Privacy policy.
Last updated: 1 October 2026
WonMetrics is operated by AddonNordic ApS, CVR 46495985, Denmark. We are the data controller for this website and for your account with us. For the competitors you track and the registry data in their dossiers, you are the controller and we are the processor — that relationship is set out in the data processing agreement.
Contact for any privacy question: contact@addonnordic.dk.
This website sets no cookies
We count visits with Plausible Analytics, run by Plausible Insights OÜ in Estonia with data stored in the EU. It sets no cookies, does not store IP addresses and builds no profiles: we see page views, where visits came from and which country, in aggregate only. There is no Google Analytics, no advertising pixels and no session recording. We do not set cookies on visitors, which is why you were not asked to accept any.
Our web host keeps standard server logs, which include IP addresses, for security and troubleshooting. We do not build profiles from them and we do not combine them with anything else.
What we collect, and why
If you write to us
The contact form sends us your name, email address, company and message. It is emailed to us and not stored on this website — there is no database of enquiries here to leak or to be asked for. We keep the email for as long as the conversation is useful and delete it after. Lawful basis: legitimate interests in answering the person who wrote to us.
If you create an account
We store your email address, your plan, and your usage against it. Your password is held by our authentication provider and we never see it. Lawful basis: performance of the contract with you. For paid plans we also process billing details and VAT number, which we are required to keep for accounting purposes under Danish law.
The competitors you track, and their dossiers
When you track a competitor, we watch public contract-award notices — TED for the EU, Doffin for Norway — for its name, and we build its supplier dossier from what its national business register publishes. Registry data includes named individuals — directors and officers, and beneficial owners where a register makes them available — so it is personal data even though it is public. We process it on your instructions, as your processor, so you can see who wins public contracts and who you are bidding against.
We do not enrich this data with anything else, do not sell it, do not use it to train models, and do not use it to build profiles of individuals. Where a register restricts access, we respect the restriction rather than looking for a way around it.
If you upload tender documents (Bid help)
Bid help reads the tender documents you upload — typically the conditions and requirement specification a buyer has published — and returns a checklist of requirements, deadlines and award criteria, each with a quote from the document and the page it is on. Tender documents can contain personal data, such as the name and contact details of the buyer’s case officer. We ask you to upload the buyer’s documents, not your own bid.
The files are stored in a private storage area that only your account can reach, sent to our AI model provider for the analysis, and deleted as soon as the analysis is finished (within 24 hours if an analysis fails). What we keep is the result — the checklist with its short quotes — until you delete the analysis or close your account. Our AI model provider, OpenAI, does not use the documents to train its models; it may keep a request for up to 30 days to detect abuse. It is listed at /subprocessors. Lawful basis: performance of the contract with you, and for personal data in the documents you upload, you are the controller and we process it on your instructions under the data processing agreement.
If you chat with our AI assistant
At the bottom of the page you can write to an AI assistant. It is an AI, not a person, and the chat says so. It answers from information about our own products and prices.
When you write in the chat, we process what you write and which pages on the site you viewed during the visit. Before we store the text, we automatically remove names, email addresses, phone numbers, street addresses, national ID numbers and IP addresses. We keep the latest messages for no more than 30 days and then delete them. We do not store your IP address, and the chat sets no cookies.
We use the conversation to answer you and to judge whether a person should contact you. If you choose “Talk to a human” and fill in the form, we store the details you enter so we can reply.
For the chat we use these processors: OpenRouter, Inc. (relays the answer from the language model), TypeSafe AI, Inc. (estimates how close you are to buying), OpenAI Ireland Ltd. (summarises the conversation), Railway Corporation and Supabase (hosting and storage in the EU) and Resend (notifies us when you ask to be contacted). Some of them process data in the United States. The transfer is based on the European Commission’s standard contractual clauses.
The legal basis is our legitimate interest in answering questions about our products (GDPR Article 6(1)(f)). When you ask to be contacted, we process your contact details in order to reply (Article 6(1)(b)). Please do not write sensitive personal data in the chat.
Where it goes
We use a small number of service providers to run WonMetrics — hosting, database, authentication, AI analysis of the tender documents you upload, payment and email delivery. Each one is named at /subprocessors with what it does and where it processes data. That list is authoritative and we update it before a change takes effect.
We do not sell personal data, and we do not share it with anyone for their own purposes.
Your rights
Under the GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, and ask us to restrict processing. Write to contact@addonnordic.dk and we will respond within one month.
If your request concerns registry data in a dossier that one of our customers tracks, we will pass it to that customer, who is the controller for that processing, and assist them in answering you.
You can also complain to a supervisory authority. In Denmark that is Datatilsynet, datatilsynet.dk.
Changes to this policy
If we change this policy in a way that affects you, we will say so — by email for account holders, and by updating the date at the top of this page. We do not quietly revise it and rely on you re-reading it.