Privacy policy
Who is responsible
Motorbay is run by Lukas Ryborg Dreier and Simon Christensen as a partnership (interessentskab). We are the data controller for the personal data described here. Our address is in the footer of every page. Write to support@motorbay.app about anything in this policy.
What we collect, and why
Your account
When you sign up: your email address, a hash of your password (never the password itself), whether you are a private individual or a business, your language, and which version of these terms you accepted and when.
If you turn on two-step verification, we also store the secret for your authenticator app and hashes of your recovery codes.
Why: to give you an account and the service you signed up for (GDPR art. 6(1)(b), the contract).
Your API keys and requests
For each API key: its name, a hash of the key (the key itself is shown to you once and never stored), when it was created and when it expires.
For each request made with a key: the time, the method and path, the query, the status, the size and duration, and the caller's IP address and user agent. We count your requests per day to bill you and to show you your usage.
Why: to run and bill the service (the contract), and to find abuse and keep the service secure (art. 6(1)(f), our legitimate interest in a secure service).
Payment
Payment happens on Stripe's checkout page. Your card details go to Stripe, never to us. We store the IDs of your Stripe customer and subscription, your plan, and the dates of your trial and subscription. If you are a private individual and asked us to start before the withdrawal period ended, we store when you asked.
Why: the contract, and our duty to keep accounting records (art. 6(1)(c), bogføringsloven).
Withdrawals
If you withdraw from your subscription, we store your name, email address, the subscription, when you withdrew, and what was refunded.
Why: our legal duties under forbrugeraftaleloven and bogføringsloven (art. 6(1)(c)).
Emails we send you
We send you emails to confirm your address, reset your password, tell you about changes to your account or its security, and send receipts. Our server logs the address and the subject of each email it sends. We don't send marketing emails.
Why: the contract, and our legitimate interest in keeping your account secure.
Support
If you email support@motorbay.app, we keep the email and our reply.
If the support desk on your account page is turned on and you ask it a question, we store the question and the answer with your account. To write the answer, the question is sent to Anthropic (Claude), and first to a system of ours that checks it for misuse. Don't put personal data in your questions.
Why: to answer you (the contract), and to review misuse (our legitimate interest).
Cookies
The console sets only the cookies it needs to work: your session, and your choice of language. They are listed on the cookies page.
Page views
To see which pages are read, the console counts page views without cookies. For each page you open, it sends
us the page, the language, the domain of the site that linked to it (for example www.google.com, never the
full address), and we add one to that day's count. That is all we keep: a number per page, language,
referring domain and date.
We use no cookies for this and store nothing in your browser. We don't store your IP address, and nothing we keep can identify you or your device. Pages behind sign-in, and the links in our emails, are not counted.
If your browser sends Global Privacy Control or Do Not Track, nothing is sent at all.
The vehicle data
The vehicle data in the API comes from Motorstyrelsen's public statistics extract. It holds no owners, keepers or insurance details. Some permits carry a free-text comment from Motorstyrelsen that can contain a company's CVR number, and a sole trader's CVR number can identify a person. We serve those comments as they are in the public extract.
If your CVR number appears in a permit comment and you want it removed from our copy, email support@motorbay.app. We check that the number is yours, and then it is removed from the API and stays removed after every weekly update. Motorstyrelsen's own register is not affected.
Who else handles your data
We use these providers. Each processes data only on our behalf.
| Provider | What for | Where | Safeguard for data leaving the EU |
|---|---|---|---|
| Contabo | The server and databases that run Motorbay | Germany and France (EU) | Not needed: stays in the EU |
| Migadu | Sending and receiving email | France | Not needed: stays in the EU |
| Stripe | Payments | EU and the US | The EU-US Data Privacy Framework, and the EU's standard contractual clauses |
| Cloudflare | The domain's DNS, and R2 storage for nightly copies of the databases | EU for the copies; DNS is global | The EU-US Data Privacy Framework, and the EU's standard contractual clauses |
| Anthropic | Answering support desk questions, only when the desk is turned on | US | The EU's standard contractual clauses |
We don't sell your data, and we don't share it with anyone else unless the law requires it.
Each provider's data processing agreement covers the safeguard named above. Ask us for a copy.
How long we keep it
| Data | How long |
|---|---|
| Your account, keys and usage counts | Until you delete your account |
| Request logs with IP addresses | 90 days |
| Support desk questions and answers | 90 days, or until you delete your account |
| Server logs, including the email addresses we sent to | Until the log is rotated. Each service keeps its last 30 MB of log, so older lines are overwritten as new ones come in |
| Backups | 14 days |
| Withdrawal records | 5 years after the end of the financial year, as bogføringsloven requires |
| Payment records at Stripe | As long as Stripe must keep them by law |
When you delete your account, we delete it, your keys, sessions, request logs, usage and support questions at once. Copies in backups are gone within 14 days.
Your rights
You have the right to:
- see the data we hold about you. Download data, under "Download your data" on your account page, gives you a copy at once;
- have wrong data corrected;
- have your data deleted. Delete account on your account page does this at once;
- object to what we do on the basis of our legitimate interest;
- restrict what we do with your data while a question is being settled;
- get your data in a machine-readable form. The download is JSON.
Write to support@motorbay.app for anything else. We answer within a month.
You can complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk.
Changes
If we change this policy, we update this page and the date below. If a change matters for you, we tell you by email.
Last updated: 28 September 2026.