Duckweeds AI

Duckweed Privacy Policy

Last updated: April 2026

1. Introduction

Duckweed ApS ("Duckweed," "we," "us," or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the Duckweed platform ("Platform") at duckweed.dk.

This policy is written in accordance with Regulation (EU) 2016/679 ("GDPR") and the Danish Data Protection Act (databeskyttelsesloven). Please read it carefully.

2. Data Controller

The data controller responsible for your personal data is:

Duckweed ApS [Registered address] CVR-nr: [Your CVR number] Email: privacy@duckweed.dk Website: duckweed.dk

If you have any questions about how we handle your data, contact us at the above address.

3. What Data We Collect

We collect the following categories of personal data:

3.1 Account Data When you register on the Platform, we collect your name, business name, email address, phone number, billing address, and payment information. Payment details are processed securely through our third-party payment provider and are never stored directly on our servers.

3.2 Business and Website Data To deliver the Service, we collect your business website URL, brand assets, product and service information, and any other content you provide or that we derive from crawling your website for the purpose of generating ad copy and visuals.

3.3 Advertising Performance Data We collect data relating to the performance of advertising campaigns managed on your behalf, including impressions, clicks, conversions, spend, and audience interaction data retrieved from connected Ad Platforms (Google Ads, Meta, LinkedIn, and others).

3.4 Usage Data We collect data about how you interact with the Platform, including pages visited, features used, session duration, device type, browser type, IP address, and referring URLs.

3.5 Communication Data If you contact us by email, chat, or through the Platform, we retain records of that correspondence.

3.6 Cookie Data We use cookies and similar tracking technologies as described in Section 10 of this Policy.

4. Legal Basis for Processing

We process your personal data on the following legal grounds under GDPR Article 6:

Performance of a contract (Article 6(1)(b)) — Processing your account data, business data, and advertising performance data is necessary to deliver the Service you have subscribed to.

Legal obligation (Article 6(1)(c)) — We process certain data to comply with Danish accounting law (bogføringsloven), VAT obligations, and other applicable legal requirements.

Legitimate interests (Article 6(1)(f)) — We process usage data and aggregated performance data to improve the Platform, prevent fraud, and ensure platform security. We have assessed that these interests are not overridden by your rights and freedoms.

Consent (Article 6(1)(a)) — Where we send you marketing communications or use non-essential cookies, we do so on the basis of your explicit consent, which you may withdraw at any time.

5. How We Use Your Data

We use your personal data for the following purposes:

To create and manage your Duckweed account
To generate, launch, and optimise advertising campaigns on your behalf
To process subscription payments and issue invoices
To communicate with you about your account, campaigns, and service updates
To provide customer support
To improve and develop the Platform using anonymised and aggregated data
To comply with our legal and regulatory obligations
To detect, prevent, and investigate fraud or misuse of the Platform
To send you marketing communications where you have consented

6. Data Sharing and Third Parties

Duckweed does not sell your personal data. We share your data only in the following circumstances:

6.1 Ad Platforms To deliver the Service, we connect to and share relevant campaign data with third-party Ad Platforms including Google Ads, Meta, and LinkedIn. Each platform operates under its own privacy policy and data processing terms. By using the Platform, you acknowledge this data transfer is necessary for delivering the Service.

6.2 Payment Processors Payment data is handled by our third-party payment processor. We share only the data necessary to process your subscription.

6.3 Service Providers We work with trusted third-party service providers for hosting, analytics, customer support, and email delivery. These providers act as data processors under GDPR and are bound by Data Processing Agreements with Duckweed.

6.4 Legal Requirements We may disclose your data to public authorities, courts, or law enforcement where required by Danish or EU law.

6.5 Business Transfers In the event of a merger, acquisition, or sale of Duckweed ApS, your data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and of any changes to this Policy.

7. International Data Transfers

Some of our third-party service providers and Ad Platforms are located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on the recipient's participation in an approved adequacy framework. Details of these transfers are available upon request at privacy@duckweed.dk.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy:

Account data — retained for the duration of your subscription and for 5 years thereafter in accordance with Danish accounting obligations
Advertising performance data — retained for 3 years following the end of your subscription to allow for historical reporting and dispute resolution
Usage data — retained for 12 months on a rolling basis
Communication data — retained for 2 years from the date of last correspondence
Invoice and billing records — retained for 5 years as required by Danish bookkeeping law (bogføringsloven)

When data is no longer required, it is securely deleted or anonymised.

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right of access (Article 15) — You may request a copy of the personal data we hold about you.

Right to rectification (Article 16) — You may request correction of inaccurate or incomplete data.

Right to erasure (Article 17) — You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to our legal retention obligations.

Right to restriction of processing (Article 18) — You may request that we limit how we process your data in certain circumstances.

Right to data portability (Article 20) — You may request a copy of your data in a structured, commonly used, machine-readable format.

Right to object (Article 21) — You may object to processing based on legitimate interests, including profiling.

Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@duckweed.dk. We will respond within 30 days. We may need to verify your identity before processing your request.

10. Cookies

Duckweed uses cookies and similar technologies to operate the Platform and improve your experience. We use the following categories of cookies:

Strictly necessary cookies — Required for the Platform to function. These cannot be disabled.

Analytical cookies — Used to understand how users interact with the Platform. We use anonymised data only. These require your consent.

Marketing cookies — Used to measure the effectiveness of our own marketing campaigns. These require your consent.

You can manage your cookie preferences at any time through the cookie banner on our website or by adjusting your browser settings. Note that disabling certain cookies may affect Platform functionality.

11. Data Security

Duckweed implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include encrypted data transmission (TLS), access controls, regular security assessments, and staff training. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Danish Data Protection Authority (Datatilsynet) within 72 hours and affected users without undue delay, as required by GDPR Article 33 and 34.

12. Children's Data

The Platform is intended for business use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@duckweed.dk and we will delete it promptly.

13. Complaints

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Danish Data Protection Authority:

Datatilsynet Carl Jacobsens Vej 35 2500 Valby, Denmark dt@datatilsynet.dk www.datatilsynet.dk

We would, however, appreciate the opportunity to address your concerns directly before you contact Datatilsynet. Please reach out to us at privacy@duckweed.dk first.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or through a prominent notice on the Platform at least 14 days before the changes take effect. The "Last updated" date at the top of this Policy reflects the most recent revision. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.