Privacy policy

Data controller

Hours (CVR: 34 97 22 81) is the controller for the processing of your personal data. Hours has not appointed a data protection officer (DPO). The privacy contact is Martin Kristensen. Contact him at msk@hours.dk with questions about how we process your data.

Collection of personal data

We collect the following categories of personal data:

• Contact information (name, email, phone number)
• Company information (company name, CVR number, industry)
• Usage data (login activity, features used, session data)
• Payment details (handled by a third party; we do not store card information)
• Contract data and supplier information you upload to the platform

Purpose of the processing

We process your personal data for the following purposes:

• Delivery and operation of the Hours platform
• Customer support and communication
• Invoicing and payment handling
• Improving the product based on usage data
• Legal compliance

The legal basis for the processing is performance of a contract (GDPR Art. 6(1)(b)) and legitimate interest (GDPR Art. 6(1)(f)).

Storage and deletion

We retain your personal data for as long as you are an active user of Hours. Upon cancellation, your data is deleted within 30 days, unless the law requires longer retention.

The database and file archive are hosted by Supabase in the EU (Frankfurt) and encrypted at rest by the provider (AES-256). The application runs on Hostinger in the EU; encryption at rest of the application server's disk is not documented, but Hours encrypts access tokens for banking, accounting and mailboxes with AES-256-GCM before storing them. All communication between your browser and Hours is encrypted in transit (TLS 1.2+). When the AI assistant Amber is enabled, document content is sent to Anthropic (USA) under Standard Contractual Clauses (SCC).

Your rights

You have the following rights under the GDPR:

• Right of access to your personal data
• Right to rectification of inaccurate information
• Right to erasure ("the right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing

To exercise your rights, contact Martin Kristensen at msk@hours.dk. You can also complain to the Danish Data Protection Agency at dt.dk.

Cookies

Hours uses necessary cookies to maintain your session and ensure the platform's functionality. We do not use third-party tracking cookies without your consent.

Hours currently uses no statistics cookies and no web analytics. If we introduce web analytics, we will ask for your consent first and update this policy. Your language choice is stored only when you click a language yourself. Without a choice the page is shown in Danish.

Connected services

You choose which services to connect to Hours, for example Google, Microsoft 365 or your accounting system. For each connection Hours receives only the access you explicitly grant on the service's own consent screen, and uses it only to provide the features you turn on. Data from connected services is not sold, not used for advertising and not used to train generalised AI models. You can disconnect any service under Settings → Integrations; Hours then stops using it and removes the access tokens.

Google (Gmail, Google Drive and Amber in Gmail)

This describes how Hours accesses, uses, stores, shares, protects and deletes data it receives from Google APIs. For Google user data this section takes precedence over any general statement elsewhere in this policy.

Data we access, and why

• Your Google email address (userinfo.email, openid): to show which Google account is connected and match it to your Hours account.
• Sending email (gmail.send): to send email from your own address when you confirm it in Hours: negotiation emails to suppliers (in the original thread, sometimes with a redacted contract attached), invitations to your team and share links. Hours never sends email you have not confirmed.
• Reading email (gmail.readonly), only after you turn on automatic import or reply finding: Hours reads the sender, subject, date, text and attachments of messages that match invoice and contract searches (for example messages with attachments and words such as invoice or contract, by default from the last 30 days) to import invoices, contracts and price notices; and it reads messages tagged with your Hours negotiation reference to find supplier replies to negotiations you started. Hours asks Google for this permission separately, at the moment you turn the feature on.
• Google Drive (drive.file): only files and folders Hours creates or that you choose in Google's picker, to store copies of your documents. Hours cannot see other files in your Drive.
• Amber in Gmail add-on (gmail.addons.execute, gmail.addons.current.message.readonly, gmail.addons.current.action.compose): only the message you have open and the parts you select, so you can ask Hours about it, and a reply draft when you press the button. The add-on never sends email.

What we store. From Gmail we store the documents you import (PDF attachments and the records created from them, such as invoices, contracts and receipts), supplier replies to your negotiations, the subject and a short excerpt of detected price notices, and a fingerprint (hash) of each imported file to avoid duplicates. We do not store the full text of other emails. Attachments you send to Amber in Gmail are stored in your Hours account.

Sharing. We share Google user data only as needed to provide the features you use:

• Supabase (database and file storage, EU) and Hostinger (application servers, EU).
• Anthropic (USA, EU Standard Contractual Clauses): analyses documents and selected email content to extract suppliers, amounts, dates and terms, and powers Amber. Anthropic does not use the data to train its models.
• Groq (USA, EU Standard Contractual Clauses): may process the text of a stored contract when you ask Hours to analyse it again.
• An AI provider you choose yourself (for example OpenAI or Google) if you connect your own API key in Amber; content is then sent to that provider under your own agreement with it.
• Notification channels you set up (Slack, Telegram or WhatsApp) receive short notices such as the supplier name and email subject.

We do not sell Google user data or transfer it for advertising, to data brokers, or for credit assessment or lending.

AI and machine learning. Google user data is used by AI only to provide the features you use. Any learning, such as remembering how your organisation classifies a supplier, is stored and used only within your own organisation and is never shared with or used for other customers. Google Workspace data is not used to develop, improve or train generalised or non-personalised AI or machine learning models, by Hours or by our providers.

How we protect it. All traffic is encrypted with TLS. Google access and refresh tokens are encrypted by Hours with AES-256-GCM before they are stored, in a database that is also encrypted at rest. Access is restricted to the server functions that provide the features, and every record is scoped to your organisation and user. Backups are encrypted.

Storage and deletion

• Disconnect: when you disconnect Gmail or Google Drive in Hours (Settings → Integrations), we ask Google to revoke Hours' access, delete the stored tokens and remove the stored Gmail address. If Google does not confirm the revocation, Hours tells you, and you can remove access at myaccount.google.com/permissions.
• Imported data: documents and records you imported stay in your Hours account until you delete them or your account. There is no automatic expiry.
• Account deletion: after a 30-day grace period we delete your account, revoke Hours' Google access and delete Google-derived data, including Amber attachments, negotiation emails and file fingerprints. Accounting records that Danish bookkeeping law requires us to keep (invoices, receipts and contracts registered as vouchers) are kept for 5 years, anonymised and separated from your identity, and then deleted.
• Backups: encrypted nightly backups are kept for up to 30 days and then deleted.
• Requests: you can ask us to delete Google-derived data at any time by writing to kontakt@hours.dk.

Limited Use. Hours' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to how we use Google data

Clarified on October 2, 2026.

Before we use your Google data in a new way or for a purpose other than what was previously disclosed to and accepted by you, we update this policy, notify you in Hours or by email, and ask for your affirmative consent to the changed processing. The notice explains the affected data and features, the purpose and any new recipients, and links to the updated policy.

The new processing may only begin after you give consent. If you decline or do not respond, we do not use your Google data for the new processing. You can still disconnect under Settings → Integrations. Continued use of Hours, an updated date or an existing Google permission does not by itself constitute consent to a new purpose. If the feature requires additional Google permissions, we also request them on Google's consent screen.

Other services

• Microsoft Outlook, OneDrive and SharePoint (Microsoft Graph): email and attachments to import invoices and contracts, sending negotiation emails you confirm, and files in the folders or libraries you choose to store copies of your documents. Amber in Outlook only reads the email you have open and the parts you select.
• Slack: files and messages in channels the Hours bot is invited to, to import shared invoices and contracts, and notifications from Hours.
• Dropbox: files in the Hours folder or the folder you choose, to store copies of your documents.
• Telegram and WhatsApp: documents and messages you send to Hours yourself, so Amber can analyse them. Groups are kept separate per company.
• e-conomic, Dinero, Billy, Uniconta and Business Central: suppliers, invoices, vouchers and entries from your accounting system, so Hours can show and reconcile them.
• Booking form on hours.dk (Web3Forms): when you book a walkthrough, your name, email, company, message and chosen time are sent through the form service Web3Forms, which forwards the request to Hours. We use the data to reply to you. The location of the service and the agreement with it are being verified.
• Stripe Financial Connections: where the feature is enabled, Hours can retrieve the account, balance and transaction data you approve through Stripe and your bank, so Hours can show liquidity and reconcile bank movements with invoices and expenses. The connection is read-only, is not used for credit assessment and can be disconnected again. See the document Financial Connections & Open Banking under Documents on docs.hours.dk, where it can be downloaded (Danish).
• Enable Banking (open banking): with your explicit consent you can share account, balance and transaction data with Hours for bank reconciliation and financial overview. Enable Banking handles bank access under its own AISP authorisation, while Hours is responsible for the subsequent use and storage. Consent expires under your bank's rules and can be withdrawn at any time. See the document Financial Connections & Open Banking under Documents on docs.hours.dk, where it can be downloaded (Danish).

To request deletion of data from a connected service, write to kontakt@hours.dk. We complete it without undue delay and within 30 days.

Contact

If you have questions about our privacy policy, feel free to contact us:

Hours v/ Martin Kristensen, sole proprietorship, CVR no. 34 97 22 81
Privacy contact: Martin Kristensen, msk@hours.dk
Other enquiries: kontakt@hours.dk