Ceero
Sign inOpen hub

Legal

Privacy Policy

Last updated: August 21, 2026

1. Introduction

Ceero ApS ("Ceero", "we", "us", or "our") operates hub.ceero.eu as the marketing hub and account portal for the Ceero product ecosystem. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you:

  • Browse our website, product pages, pricing, mission, and marketing content
  • Create or use a unified Ceero account that works across our apps (including HourIQ, Scope, Translately, and Free Markdown to PDF)
  • Subscribe to or manage a Ceero bundle plan
  • Contact us or interact with cookie and consent preferences

Each individual product may also have its own privacy policy covering product-specific processing. Where both apply, this policy describes account-level and platform-level processing; the product policy describes processing within that product.

By using Ceero, you acknowledge this Privacy Policy. Ceero ApS is the data controller for personal data described here.

Last updated: May 2026

2. Data Controller and Contact

3. Scope: What This Policy Covers

3.1 Ceero website and account portal

This policy covers personal data processed when you visit hub.ceero.eu, sign in, manage billing, or navigate between our products from the hub.

3.2 Unified account

We provide a single sign-on experience through WorkOS AuthKit. When you create a Ceero account, the same identity may be used to access connected Ceero apps without creating separate credentials. Account-level data (email, name, user id, subscription status) is shared across the ecosystem as needed to provide this experience.

3.3 Individual products

When you use a specific product (for example HourIQ at houriq.app or Translately at translately.app), that product may process additional data under its own privacy policy. Product-specific content, usage data, and integrations are governed by the relevant product policy in addition to this one.

4. Information We Collect

4.1 Information you provide

  • Account information: Name, email address, and profile details provided during registration or sign-in (including via OAuth providers where supported).
  • Communications: Messages you send to support, feedback forms, or other contact channels.
  • Billing-related information: Subscription selections and billing portal interactions. Payment card details are collected and processed by Paddle as Merchant of Record; we receive transaction records, subscription status, and customer identifiers necessary for fulfilment.

4.2 Automatically collected information

  • Usage data: Pages visited, features viewed, referral sources, and interactions with marketing content on hub.ceero.eu.
  • Technical data: IP address, browser type, device information, operating system, language preferences, and access timestamps.
  • Authentication metadata: Session identifiers, sign-in timestamps, and security events from WorkOS.
  • Subscription metadata: Plan type, billing interval, subscription status, and renewal dates synced from Paddle webhooks.

4.3 Cookies and consent

  • Essential cookies: Required for authentication, security, and basic site functionality.
  • Analytics cookies: Vercel Web Analytics, enabled only with your consent via the cookie banner.
  • Consent records: Your cookie preference choices, consent timestamp, and banner version.

See our Cookie Policy for details.

5. How We Use Information

We use personal data to:

  • Operate hub.ceero.eu and provide the unified account experience
  • Authenticate you and maintain sessions across Ceero apps
  • Process and manage bundle subscriptions and billing through Paddle
  • Provide customer support and respond to inquiries
  • Send service-related communications (account, security, billing, product updates)
  • Improve our website, products, and user experience
  • Detect fraud, abuse, and security incidents
  • Comply with legal obligations and enforce our terms

We do not sell your personal information.

With your consent, we use analytics to understand aggregate website usage. You may withdraw consent at any time via the cookie banner or Cookie Settings in the footer.

6. Legal Bases (EEA/UK)

Where GDPR applies, we rely on:

| Processing | Legal basis | | --- | --- | | Account creation, authentication, and unified sign-on | Performance of a contract (Art. 6(1)(b)) | | Bundle subscription and billing management | Performance of a contract (Art. 6(1)(b)) | | Service-related communications | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) | | Website security, fraud prevention, and abuse detection | Legitimate interests (Art. 6(1)(f)) | | Product and website improvement analytics (non-essential cookies) | Consent (Art. 6(1)(a)) | | Marketing website analytics and aggregate usage measurement | Consent (Art. 6(1)(a)) where cookies are involved; otherwise legitimate interests (Art. 6(1)(f)) | | Compliance with tax, accounting, and legal obligations | Legal obligation (Art. 6(1)(c)) | | Establishing, exercising, or defending legal claims | Legitimate interests (Art. 6(1)(f)) |

7. Sharing and Sub-processors

We share personal data with sub-processors who assist in operating Ceero. They process data only on our documented instructions and under contractual safeguards. The current list is at /legal/subprocessors.

| Sub-processor | Role | | --- | --- | | WorkOS | Unified authentication (AuthKit), SSO, session management | | Convex | Account records, subscription sync, consent logs, backend compute | | Vercel | Website hosting and, with consent, analytics | | Paddle | Merchant of Record for paid subscriptions, billing, invoicing, tax handling |

Paddle note: For payment transactions, Paddle acts as an independent controller for payment data under its Merchant of Record model. Ceero receives only the records necessary to provide subscriptions and support. See Paddle's privacy policy.

We may also disclose information where required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice where required).

8. International Data Transfers

Several sub-processors are established outside the EU/EEA, primarily in the United States. Transfers include:

  • United States: WorkOS, Convex, Vercel, and (in part) Paddle
  • Ireland / United Kingdom: Paddle (in part)

For transfers to countries without an adequacy decision, we rely on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where applicable, the UK International Data Transfer Agreement or EU-US Data Privacy Framework certification.

A Transfer Impact Assessment summary is available on request to support@ceero.eu.

9. Data Security

We implement appropriate technical and organizational measures, including:

  • Encryption in transit (HTTPS/TLS)
  • Access controls for production systems and databases
  • Secure authentication through WorkOS
  • Webhook signature verification for billing events
  • Provider security certifications (see /legal/subprocessors)

No method of transmission or storage is completely secure.

10. Data Retention

  • Account data: Retained for the duration of your account and deleted within 90 days after account deletion, unless longer retention is required by law.
  • Subscription and transaction records: Retained for the duration of the subscription and thereafter as required by Danish accounting and tax law (typically up to 5 years for accounting records; up to 7 years where bookkeeping law applies).
  • Consent records: Retained to demonstrate consent for the period required by applicable law.
  • Support communications: Retained as long as needed to resolve inquiries and for a reasonable period thereafter.
  • Server and security logs: Typically up to 30 days unless needed for investigations.
  • Analytics data: Aggregated and anonymised data may be retained longer for service improvement.

Product-specific data in individual apps is retained according to each product's privacy policy.

11. Your Rights

Depending on where you live, you may have the following rights:

  • Access — request a copy of personal data we hold about you
  • Rectification — request correction of inaccurate data
  • Erasure — request deletion, subject to legal retention requirements
  • Restriction — request limited processing in certain circumstances
  • Portability — receive your data in a structured, commonly used format
  • Objection — object to processing based on legitimate interests, including profiling where applicable
  • Withdraw consent — for analytics cookies and consent-based processing

To exercise these rights, contact support@ceero.eu. We respond within one month, extendable by two months for complex requests.

You may manage your subscription and billing details through the Paddle customer portal accessible from your Ceero billing page.

12. Personal Data Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  1. Notify Datatilsynet without undue delay and, where feasible, within 72 hours of becoming aware, as required by Article 33 GDPR.
  2. Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34 GDPR, including the nature of the breach, likely consequences, and measures taken or proposed.

Report security concerns to security@ceero.eu.

13. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects within the meaning of Article 22 GDPR.

14. Marketing Communications

We may send product updates and ecosystem news to account holders where permitted by law. You may opt out of non-essential marketing emails using the unsubscribe link in any message or by contacting support@ceero.eu. Service-related communications (security alerts, billing, account notices) are not marketing and cannot be fully opted out while you maintain an account.

15. Children

Ceero is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

16. Supervisory Authority

If you are in the EU/EEA and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection supervisory authority.

In Denmark, the supervisory authority is:

  • Datatilsynet
  • Website: datatilsynet.dk
  • Address: Carl Jacobsens Vej 35, 2500 Valby, Denmark

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Where required, we will provide additional notice (for example by email to account holders).

18. Contact

  • Email: support@ceero.eu
  • Company: Ceero ApS
  • Address: Njalsgade 21F 2. sal, København S, Denmark
  • CVR: 45441393