Privacy policy

Who is responsible

For data about our customers' users and for this website, Vilea ApS, CVR 43126563, Nyholms Allé 36A, 2610 Rødovre, Denmark is the data controller.

For data our customers enter about their own customers (names, addresses, jobs, quotes, invoices), the customer is the data controller and we process the data on their behalf as data processor under a data processing agreement.

What we collect

• Account data: name, email, phone and role of the people who use Installerboard.
• Business data the customer enters: customers, jobs, quotes, invoices, time registrations, photos and notes.
• Advertising data, only if the customer connects an ad account (see below).
• Technical data: log data needed to run and secure the service (IP address, browser, time of request).

Google Ads and Meta Ads connections

A customer can choose to connect their own Google Ads or Meta Ads account under Settings. When they do, they sign in with Google or Meta and grant Installerboard read access.

We read: the list of ad accounts the user has access to, account names and currency, and campaign names and campaign-level results (spend, impressions, clicks and leads per day). We use this only to show the customer their own ad spend, leads and cost per lead on their own dashboard in Installerboard.

We do not create, edit or pause campaigns, we do not read the content of ads, and we do not use the data for advertising, profiling or to train AI models. The data is never sold or shared with other customers or third parties.

Access tokens are stored encrypted at rest in our EU database and can only be read by our servers, not by other users. The customer can disconnect at any time in Settings, which deletes the tokens and the account's stored ad data. Access can also be revoked at any time in the Google account (myaccount.google.com/permissions) or in Meta Business settings.

Installerboard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Purpose and legal basis

• To deliver the service under our contract with the customer (GDPR art. 6(1)(b)).
• To secure and improve the service and prevent misuse (legitimate interest, art. 6(1)(f)).
• To meet bookkeeping and legal obligations (art. 6(1)(c)).

Where data is stored and who processes it

All data is stored in the EU. We use these sub-processors:

• Supabase (database and authentication), AWS region eu-west-1, Ireland.
• Vercel (hosting of the application and website), region Frankfurt, Germany.
• Amazon Web Services SES (sending email from the application), eu-west-1, Ireland.
• Google and Meta, only when a customer connects an ad account, to fetch the customer's own data.
• The booking form on installerboard.com is provided by LeadConnector (HighLevel).

How long we keep data

Account and business data is kept while the customer has an active subscription and deleted no later than 90 days after the subscription ends, unless the law requires us to keep it longer (for example bookkeeping records for 5 years). Ad tokens and ad data are deleted when the connection is removed.

Cookies

The website uses no tracking or advertising cookies. The application uses only the cookies needed to keep you signed in.

Your rights

You can ask for access, correction, deletion, restriction, data portability and object to processing. Write to info@vilea.dk. If the data was entered by an Installerboard customer, we forward the request to them. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).