Privacy Policy
This policy explains what personal data Metnir collects when you visit this website or get in touch with us, what we use it for, and what your rights are.
1. Who We Are
Metnir is the trading name of Vexera ApS, a Danish company with CVR number 46442350, at Fuglegårdsvej 36D, 2820 Gentofte, Denmark. We are the data controller for the personal data described here. This policy covers the EU General Data Protection Regulation (GDPR), the Danish Data Protection Act and the Danish rules on cookies and similar technologies. For anything about this policy, write to privacy@metnir.com.
2. What We Collect and Why
When you write to us
If you email us, Microsoft processes the information you send, such as your name, email address, company and message, on our behalf. We use it to reply and, if you ask for an assessment, to scope and arrange it. We rely on our legitimate interest in answering inquiries (GDPR Article 6(1)(f)), or on taking steps at your request before entering into a contract (Article 6(1)(b)). We keep correspondence while it is needed to handle your inquiry or the resulting customer relationship, and longer only where a legal obligation or the establishment, exercise or defence of legal claims requires it.
Website forms and newsletters
The contact form sends your name, email address, optional company and message through our Cloudflare hosting to HubSpot, our form and customer relationship management provider. We use those details to answer and handle your request on the same legal bases and retention criteria as correspondence above. Contact requests do not subscribe you to marketing emails. Please do not submit passwords or sensitive personal data.
Newsletter signup asks for separate, affirmative consent to research updates and news by email. HubSpot stores your email address, submission time and consent record, including the wording and subscription type. The basis is consent under GDPR Article 6(1)(a) and section 10 of the Danish Marketing Practices Act. HubSpot sends a confirmation email, and marketing emails require confirmation. You can withdraw consent using the unsubscribe link in an email or by contacting us. Accepting analytics cookies does not subscribe you. We keep subscription data while needed for the subscription and retain only the consent or suppression records necessary to document permission, honour an opt-out or defend legal claims. We do not track newsletter opens, link clicks or individual browsing through email identifiers.
No HubSpot tracking script, tracking cookie or embedded form is loaded on this website. The forms work independently of analytics consent. We forward the submitted fields and a fixed page reference to HubSpot, without your IP address, analytics identifiers or browsing history. HubSpot's account data hosting location is the European Union (Germany).
When you visit the site
To deliver a page, our hosting provider processes your IP address and technical details about your browser and the request. We rely on our legitimate interest in running the site and protecting it against attacks (GDPR Article 6(1)(f)), and we don’t use this data to identify you.
3. Analytics and Cookies
Analytics run only if you accept them in the pop-up. Before you answer, and after you deny, no analytics events or recordings are collected. Global Privacy Control and Do Not Track also disable analytics. You can use the site without accepting. Necessary storage used to remember your cookie choice and the name-change notice works independently of analytics.
If you accept, we use PostHog's EU Cloud service to understand and improve this website: the pages you visit, the referring website's origin, your browser and device, your approximate location, link and button clicks, cursor and scroll positions for heatmaps, and page performance. PostHog also reconstructs your visit as a session replay. Form inputs are masked in your browser before they are sent. We do not send field values, message contents, clipboard text, console logs, network headers or network bodies to PostHog. Query strings and fragments are removed from captured page URLs. We use a random browser identifier and do not attach your name or email address or create person profiles. This is pseudonymous data, not anonymous data.
The legal basis is your consent (GDPR Article 6(1)(a)). After acceptance, PostHog uses a first-party ph_*_posthog cookie and localStorage to recognize your browser, and sessionStorage to link activity within a session. The analytics cookie expires after 180 days and may be renewed on a visit while consent remains valid. Browser identifiers are removed when consent expires or you withdraw it. Recordings have 30-day retention. Ordinary analytics events have the account's one-year retention window; expiry is not a promise of immediate deletion, because PostHog removes expired events in batches. Events include the consent version and acceptance and expiry times so we can document your choice.
The necessary metnir-consent-v1 cookie and matching localStorage entry remember either choice for 180 days without extending that period on each visit. They hold the choice, its version and expiry time. You can change your answer through Cookies at the bottom of every page. Choosing Deny stops future analytics and recording and removes PostHog's browser identifiers. It does not delete data already received by PostHog. Your choice is specific to this browser on this domain and cannot transfer from vexera.ai.
The localStorage preferences rename-notice and rename-popup remember whether you have dismissed or seen the name-change message. They contain no analytics identifier and remain until you clear this site's browser data.
4. Who Receives Your Data
We do not sell personal data or use website analytics for advertising. Our providers are Cloudflare for hosting and security, Microsoft for email, HubSpot for form submissions, customer relationship management and newsletters and, after analytics acceptance, PostHog for website measurement and replay. Providers processing personal data on our behalf must be covered by data processing terms. Otherwise we disclose personal data only where the law requires it.
PostHog data is stored in its EU region and our HubSpot account uses EU hosting in Germany. EU hosting does not exclude access by a provider or its subprocessors outside the EU/EEA. Where such transfers occur, the providers' data processing terms specify the applicable safeguards, such as a European Commission adequacy decision, including the EU-US Data Privacy Framework where applicable, or Standard Contractual Clauses. You can contact us for information about the safeguards and a copy of the relevant terms.
5. Customer Systems
This policy covers this website, not our security assessments. Personal data we come across in a customer’s systems is processed on that customer’s instructions under a data processing agreement, and the customer remains its controller. If your data is held in a system we have tested, please contact that customer.
6. Your Rights
You can ask for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict our use of it or hand it over in a portable format. You can object to processing that rests on our legitimate interest, and withdraw a consent at any time; that does not affect what was done before you withdrew. Write to privacy@metnir.com. We normally respond within one month. If a request is complex or numerous, GDPR allows up to two additional months; we will explain any extension within the first month. For requests about analytics, we may need your browser identifier because we cannot locate your visits using your name or email alone. We do not make automated decisions with legal or similarly significant effects based on website analytics.
7. Complaints
You can contact us about concerns or complain directly to the Danish Data Protection Agency without contacting us first: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.
8. Changes to This Policy
When this policy changes, the new version is published on this page. Last updated 11 November 2026.