Privacy Policy

Summary

We process personal data exclusively on a legal basis under GDPR (contract, consent, legitimate interest or legal obligation). Data is hosted in the EU, secured with encryption in transit and at rest, and processed with strict role and tenant isolation.

Data subjects can request access, correction, deletion, restriction, portability and objection at any time.

Processors

• Mollie B.V. for payment processing (EU)
• Supabase for platform hosting (EU region)
• Anthropic/OpenAI for AI features under applicable safeguards

Knowledge Risk Check (free self-assessment)

We offer a free self-assessment that helps companies see in which areas critical knowledge depends on a few people. It can be used without registration and without providing personal data.

• Answers: only selected options from predefined choices. There are no free-text fields; we collect no names, no information about individual employees and no trade secrets.
• Technical data of a run: start and completion time, selected areas, questionnaire version and, if present, campaign parameters from the link (utm_source, utm_medium, utm_campaign).
• Access key: your result is reachable via a randomly generated link. We store only a cryptographic hash (SHA-256) of that key; the key itself exists only in your address bar.
• No IP addresses: we do not store IP addresses for the self-assessment. To protect against automated mass requests, the IP address is processed briefly and only as a hash with a daily changing salt in a temporary cache.
• Optional email address and company: only if you want to receive the result by email (consent, Art. 6(1)(a) GDPR; the box is not pre-ticked; we store the time and version of the consent text). We create an entry in our prospect list (CRM) so that we can take your result into account in a conversation. If you book a consultation with the same email address, we attach a short summary of your result to the appointment. The result link itself is not stored.
• Retention and deletion: runs without an email address are deleted automatically after 90 days at the latest. With the delete link in the result email you can delete your run, your answers and your contact details at any time; the CRM entry is removed as well. If we have already contacted you or you have booked an appointment, that business contact remains, but the result data is removed from it. For complete deletion write to [email protected].
• Recipients: Supabase (storage, EU region), Resend (email delivery, only if you request the result by email) and Upstash (temporary cache for abuse protection; processes only the IP hash described above).
• No automated decision-making: the result is based on a fixed, transparent calculation rule. No artificial intelligence is used and no individual persons are assessed.
• Measurement without third parties: we only record timestamps on the anonymous run (started, completed, demo or pilot request). No cookies are set and no third-party analytics are used.