On this page
Last updated 1 October 2026. Dansk udgave
BID is the shared sign-in for broberg.ai's systems. When you sign in to one of our apps, it happens here, on id.broberg.ai. This page explains what BID knows about you, why, for how long, and how to have it deleted.
BID shows no ads, sells no data and does not track you across websites.
Data controller
WEB HOUSE ApS
Riberhusvej 9
9492 Blokhus, Denmark
CVR (company no.): 21221198
Contact: legal@broberg.ai
What we process
- Your account: name, email address, and whether the address is verified. If you added them yourself: phone number, extra email addresses and a profile picture.
- Your sign-in methods: your password is stored only as a one-way hash, never in plain text. For a passkey, only the public half is stored; the private half stays on your device. If you use two-factor authentication, the key for your authenticator app and your backup codes are stored.
- Sign-in with another provider: if you sign in with Google, Apple, Microsoft, GitHub, LinkedIn or Facebook, we receive your name, your email address, your profile picture and the provider's id for your account. We do not ask for your posts, friends, contacts or anything else. We never receive your password at the provider.
- Sign-in with MitID: if you sign in with MitID (the Danish national eID), we receive and store the proof of sign-in that MitID sends through Idura: your name, your date of birth and age, your stable MitID id and details about the sign-in itself (assurance level and time). We use it to recognise you next time and to be able to document that the sign-in happened with MitID. We do not currently ask for your CPR number (Danish personal identification number) and do not receive it. MitID can only be used on an account where you have connected it yourself.
- Sessions: while you are signed in, the session is stored with IP address and browser, so you can see and end your active sign-ins.
- Sign-in attempts: every attempt to sign in, including failed ones, is stored with IP address, so we can detect and stop attempts to guess passwords.
- History: when you signed in, with which method, and which apps you opened. Without IP address.
- Apps you have given access: which of our apps you have signed in to, so you can see and withdraw the access.
Why we process it
- Performance of a contract (GDPR art. 6(1)(b)): so you can sign in to the systems you use.
- Legitimate interest (art. 6(1)(f)): to keep accounts safe from misuse, detect break-in attempts and show you who has been signed in to your account.
How long we keep it
| Data | Retention |
|---|---|
| The account and your sign-in methods | As long as you have the account |
| A session | 7 days after last use, or until you sign out |
| Sign-in attempts with IP address | 24 hours |
| History (without IP address) | 2 years |
| MitID details (name, date of birth, age, MitID id) | As long as MitID is connected to your account |
When the account is deleted, sessions, history and sign-in methods are deleted with it.
Who we share data with
We never sell data. The app you sign in to receives your name, your email address and your profile picture, and only when you sign in to it. Apart from that we use these data processors:
- Supabase (Stockholm, EU): the database.
- Fly.io (Stockholm, EU): the servers that run BID.
- Cloudflare R2 (EU): profile pictures and encrypted database backups.
- Resend (USA, EU-approved): sending email, e.g. confirmation links.
- GatewayAPI (EU): sending SMS codes, if you use SMS.
- Upmetrics: error monitoring, so we notice when something goes wrong.
- Idura (EU): broker for sign-in with MitID, if you use MitID.
- Gravatar (Automattic, USA): only if you choose a Gravatar picture. The picture is looked up from a hash of your email address.
If you sign in with another provider (Google, Apple, Microsoft, GitHub, LinkedIn or Facebook), that provider's own privacy policy governs what happens on their side.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and to object. Under My account → Privacy and data you can download a copy of what BID knows about you yourself. You correct name, picture and email addresses under My account.
If you are unhappy with how we process your data, you can complain to the Danish Data Protection Agency, Datatilsynet.
How to delete your account and your data
Write to legal@broberg.ai from the email address on your account and ask for the account to be deleted. We confirm that it is you, delete the account and all the data above, and reply when it is done, within 30 days at the latest.
If you signed in with Facebook, you can also remove BID from your Facebook account under Settings → Apps and websites. That stops future sign-ins with Facebook, but does not delete your account with us. Write to us if that should be deleted too.
Deleting your BID account does not delete the data you have in the individual apps. Each app has its own policy for that.