Ordlyd

GDPR overview

GDPR compliance is claimed in writing, with processing declared to take place in accordance with the EU General Data Protection Regulation. The single legal basis invoked is legitimate interest, Article 6(1)(f), with a balancing test declared as carried out. Four data categories are listed — name, email, optional profile picture and billing data — and six rights are enumerated: access, rectification, erasure, portability, objection and restriction, answered within one month at the latest. One sub-processor, Glide Apps, is named under a written processing agreement. The gaps are equally concrete: no DPO, no dedicated privacy address (only hej@ordlyd.ai), no mention of the right to complain to the Danish Datatilsynet, no mention of transfers outside the EU or standard contractual clauses, and no effective or last-updated date on the policy. Being established in Denmark, the publisher needs no Article 27 representative.

Who owns the data?

Ordlyd, legally Klean A/S (CVR 31256089), declares itself data controller for the personal data processed through its SaaS. A single sub-processor is named, Glide Apps, which processes and stores data on Ordlyd's behalf under a written data processing agreement. The privacy policy states that personal data is never sold on to third parties, and that nothing is shared beyond Glide Apps except with your explicit consent or under a legal obligation towards public authorities. One point is worth stating plainly: neither the terms nor the privacy policy says who owns the generated texts or the imported product data. No intellectual property, licence or reuse clause appears in the published documents.

Reuse rights

The published documents never grant, restrict or even mention rights over the text Ordlyd produces, so there is no contractual answer to "can I publish this and sell from it?". In practice the product is built around commercial reuse: the e-commerce workflow imports a product feed, generates titles and descriptions, lets a human correct them in the interface and exports them back to the shop. Reuse is implied by design rather than granted by contract. On the personal-data side the picture is tighter. Processing is limited to four stated purposes — delivering the service, billing and payment, marketing and communication, and product improvement through usage patterns, feedback and preferences — and the policy commits to no other purpose without consent or another lawful basis. Marketing messages can be unsubscribed from at any time. Two silences deserve attention: the pricing table sells AI training on your own text samples while the privacy policy never mentions model training at all, and no international transfer or standard contractual clauses are mentioned even though Glide Apps is a US vendor.

Data retention & training

Hosting summary

No hosting jurisdiction is published. Neither the privacy policy nor the terms name a country, a region or an infrastructure provider for the data Ordlyd processes. What is stated is narrower: one sub-processor is named, Glide Apps, described as an "underdatabehandler" that processes and stores data on Ordlyd's behalf under a written data processing agreement imposing documented instructions and appropriate technical and organizational measures. Beyond Glide Apps, the policy says no data is shared with other external recipients. The contractual framework is Danish law, with Aarhus as the venue. There is no mention of international transfers, standard contractual clauses or an adequacy decision, which is a notable silence given that Glide is a US vendor. Two technical observations, which the publisher does not present as hosting statements: the Ordlyd application is a Glide app whose assets are served from Google Firebase storage, and the marketing site runs on Webflow behind Cloudflare. Those are signals about the stack, not declarations about where customer data is stored. Buyers with data residency requirements should ask the publisher directly.