Privacy Policy

1. Who we are

Matchlab is provided by Bunch Bygningsfysik ApS, CVR no. 36 02 32 95, Staktoften 22A, 2950 Vedbæk, Denmark. We are the data controller for the personal data described in this policy. You can reach us at info@bunchbyg.dk.

2. What we collect

• Account data: your email address and a sign-in identifier issued by our authentication provider.
• Application data: the projects, constructions and materials you create in the app.
• Payment data: purchase records (amount, currency, status and Stripe transaction references). Your billing name, address, any VAT number and your card details are collected directly by Stripe at checkout; card details never touch our servers.
• Contact messages: the name, email address, company and message you send through the contact form.
• Technical data: IP addresses and request logs generated by our hosting provider for security and operations, and briefly for rate-limiting the contact form. We do not use analytics or tracking tools.

3. Why we process your data

We process personal data to provide the Service and handle your purchase (performance of a contract, GDPR art. 6(1)(b)), to comply with bookkeeping and tax law (legal obligation, art. 6(1)(c)), and to respond to enquiries and keep the Service secure (legitimate interest, art. 6(1)(f)). We do not sell personal data and we do not use it for third-party advertising.

4. Processors we use

• Magic (Magic Labs, Inc., USA) — passwordless email authentication; processes your email address.
• Stripe (Stripe Payments Europe, Ltd., Ireland / Stripe, Inc., USA) — payment processing, invoicing and VAT calculation. For fraud prevention and its own legal obligations, Stripe also acts as an independent data controller.
• Vercel, Inc. (USA) — hosting of the application and its server logs.
• PlanetScale, Inc. (USA) — the database where account, payment and application data are stored.
• Resend (Plus Five Five, Inc., USA) — delivery of contact-form messages to our inbox.

Where these providers process data outside the EU/EEA, the transfer is based on the EU–US Data Privacy Framework and/or the EU Commission's Standard Contractual Clauses. Calculation requests sent to our own calculation engine contain construction data only, not personal data.

5. Retention

Account and application data are kept while your account is active and are deleted or anonymised when your account is deleted, except where we must keep them longer. Payment and invoicing records are kept for the current year plus five years, as required by the Danish Bookkeeping Act. Contact messages are kept only as long as needed to handle the enquiry.

6. Your rights

Under the GDPR you can request access to, correction of, deletion of, or a copy of your personal data, ask us to restrict processing, and object to processing based on legitimate interest. Write to info@bunchbyg.dk or use the contact form to exercise your rights. You can also lodge a complaint with Datatilsynet (the Danish Data Protection Agency), www.datatilsynet.dk.

7. Cookies

The application uses strictly necessary cookies only: session cookies that keep you signed in and security cookies set as part of authentication and payment. We do not set analytics or marketing cookies, which is why the site shows no cookie consent banner.

8. Security

All traffic to the Service is encrypted (TLS), database access is restricted and credential-protected, and payment details are handled exclusively by Stripe, a PCI DSS Level 1 certified provider.

9. Changes to this policy

We may update this policy from time to time, for example if we change providers. The current version is always available on this page; material changes will be announced by email or in the application.