, and how long we keep it.
The data controller is Alkvantor Intelligence ApS, CVR 45021467 (see the company in the Danish business register). Send questions about your information to support@lovapi.dk.
What we process and why
Your account
When you log in, we process your email address, a user ID and the times you log in. With the account we store your plans, the names of your API keys, when they were created, and the first characters of each key, so you can tell them apart. We do not store the keys themselves, only a cryptographic hash, which we use to check them.
The purpose is to provide the service to you. The basis is our agreement with you.
Payment
If you buy a paid plan, payment goes through Stripe. Stripe processes your name, your email, your address, your CVR or VAT number if you give it, and your card details. We never see your card number. On our side we store your customer ID at Stripe, and we can see your subscriptions and invoices.
The basis is the agreement with you and our duty to keep accounting records. Stripe is itself data controller for part of the processing, for example fraud prevention. You can read about it in Stripe's privacy policy.
Use of the API
To enforce the plans' usage limits, we count how many requests each account uses per minute and per day. The numbers are tied to an account ID, not to your email.
Our server logs each request with the IP address, the time, the requested address, the status of the response and the software that sent the request. The requested address contains your search text when you search. We use the log for operations, troubleshooting and to detect misuse and hacking attacks. The basis is our legitimate interest in running a secure and stable service.
We do not use the content of your requests for anything other than answering them and the purposes mentioned here.
Visitor statistics
We use Umami to count visits to lovapi.dk. Umami uses no cookies. Instead, an anonymous ID is calculated from your IP address and your browser, and it changes every month, so we cannot recognise you over time or across sites. The IP address itself is not stored. If you have turned on Do Not Track in your browser, your visit is not counted. The basis is our legitimate interest in knowing which pages are used.
Enquiries
If you write to us, we process your email and what you write, so we can answer you.
Where your information is stored
We use these providers, who process information on our behalf:
- Google (Firebase) for log in, account data and the account page. Account data is stored in the EU (Belgium). Firebase Authentication, which handles log in, may process the information in the USA.
- Hetzner Online for the API, with servers located in Germany.
- Stripe for handling payment.
- Umami for visitor statistics on lovapi.dk, with data stored in the EU.
If information is transferred from these providers to the USA, this happens on the basis of the EU-U.S. Data Privacy Framework, under which Google and Stripe are certified, or the European Commission's standard contractual clauses.
We do not sell your information, and we do not share your information with others unless the law requires it.
How long we keep data
- Account: until you ask us to delete the account.
- Invoices and payments: for 5 years after the end of the financial year they belong to, as the Danish Bookkeeping Act (bogføringsloven) requires. This also applies after the account is deleted.
- The server log: no more than 30 days.
- Number of requests: kept as usage history. Once the account is deleted, the numbers can no longer be linked to you.
- Visitor statistics: 6 months, after which they are deleted.
- Enquiries: for as long as the matter requires.
Cookies and local storage
We use no cookies for statistics or marketing. The visitor statistics work without cookies and without storing anything in your browser. The account page stores in your browser that you are logged in, and while you log in, the email you typed. This is necessary for log in to work and therefore does not require consent.
The pages load fonts from Google Fonts. Your browser therefore sends your IP address to Google when you open them.
Your rights
You have the right to access the information we process about you, and to have it corrected or deleted. You may also have the right to have the processing restricted, to object to it and to receive your information in a common format. Write to support@lovapi.dk, and we will answer within a month.
You can complain about our processing to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk.
Changes
We update the policy when we change how we process information. The date at the top shows when it was last changed. You are told about material changes by email.