Privacy policy

Controller: Otonom (trading as OpenAjan), CVR 46779274, Lyngbyvej 83A, 2100 København Ø, hej@openajan.com.

1. What we collect

Merchants: name, address, phone, email, opening hours, menu/prices, company number (if given), login codes, order history.
Customers (via AI agents): name, phone, email (optional), order contents, requested time, note, which agent placed the order, technical logs (IP, time).
Account when you connect an AI assistant (OAuth): name, phone, email and the limits you choose (maximum per order and per month). Used only to fill in your orders and enforce your limits.

2. Purposes and legal basis

Showing the shop to customers and AI agents, relaying orders/bookings to the shop, sending confirmations, billing the merchant fee, preventing abuse, meeting legal duties. Basis: contract (GDPR art. 6(1)(b)), legitimate interest in operation and security (6(1)(f)), legal obligation (6(1)(c), bookkeeping).

3. Roles

For merchant data Otonom is controller. For customer data inside an order the merchant is controller and Otonom is processor under a data processing agreement (see tab).

4. Recipients

The shop you order from. Processors: Simply.com (hosting and email, Denmark), SMS provider (GatewayAPI, EU) and payment provider (Stripe) if enabled. The AI agent (e.g. ChatGPT, Claude) is an independent controller of your conversation. We never sell data and show no ads.

5. Retention

Order records: 5 years (Danish Bookkeeping Act). Customer details in orders: deleted/anonymised after 12 months unless law requires longer. Merchant data: while the shop exists + 5 years for accounting data. Logs: 90 days.

6. Your rights

Access, rectification, erasure, restriction, portability and objection — write to hej@openajan.com. You may complain to Datatilsynet (datatilsynet.dk). Merchants can delete their shop any time in the panel.

7. Cookies

Only strictly necessary cookies (session/login, CSRF). No tracking, no third-party cookies.

8. Transfers outside the EU

Data is processed in the EU. If an AI agent outside the EU places an order, that happens under the agent's responsibility and your choice of agent.

9. What the AI assistant receives from OpenAjan

When you use OpenAjan inside an AI assistant (e.g. ChatGPT, Claude), our tools return only the following data to the assistant:

• Shop data (find_shops, find_options, get_shop, search, fetch, get_availability): the shop's name, type, address, phone, opening hours, items with prices and durations, free times. No data about you.
• Order summary and order (place_order): shop, items, quantities, total, currency, time, payment method, status, order id, a quote code (valid 15 minutes) and a signed receipt (link, key id and Ed25519 signature). The receipt contains an anonymous user reference (hash) — not your name, phone or email.
• Order status (order_status): order id, shop, status, total, currency, requested time and time placed — only for your own orders.
• Error messages: a short error code and, where relevant, numbers (e.g. free times or your amount limit). No personal data and no debugging data.

Your name, phone number and email are never returned to the assistant; they are used only for the order at the shop. Section 9 added 27 October 2026.

Last updated: 17. september 2026.