Privacy Policy
Who is responsible
Saaga ApS is the data controller for the personal data described here. If you have questions about how your data is handled, or want to exercise any of the rights below, email andy@andysontag.com.
What I collect, and why
When you email me. Your name, email address and whatever you choose to put in the message. Used to reply to you and, where relevant, to take steps towards an agreement at your request.
When you book and pay for a session. Your name, email address, billing country and address, and the details of what you bought. Payment card details go directly to Stripe and are never seen or stored by me. This data is needed to perform our agreement and to meet Danish bookkeeping obligations.
When you schedule a session. Your name, email address and time zone, handled through Calendly.
When you visit this site. Aggregate page view data collected by the site's own hosting platform, used to understand which pages are read. There is no third-party analytics, no advertising, and no cross-site tracking or profiling.
What we discuss in a session stays between us and is not shared with anyone, except where the law requires otherwise.
Who else processes your data
- Stripe — payment processing
- Lovable — website hosting and site analytics
- Calendly — appointment scheduling
- Google — web fonts, which means Google receives your IP address when a page loads
- e-conomic — invoicing and bookkeeping
Each of these acts on my instructions under a data processing agreement. Some may process data outside the EU/EEA, in which case transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
How long it is kept
Invoices, receipts and related records are kept for five years from the end of the financial year, as required by the Danish Bookkeeping Act. Email enquiries that do not lead to work are deleted within twelve months. Session notes are deleted when our engagement ends, unless you ask me to keep them.
Your rights
You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how it is used, and to receive it in a portable format. Where processing relies on your consent, you can withdraw that consent at any time.
To exercise any of these, email andy@andysontag.com. I will respond within one month.
If you think your data has been handled improperly, you can complain to the Danish Data Protection Agency, Datatilsynet, at datatilsynet.dk.
Cookies
This site uses only what is needed to make it work, plus the analytics described above. It does not use advertising or cross-site tracking cookies.
Changes
If this policy changes, the date at the top of the page changes with it.