Privacy Policy

Last updated: 5 October 2026

1. Data controller

The data controller for the processing of your personal data is:

Wrapper ApS
CVR no.: 46623010
Esromgade 18, 2., 2200 København N
Website: archie.bi
E-mail: privacy@archie.bi

This policy covers both our website (archie.bi) and the Archie platform (the "Service").

2. Our role: data controller and data processor

Archie is a business intelligence platform that collects data from your company's systems (POS systems, scheduling systems, etc.). We therefore have two roles:

• Data controller: For information about website visitors, account data, billing and your use of the Service, Wrapper ApS is the data controller. This policy describes that processing.
• Data processor: For the business data your organisation chooses to synchronise to Archie (e.g. sales data and employee data from your own systems), your organisation is the data controller and Wrapper ApS is the data processor. That processing is governed by the data processing agreement between your organisation and us.

3. Information we collect

3.1 Website visitors (archie.bi)

• Usage data via the analytics tool PostHog (page views, clicks, device and browser information)
• Ad measurement data via the LinkedIn Insight Tag (campaign measurement and retargeting)
• E-mail address, if you sign up for early access via the form on the site (processed via Formspree)

3.2 Account data

• E-mail address and name
• Organisation affiliation and role
• Login via e-mail/password or Google account

This information is collected via our authentication service (Clerk) when your account is created.

3.3 Payment data

• Subscription status and billing history
• Billing information (company name, CVR number, billing e-mail)

Payment data is processed by Stripe. We do not store full card numbers.

3.4 Synchronised business data (as data processor)

Depending on which integrations your organisation connects, we process:

• Sales and transaction data from POS systems (e.g. OnlinePOS, Square, Oracle Simphony)
• Scheduling and employee data from workforce systems (e.g. Planday, Tamigo), including employee names, e-mail, phone number, payroll number, shifts and labour costs
• Reviews from Google Reviews / Google Business Profile
• Weather data from DMI (not personal data)

Your organisation is responsible for having a valid legal basis for the data that is connected — including in relation to its own employees.

3.5 Usage data and logs

• Actions in the system (audit log)
• Technical logs and error reports
• AI query logs (see section 6)

3.6 Connected AI assistants (Archie MCP plugin)

If you choose to connect Archie to ChatGPT, Codex, Claude or another compatible assistant, you authorise a connection through Archie's sign-in and consent screen. The consent screen lets you select the data connections and read or write access to grant. Depending on the grant, an assistant can request connection and location names and identifiers; sales, product, budget, aggregated labour, weather and forecast data; and report or dashboard content you have saved in Archie. Tool requests and their responses are exchanged with the assistant provider to answer your request or carry out an action you approve.

Archie's analytics tools are designed to exclude staff-level records, contact details, payroll identifiers, absence reasons and free-text shift notes from their responses. Report instructions and dashboard content that you create can still contain information you enter yourself. Do not put health information, government identifiers, payment-card details or passwords into those fields or into assistant requests.

You can review the access requested on the consent screen. To revoke access, use Settings › MCP › Revoke OAuth Sessions in Archie; this disconnects every assistant connected through Archie's sign-in, including ChatGPT and Claude. A revoked grant can no longer make authenticated Archie tool calls. The underlying business data stays in Archie according to section 7; the assistant provider's handling of conversations and tool results is governed by its own settings and privacy terms.

4. Legal basis (GDPR Art. 6)

Where we are the data controller, we process personal data on the following bases:

4.1 Performance of a contract (Art. 6(1)(b))

• Creation and operation of your account
• Delivery of the subscription service
• Billing and payment

4.2 Consent (Art. 6(1)(a))

• Analytics cookies on archie.bi (PostHog)
• Sign-up for early access / news

You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4.3 Legitimate interest (Art. 6(1)(f))

• Troubleshooting, operations and system optimisation
• System security and abuse prevention
• Anonymised statistics to improve the Service

5. Third parties and data sharing

We use the following sub-suppliers/data processors:

In addition, data is exchanged with the systems your organisation itself connects (e.g. OnlinePOS, Square, Oracle Simphony, Planday, Tamigo, Google). Access keys for these systems are stored encrypted (AES-256).

If you choose to connect Archie to ChatGPT or Codex, OpenAI receives the tool requests and results described in section 3.6 to provide that assistant experience; if you connect Claude, Anthropic receives them. These are user-initiated connections, separate from the sub-suppliers listed above.

We have entered into data processing agreements with all relevant sub-suppliers.

6. AI and machine learning

Archie uses AI technology (via OpenRouter) to generate insights, reports and dashboard configurations based on your business data.

When you connect Archie to ChatGPT or Codex, OpenAI also receives the Archie tool calls and results described in section 3.6; when you connect Claude, Anthropic receives them. This connected-assistant flow is separate from Archie's use of OpenRouter to generate reports.

Important:

• Data is sent to OpenRouter and the selected model provider for processing, but is not stored permanently with these providers.
• AI-generated insights are an assistive tool — you are always responsible for verifying the results before making decisions based on them.

7. Data retention

• Active account: Your data is retained for as long as your organisation's account is active.
• Account deletion: Upon termination, personally identifiable data is deleted within 30 days, unless legislation (e.g. the Danish Bookkeeping Act) requires longer retention of billing data.
• Anonymised data: Aggregated and anonymised data may be retained after deletion.
• Backups: Data in backups is deleted in line with the normal backup rotation (max. 90 days).

8. Your rights (GDPR Art. 15-22)

You have the following rights under the GDPR:

• Right of access (Art. 15): You can request a copy of the personal data we process about you.
• Right to rectification (Art. 16): You can request correction of inaccurate information.
• Right to erasure (Art. 17): You can request deletion of your personal data (the "right to be forgotten").
• Right to restriction (Art. 18): You can request restriction of the processing of your data.
• Right to data portability (Art. 20): You can receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21): You can object to processing based on legitimate interest.
• Right to complain: You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

If you are an employee of a company that uses Archie and your enquiry concerns data synchronised from the company's systems, you should as a rule contact your employer (the data controller) — we assist as data processor.

To exercise your rights, contact us at privacy@archie.bi. We respond to enquiries within 30 days.

9. Transfers to third countries

Some of our sub-suppliers are established in the USA. Transfers of personal data to the USA take place on the basis of:

• The EU-US Data Privacy Framework (for certified companies)
• The EU Commission's Standard Contractual Clauses (SCCs) as a supplement

We ensure that a valid transfer basis under GDPR Chapter V is always in place.

10. Cookies

On archie.bi we use:

• Necessary cookies for session management and security
• Analytics cookies from PostHog to understand how the site is used (page views, clicks). PostHog data is processed in the EU.
• Marketing cookies from LinkedIn (Insight Tag) for measuring ad campaigns and retargeting. See LinkedIn's cookie policy at linkedin.com/legal/cookie-policy.

11. Data breach handling

In the event of a data security breach:

• The Danish Data Protection Agency is notified within 72 hours in accordance with GDPR Art. 33.
• Affected users and customer organisations are informed without undue delay if the breach entails a high risk to their rights and freedoms (GDPR Art. 34).
• We document all security incidents and the measures taken.

12. Changes to this policy

We may update this privacy policy from time to time. In the event of material changes, we will notify you by e-mail at least 30 days before the changes take effect.

13. Contact

If you have questions about our processing of personal data, you are welcome to contact us:

Wrapper ApS
CVR no.: 46623010
E-mail: privacy@archie.bi
Website: archie.bi