Privacy policy

I use Google Analytics to see how many people visit the site and which pages are read. It helps me improve the content. No advertising is shown on the site.

Google Analytics and PostHog load only after you actively say yes in the cookie banner, either with “Accept” or under “Let me choose”. Until then no cookies are set and no data is sent to Google or PostHog. If you click “No thanks”, nothing happens — and you will not be asked again for a month.

The website uses Google Consent Mode v2. Nothing is sent to Google until you say yes to analytics. After that, consent is given for analytics only (analytics_storage), while ad_storage, ad_user_data and ad_personalization are always denied. If you withdraw your yes, analytics is denied as well.

I advertise on Google. If you have accepted statistics and send the contact form, Google Ads is told that a form was sent, so I can see whether the ads lead to enquiries. Because ad_storage is denied, no advertising cookies are set, and Google only receives a signal without cookies. It is used to count enquiries, not to show you ads.

Google Analytics 4 uses your IP address to determine your approximate country and city and does not store the address itself. The data processor is Google Ireland Limited, and data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, which the transfer relies on.

I also use PostHog. Under “Let me choose” you can say yes to two things separately: Analytics (which pages are read, what is clicked, where you came from and errors the page runs into in your browser) and Recording of visits (a replay of the page as you saw it, with mouse movements, clicks and scrolling, so I can see where the site gets in the way). “Accept” means yes to both, “No thanks” means no to both.

What you type into fields is never included in a recording, and forms are not shown at all. PostHog never loads on the Manniche UI Pro login, account and order pages. I do not link your name or email to data in PostHog and build no profile of you. If your browser has “Do Not Track” or “Global Privacy Control” turned on, PostHog does not load.

The program itself is hosted on my own server, so no code is fetched from PostHog. Your browser sends data directly to PostHog’s server in the EU (Frankfurt). The server sees your IP address, but PostHog is set not to store it. The browser stores a random ID and your choice in localStorage (keys starting with ph_) and in sessionStorage. The data processor is PostHog Inc. in the USA. Data is stored in the EU, but PostHog may access it from the USA. This is covered by the European Commission’s standard contractual clauses in PostHog’s data processing agreement. Recordings are deleted after at most 30 days and other data after at most one year.

Regardless of your choice, the site counts visits without cookies. For each page view your browser sends only the page address, and whether it is the first page of the visit, to my own server (admin.mikkelmanniche.dk at Simply.com). Only a total per day and per page is stored — no IP address, no ID and nothing about your browser — so the numbers cannot be traced back to you. The server sees your IP address, as with any visit on the web, but the count does not store it.

The same cookie-free measurement also counts open tabs in real time, so I can see how many people are on the site right now. For this the page uses a temporary random ID that exists only in the browser’s memory while the page is open. It is not stored on your device (neither in cookies nor in storage) and is sent along with a small signal every 30 seconds, for 30 minutes at most, and one last time when you close or leave the page. It therefore needs no consent and cannot be traced back to you.

If you have accepted statistics, the count also links the pages of your visit together, so I can see which way visitors go before they get in touch or place an order. Your browser stores a random visit ID and where you came from in sessionStorage. It disappears when you close the tab, and a new one is used after 30 minutes without activity. Together with the ID, the site sends the pages you view during the visit, where you came from (the referring site or a campaign code), your time zone and language, and whether you send the contact form, pay, or click a link to email, phone or meeting booking. The server reads the device type and browser from your browser’s name (user agent) and does not store your IP address. Visits are stored on my own server and deleted after 90 days. If you withdraw your consent, the ID is deleted from your browser immediately.

To change your mind, press Cookie settings at the bottom of the page. If you withdraw a yes, analytics cookies are deleted straight away. If you say no to both, PostHog stops and what it has stored in your browser is deleted.

Mikkel Manniche Rolighed, Heßstraße 74, 80798 München, Germany · +45 25 77 66 17 · kontakt@mikkelmanniche.dk. You are always welcome to write if you have questions about your data.

• Your name
• Your email address
• Your message
• The time of the enquiry
• Your IP address

The IP address is stored solely to trace and stop misuse of the form, such as automated spam.

When you start filling in the contact form or the cancellation form, the site sets a strictly necessary session cookie (PHPSESSID), which is only used to stop spam and is deleted when you close your browser; it needs no consent (§ 25(2) no. 2 TDDDG).

Solely to read and answer your enquiry. The information is not used for marketing, is not sold and is not shared with anyone else.

• Analytics, recording of visits and cookies: your consent (GDPR Art. 6(1)(a) and Section 25(1) of the German TDDDG). You can withdraw it at any time under Cookie settings.
• Contact form: answering your enquiry and possibly entering a contract (Art. 6(1)(b)) and my legitimate interest in replying and stopping spam (Art. 6(1)(f)).
• Payment and invoice: the contract with you (Art. 6(1)(b)) and my legal duty to keep accounting records (Art. 6(1)(c)).
• Manniche UI Pro and your account: the contract with you (Art. 6(1)(b)) and my legitimate interest in a secure account and in stopping misuse (Art. 6(1)(f)).
• Cookieless visit counting: my legitimate interest in knowing which pages are read (Art. 6(1)(f)). Nothing about you is stored.
• Contacting your business: my legitimate interest in offering my services (Art. 6(1)(f)).
• Emails after you agree on the phone: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Your message is sent to my mailbox and stored in a file on the web server at the same time, so an enquiry is not lost if the email should fail. The file cannot be reached from the internet. Both mail and website are hosted by Simply.com A/S, who therefore act as data processor.

I keep enquiries for as long as they are relevant to our conversation, and clear them out regularly. If you want your data deleted right away, just write to me.

I phone small Danish limited companies that could use a new website, to offer them my services. The legal basis is my legitimate interest in marketing my services to businesses (GDPR Art. 6(1)(f)).

You can always say no. If you say no thanks on the phone, or reply “stop” to an email, I will not call or write again. You have the right to object to marketing (GDPR Art. 21), and you do not have to give a reason.

The details come from publicly available sources:

• The Danish Business Authority’s business register (CVR), directly and via cvrapi.dk: company number, name, address, phone number, email address, website, legal form, industry, date of incorporation, number of employees, the name of the owner or director, and whether the business or its production units have opted out of advertising.
• Annual reports filed with the Danish Business Authority: key figures such as gross profit, profit and equity.
• The business’s own website: a shared email address such as info@, whether there is a contact form, and links to social media. I also measure the site’s speed, security and age with Google PageSpeed, Mozilla Observatory and the Internet Archive. They only receive the web address.
• Tavily (AlphaAI Technologies Inc., USA): if I cannot find the business’s website any other way, I search for it there. Tavily only receives the company name and town, and never a company name that looks like a person’s name.
• Meta’s Ad Library and Google’s Ads Transparency Center: whether the business advertises. I check this myself and note it with the date.
• OpenStreetMap: the business’s name, address, phone number and website.
• The domain register (WHOIS): the name, address, phone number and email address of whoever registered the business’s domain, if they are public.

I add my notes from the call. If you agree to an email, I also keep your name, your email address and the emails we exchange.

I only phone limited companies, such as ApS and A/S, that have not opted out of advertising in the CVR. I do not phone sole traders. No more than 7 days before I call, I check the CVR again to make sure that neither the business nor its production units have opted out of advertising in the meantime. On the first call I tell you where I got your number and that you can say no to further calls.

I only send emails if you have agreed to it on the phone (your consent, GDPR Art. 6(1)(a)). If you agree, I record as proof who agreed and in what role, when, which number I called, which email address you gave, and what you agreed to. You can withdraw your agreement at any time, for example by replying “stop” to an email. I then record that with the date, and you will receive no more emails.

If I have looked up the name of the owner or director but have not contacted the business within 28 days, I delete the name. If we do not agree on anything, I delete the details no later than 6 months after our last contact, or after I found the business if I never called. If you have said no, the business’s name, phone number and email address go on my do-not-contact list together with the date, so I do not contact you again. I keep that list for as long as I contact businesses. I delete the rest no later than 6 months after your no. If you become a customer, When you pay online applies.

Before a call, I may ask Google Gemini for suggestions on what to talk about. Gemini receives details from the CVR and the annual report (industry, town, age, number of employees and key figures) and text from the business’s website. Names, phone numbers, email addresses, web addresses and the company name are hidden before the text is sent. The data processor is Google Ireland Limited under Google’s EU data processing terms, and Google does not use the content to improve its products. The legal basis is my legitimate interest in preparing the call (GDPR Art. 6(1)(f)).

The details are kept in my own customer system. The database is hosted by Supabase in Frankfurt, the system itself runs at Vercel Inc. in the United States, and emails are sent and received through Simply.com A/S. All three process the data on my behalf. The transfer to the United States is based on the European Commission’s Standard Contractual Clauses; write to me if you would like a copy. No automated decisions are made about you.

When I write a reply to your email, I may get a draft from Google Gemini. Gemini then receives our email thread without quotes and signatures, plus the industry and town. A filter hides names, email addresses, phone numbers, web addresses and the company name before the thread is sent. The data processor is Google Ireland Limited under Google’s EU data processing terms, and Google does not use the content to improve its products. I always read and edit the draft myself, and nothing is sent automatically. The legal basis is my legitimate interest in being able to reply quickly (GDPR Art. 6(1)(f)).

If you pay for a package or a deposit, the payment is handled by Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe receives your name, email, address and phone number, your card details and, if given, your company name and VAT number. I never see your card details. I receive your name, contact details and the amount, because I need them to deliver the work and issue an invoice. Accounting records are kept for as long as German law requires (§ 147 AO), up to 10 years.

After paying, you are sent to a thank-you page. If you have accepted analytics, my own measurement counts there that the visit ended in an order. This shows me which channels — such as Google or Instagram — lead to an order. If you declined, no link is made.

If you buy a Manniche UI Pro licence, the payment goes through Stripe as described above. I then create an account for you so you can get the code. The legal basis is the contract with you (GDPR Art. 6(1)(b)), and for keeping the account secure and stopping misuse, my legitimate interest (Art. 6(1)(f)).

What is stored:

• Account: your email address and a value derived from it (HMAC), so I can find you without the address appearing in logs.
• Licence: a licence number, its status (active, refunded, chargeback) and the payment references at Stripe. The licence number is a watermark in the code you download.
• Keys: the name you give a key, its last 4 characters, and when it was created, rotated, last used or blocked. The key itself is only stored as a hash (SHA-256).
• Login links: only as a hash. A link works once, for 15 minutes (24 hours in the welcome email), and is deleted a day after it expires.
• Sessions: only as a hash, for 30 days or until you log out.
• Stopping misuse: hourly counters for login attempts and downloads. They hold a hash of your IP address the derived value of your email address or your licence number and are deleted after a day.
• Download log: each time Pro code is fetched with a key or from the account, I store the time, licence number, component, result and a hash of the IP address. The hash uses a value that is created anew each day and the old one normally thrown away, so after that day it can no longer be traced back to your IP address. The log is deleted after 90 days. It is there to spot shared or published keys (Art. 6(1)(f)).

Order page. Only on the order page, and only once you have ticked both boxes, does the page load Stripe.js directly from Stripe. Stripe then shows the fields for email and payment on the page, and what you type in them goes straight to Stripe. I never see your card details. Stripe sets cookies there to complete the payment securely and prevent fraud: __stripe_mid (1 year) and __stripe_sid (30 minutes) on mikkelmanniche.dk, and its own cookies at Stripe and at hCaptcha, which Stripe uses against abuse. hCaptcha is run by Intuition Machines, Inc. in the USA, so data may be transferred there; see hcaptcha.com/privacy. They are strictly necessary for the payment and need no consent (§ 25(2) no. 2 TDDDG). The legal basis is the contract with you (GDPR Art. 6(1)(b)) and the legitimate interest in preventing fraud (Art. 6(1)(f)). Stripe describes its processing at stripe.com/privacy.

Cookies. When you log in, I set two strictly necessary cookies, which need no consent (§ 25(2) no. 2 TDDDG): __Host-mmpro keeps you logged in for 30 days, and __Host-mmpro-ind always holds the value 1 and only tells the pages that you are logged in on this device. Both are deleted when you log out.

Emails. I only send you emails that belong to the contract: the confirmation with the login link and login links you ask for yourself. They are sent through Simply.com A/S, which also hosts the database (processor).

For how long. The account with your email address, the licence and the keys stays until you ask me to delete it, also after a withdrawal or refund, so I can see what happened to the licence. If you write to me, I delete the account, the keys and the sessions, and your access ends. I keep the licence number and the payment references at Stripe as accounting records for up to 10 years (§ 147 AO).

Meetings are booked through Cal.com (Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA). The calendar is only loaded from Cal.com when you click a button to book. Until then, this site sends nothing to Cal.com.

When you book, Cal.com receives your name, your email, the time you choose and anything you enter in the form, such as your website, your phone number or what the meeting is about. Cal.com processes this on my behalf, in the United States, under the European Commission’s Standard Contractual Clauses. The meeting is also added to my calendar at Apple iCloud. If you choose a video call, it takes place in Cal Video. The legal basis is arranging and holding the meeting with you (Art. 6(1)(b) GDPR). I keep the booking for as long as it is relevant to our conversation, just like a message sent through the contact form.

You have the right to access the information I hold about you and to have it corrected or deleted. You can also ask me to restrict processing, receive your data in a common format (data portability) and object to processing based on my legitimate interest. You can withdraw consent at any time. Write to kontakt@mikkelmanniche.dk and I will respond as soon as I can.

You can lodge a complaint with a data protection authority. As I live in Bavaria, mine is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. You can also complain to the authority in your own country.