Last updated .
This site is run by AI INVESTMENT GROUP B.V., Kerkstraat 144-1, 1017 GR Amsterdam, Netherlands, KVK 99923467. We are the controller of the personal data described below. For anything to do with your data, write to [email protected].
The short version: we collect what you type into the quote form, plus the server logs any website produces. We use it to answer you and to do the work. We do not run analytics, we do not track you across sites, we set no cookies of our own, and we never sell anything to anyone.
What we collect, and why we are allowed to
When you ask for a quote
The form on the contact page asks for your name, email address, website URL, roughly how many pages the site has, and your message. It arrives with us by email.
- Why: to reply, to look at your site, and to prepare a quote.
- Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering a contract. If we go on to do the work, the same basis covers delivering it.
When you subscribe to the newsletter
The blog carries a subscription form. It asks for your email address and sends you a confirmation email before anything else.
- Why: to send you the newsletter you asked for.
- Legal basis: Article 6(1)(a) GDPR, your consent. You can withdraw it at any time using the unsubscribe link in any issue, or by writing to us. Withdrawing does not affect anything sent before you did.
When you simply read the site
Our host records the requests it serves: IP address, browser and device, the pages requested, and the time. Every web server does this.
- Why: to keep the site available, diagnose faults, and defend against abuse.
- Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a working and secure website. We use these logs for nothing else, and never to build a profile of you.
What we do not do
- No analytics. No Google Analytics, no Plausible, no Meta pixel, nothing counting you.
- No advertising or cross-site tracking, and no data sold or rented to anyone.
- No cookies of our own. See the cookie statement.
- No automated decision-making or profiling that produces legal effects for you.
Who else sees it
Only the providers that make the site and our email work, and only for that purpose. Each acts on our instructions as a processor.
| Provider | What it does | What reaches it | Where |
|---|---|---|---|
| Railway Corporation | Hosting. Runs this website and the server that receives the quote form. | Everything sent to the site, plus standard server logs (IP address, browser, pages requested). | United States |
| Resend, Inc. | Email delivery. Sends us the quote requests submitted through the form. | Your name, email address, website URL, and whatever you write in the message. | United States |
| The DFYe newsletter service | Runs the email newsletter you can subscribe to from the blog. | Your email address, and the fact that you confirmed the subscription. | United States (hosted on Railway) |
We also disclose personal data where the law requires it, for example to a court or a public authority acting within its powers.
Transfers outside Europe
The providers above are established in the United States, so data reaching them leaves the European Economic Area. Each publishes a data processing agreement incorporating the European Commission's standard contractual clauses, which is the safeguard those transfers rely on under Article 46 GDPR. You can ask us for a copy of the relevant clauses.
How long we keep it
| What | How long | Why that long |
|---|---|---|
| Quote requests that do not become projects | 12 months | So we recognise you if you come back, and can show how an enquiry was handled. |
| Project correspondence and records | 7 years after the last invoice | Dutch tax law requires business records to be kept for seven years (art. 52 AWR). |
| Newsletter subscription | Until you unsubscribe | Consent lasts until you withdraw it. We then keep only the fact that you opted out, so we do not mail you again. |
| Server logs | Kept by our host on its own retention schedule | They exist for security and fault diagnosis, and are not copied anywhere by us. |
Your rights
Under the GDPR you can ask us to:
- Give you access to the personal data we hold about you, as a copy.
- Correct anything inaccurate or incomplete.
- Erase it, where we have no overriding reason to keep it. The seven-year tax retention above is such a reason, and we will say so if it applies.
- Restrict how we use it while a dispute about accuracy or grounds is resolved.
- Receive it in a portable form, machine-readable, for data you gave us that we hold on the basis of consent or a contract.
- Object to processing based on our legitimate interests, on grounds relating to your situation.
- Withdraw consent at any time, where consent is the basis.
Write to [email protected]. We answer within one month, as Article 12(3) requires, and we do not charge for it. If we need to confirm who you are before handing over a copy of your data, we will ask for the least we can get away with.
If we get it wrong
Tell us first and we will fix it. You also have the right to complain to the Autoriteit Persoonsgegevens, the data protection supervisory authority in the Netherlands, or to the authority where you live or work.
Is any of it required?
None of it is required by law or by contract. You do not have to fill in the form or subscribe to anything. The only consequence of not doing so is that we cannot answer your question, because we would not know what to look at or where to send the answer.
Changes
If this policy changes, the date at the top changes with it. Material changes affecting data we already hold will be told to you directly where we have a way to reach you. Questions: [email protected].