Privacy policy

Black Capital Technology, Mølleå 3-5, 9000 Aalborg, Denmark. CVR DK-42380784. Telephone (+45) 60 92 92 60.

Our Norwegian company, Black Capital Technology, Tordenskiolds gate 2, 0160 Oslo, Norway, org. no. NO-933435458, telephone (+47) 907 00 863, serves our Norwegian customers and processes information under this policy.

If you have questions about this policy or about the information we hold about you, write to info@blackcapitaltechnology.com.

2.1 When you visit the website

• Technical information your browser sends when a page is loaded: IP address, browser type, language and the page you came from. It appears in the operating logs of our hosting providers.
• Information from cookies and similar technologies. We always use necessary cookies. We only use statistics and marketing if you have said yes in the cookie banner. See section 2.4 and our cookie policy.

2.2 When you contact us or book a meeting

If you write to us through the form on the website, by email or by phone, we keep the information you give us, typically name, company, email address, phone number and the content of your enquiry.

2.3 When you run a scan

• Your email address and the address of the website you want us to look at. We send the report to that email address.
• Your name, if you give it. It's optional. If your email address has the form firstname.lastname@ or similar, the form suggests your name from it, and if the field is empty, we use that name in our customer database.
• Your answers to the three questions about your work: where most of the manual work is, roughly how much of it there is, and what you want to improve first.
• The content of the website. We read its front page and up to four other pages. If the company has published names, direct numbers or email addresses on those pages, they are part of what we read.
• Public facts about the company from the Danish or Norwegian company register, such as its name, registration number, industry, number of employees and city.
• The language you used.
• A coded version of your IP address. It cannot be turned back into the address, and we use it only to limit how many scans can be started per hour.
• Whether a person or a program sent the form. Our host Vercel checks technical information from your browser when you send it. We learn only the answer, and do not store it.
• Whether the email with your report reached your inbox. Our email provider tells us when it is delivered, or when it bounces.
• If you have said yes to marketing in the cookie banner, the ID in HubSpot's cookie, until your scan is in our customer database, see section 3.
• What you do with the results: when you first saw them, first clicked "Book a Shadow Walk" or our contact details below them, first opened the report from the results page, and first opened the email with your report. The email contains a small image that tells us when it is opened.

From this we write a short profile of the company and three ideas for where AI could save time, and make the report you receive. We store the scan, the ideas and our copy of the report.

2.4 Cookies and your browser

We always use necessary cookies. We only use statistics (Google Analytics, Microsoft Clarity) and marketing (Google Ads, HubSpot, Snitcher) if you have said yes in the cookie banner. You can change your choice at any time using the cookie icon in the bottom left corner. The full list of cookies, who sets them, what they are used for and how long they are kept is in our cookie policy.

Your cookie choice is stored in the cookie bct_consent for up to 12 months. Apart from that, the scan stores nothing in your browser, except HubSpot's cookies if you have said yes to marketing.

To answer your enquiry. We use the information you give us to answer you and to hold a meeting with you. Lawful basis: Article 6(1)(b) of the General Data Protection Regulation where the enquiry is a step towards a contract, and otherwise our legitimate interest in answering enquiries, Article 6(1)(f).

To deliver the scan and the report. We use your email address, the website address and your answers to write the ideas, show them to you and email you the report. Lawful basis: Article 6(1)(b). You asked for the scan, and the processing is necessary to deliver it.

To follow up on your scan. Your name, your email address, your language, the website, your answers, what we found about the company and the ideas go into our customer database (CRM), so a member of our sales team can follow up with you about the scan by email or phone, as a representative of your company. We only add a scan once a person has used it and the email with the report has arrived, and never one from a throwaway email address. We do not send you newsletters. Lawful basis: our legitimate interest in following up an enquiry from a potential business customer, Article 6(1)(f), and Article 6(1)(b) where the enquiry is a step towards a contract. You can always ask us not to contact you.

To see how the scan is used. We record when you first saw the results, clicked "Book a Shadow Walk" or our contact details, opened the report from the results page, and opened the email with your report, so we can see whether the scan helps and follow up at the right time. We store it with your scan and in our customer database, and use no cookies for it. Lawful basis: our legitimate interest in improving the scan and in following up an enquiry from a potential business customer, Article 6(1)(f). You can object to it, see section 6.

Operation, security and limiting misuse. We use the coded version of your IP address to limit the number of scans per hour, check that a person and not a program sent the form, check whether the email with your report arrived, and keep operating logs. Lawful basis: our legitimate interest in keeping the service running, in not paying for automated misuse and in keeping made-up addresses out of our customer database, Article 6(1)(f).

Statistics and marketing through cookies. With your consent in the cookie banner, we use Google Analytics and Microsoft Clarity to measure how the pages are used, Google Ads and Snitcher to measure whether our ads work and which company a visit comes from, and HubSpot to see which of our pages you visit. If you then run a scan or contact us, HubSpot links those visits to you in our customer database, so we can see how you found us. Lawful basis: your consent, Article 6(1)(a), and section 3 of the Danish cookie order (cookiebekendtgørelsen). You can withdraw your consent at any time.

We use the following providers. They process information on our behalf and only for the purposes described here.

• OpenAI. Writes the company profile and the ideas. We send the text from the website you pointed to, the facts from the company register and your answers. Your name and email address are not sent to OpenAI.
• Firecrawl. Reads the website you point to, so its text can be used.
• Resend. Sends our emails from the EU, including the report, and tells us when the email with your report is delivered, bounces or is opened.
• Supabase. Stores the scans and our copy of the reports, in the EU (Ireland).
• HubSpot. Our customer database (CRM), which stores its data in the EU. It holds your name, your email address, your language, the company, your answers, the ideas, the report, and when you first saw the results, clicked, opened the report from the results page or opened the email with your report, so our sales team can follow up. With your consent in the cookie banner, it also records which of our pages you visit, see section 3.
• Vercel. Hosts the AI Opportunity Scan, which runs in the EU (Dublin), and checks that a person and not a program sends the scan's form (Vercel BotID).
• Our web host and WPMU DEV (through BunnyCDN in the EU). Host and deliver the website blackcapitaltechnology.com.
• Lovable. The logo in our sales team's email signature is loaded from bctsignature.lovable.app when you open an email from us.
• The Danish Central Business Register (CVR, through Datafordeler and Virk) and the Brønnøysund Register Centre. Look up the company you scan, so its size and industry are right in the ideas.
• Google Fonts (Google), Adobe Fonts (Adobe) and unpkg.com. The website blackcapitaltechnology.com loads fonts and code libraries from these. When your browser fetches them, the providers receive your IP address. No cookies are set.
• Google Tag Manager (Google). Controls which scripts may run and is loaded before you have chosen in the cookie banner. Google thereby receives your IP address. No cookies are set.
• Google Analytics and Google Ads (Google). Only with your consent.
• Microsoft Clarity (Microsoft). Only with your consent.
• Snitcher (Snitcher B.V., the Netherlands). Only with your consent. Looks up which company an IP address belongs to.

Some providers, including OpenAI, Firecrawl, Google, HubSpot, Microsoft, Resend, Supabase and Vercel, may process information in the USA. The transfer is based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

We do not sell your information. We do not pass it on to anyone other than those named, unless we are required to by law.

• The coded version of your IP address is deleted from the scan when it is more than 24 hours old.
• The ID from HubSpot's cookie is deleted from the scan once the scan is in our customer database or we have decided it will not be, and at the latest when it is 24 hours old.
• A scan, with the information you entered, your answers, what we found about the company, the ideas and our copy of the report, is deleted automatically 12 months after the scan.
• In our customer database (HubSpot) we keep your name, your email address, the company and a summary of the scan for as long as we are in contact with you about it. The copy of the report there is deleted automatically 12 months after the scan.
• If you ask us to delete your information before then, we do so, see section 6.
• If you become a customer, we keep the information for as long as the customer relationship lasts, and then for as long as bookkeeping law requires.
• If you unsubscribe, we keep the unsubscription permanently. It is the only way we can make sure we do not write to you again.
• Cookies are kept for the periods stated in the cookie policy.

Under the General Data Protection Regulation you have the right:

• to know what information we hold about you and to get a copy of it,
• to have incorrect information corrected,
• to have your information deleted,
• to have our processing of it restricted,
• to object to processing we base on legitimate interest, including being contacted,
• to receive the information you have given us in a common format.

You can always withdraw a consent. You do so through the unsubscribe link at the bottom of the emails you receive from us, through the cookie icon on the site, or by writing to us at the address in section 1. Withdrawing your consent does not affect the lawfulness of what we did before.

Write to us at the address in section 1 to use your rights. We answer within one month.

If you are unhappy with how we process your information, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or to the data protection authority in your own country.

We update this policy when we change how we process information. The latest version is always here.

Last updated: 3 November 2026.