Privacy policy, AIGeschikt

This is an English translation for convenience. The Dutch version is legally binding.

AIGeschikt is a brand name of VSMD V.O.F., located at Westzeedijk 102 (unit 1), 3016 AH Rotterdam, registered with the Chamber of Commerce (KvK) under number 42097283 (VAT ID NL869705234B01). VSMD V.O.F. is the controller for the processing operations described in this policy. We attach great importance to the privacy of our users and process personal data exclusively in accordance with the General Data Protection Regulation (GDPR).

1.What data do we process?

We process only the data that is necessary to provide our service:

Account and contact data – name, email address and (for business use) company name, which you provide when creating an account or taking out a subscription.
Website and domain data – the URL(s) you have us analyze and the resulting measurement and content results.
CMS login credentials – if you give us access to your content management system (such as WordPress) to publish approved content. These credentials are stored encrypted and used solely for that purpose.
Billing data – address, Chamber of Commerce (KvK) number and VAT number, and invoice history, to the extent necessary for a VAT-compliant invoice.
Payment data – payments are processed by Mollie B.V. We do not ourselves store any payment card or bank account numbers.
Technical log data – IP address and browser type, for security and troubleshooting. This data is retained for a maximum of 30 days.
Free AI scan – the web address you have scanned and, if you wish to receive the result by email, your email address.
Appointment data – name, email address and the selected time slot if you schedule a meeting through our website.
Usage and error data – only if you consent to it: how you use our website and the dashboard, technical errors in your browser, and session recordings (see Article 9). Errors that occur on our own servers are always logged by us, without cookies, to keep the service running.

2.What do we use your data for?

Performing the GEO measurements and analyses, and generating and publishing content.
Managing your account and displaying results in the dashboard.
Sending the approval, service and results emails that are part of the service.
Processing your payment and preparing and sending invoices.
Performing the free AI scan and sending you the result, and scheduling meetings that you request yourself.
Improving our website and service and detecting errors, using usage data for which you gave consent.
Securing our service, preventing fraud and complying with legal obligations.

We do not use your email address for marketing communications unless you have expressly consented to this.

3.Legal basis for processing

We process your personal data on the basis of:

Performance of the contract – to be able to provide the service (Art. 6(1)(b) GDPR).
Legitimate interest – for security, fraud prevention, logging errors on our servers and the proper functioning of our service (Art. 6(1)(f) GDPR).
Legal obligation – for retaining invoice data in accordance with the statutory tax retention obligation (Art. 6(1)(c) GDPR).
Consent – for analytical cookies and session recordings (Article 9), and otherwise only to the extent that we ask you for it separately, for example for optional newsletters (Art. 6(1)(a) GDPR and Art. 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet)). You can withdraw any consent given at any time; this does not affect the processing carried out before the withdrawal.

4.Retention periods

Account and content data: for the duration of the subscription and up to a maximum of 12 months after termination, after which it is deleted or anonymized.
CMS login credentials: until you terminate the subscription or the connection, after which they are deleted.
Google access tokens: until you disconnect the connection (they are then deleted immediately), and at the latest until the moment the account data is deleted after termination.
Invoice and payment data: 7 years in accordance with the statutory tax retention obligation.
Technical log data: a maximum of 30 days.
Free AI scan data: up to a maximum of 12 months after the scan, unless you become a customer; in that case the retention periods for account data apply.
Session recordings: 30 days. Other usage and error data at PostHog: a maximum of 1 year.
Visitor data of our website in Google Analytics: 14 months.

5.Third parties / sub-processors

We use the following external parties to provide our service. We conclude a data processing agreement with parties that act as processors:

Supabase – database, authentication and storage (hosting within the EU).
DigitalOcean LLC (US/EU) – server hosting. Our servers are located in Europe (Amsterdam).
OpenAI (US) – AI analysis and content generation.
Anthropic (US) – AI content generation (Claude).
Perplexity (US) – AI visibility measurements.
Google (Gemini) (US) – AI processing of documents and insights.
Firecrawl (US) – crawling and retrieving web page content.
Mollie B.V. (NL) – payment processing. Mollie is PCI DSS certified and regulated by De Nederlandsche Bank.
Loops (US) – sending transactional and lifecycle emails.
e-Boekhouden.nl (NL) – preparing VAT-compliant invoices.
Cal.com (storage in the EU) – scheduling meetings that you request through our website.
PostHog (storage in the EU) – product analytics, error monitoring and session recordings of our website and the dashboard (see Article 9).
Google Ireland Limited (Google Analytics) – visitor statistics for our website: where visitors come from and which pages they view (see Article 9).

We do not provide your data to any other third parties unless we are legally required to do so.

6.Data from Google services

You can connect your Google account to AIGeschikt. This always happens on your own initiative, through Google’s consent screen, and only with read-only permissions. For each connection, we read the following:

Sign in with Google – your name, email address and profile picture, to create your account and let you sign in.
Google Search Console (read-only) – the list of websites you have access to, and, for the website you choose, the search performance: search queries, pages, clicks, impressions and positions.
Google Analytics 4 (read-only) – the list of GA4 properties you have access to, and, for the property you choose, aggregated daily figures: number of sessions and engaged sessions per traffic source and landing page, key events (conversions) and revenue. We do not read any data about individual visitors, and for a landing page we store only the path, without the query string.

Purpose. We use this data solely to show you in your dashboard how your website is performing, in particular how much traffic, how many conversions and how much revenue come in through AI assistants (such as ChatGPT, Perplexity and Gemini), and to base the analyses and content we create for you on that data. We do not use it for advertising, do not sell it, and do not use it to train general AI models.

Sharing. We do not share this data with third parties, except with the sub-processors listed in Article 5 to the extent necessary to provide these features (storage at Supabase, and the AI processing with which we prepare the analyses in your dashboard), or if the law requires us to do so.

Storage and security. We store the Google access token encrypted. Only our servers use it, to periodically retrieve the data described above.

Withdrawal and deletion. You can disconnect a connection at any time in your dashboard. We will then immediately delete the access token. You can also revoke access via myaccount.google.com/permissions. Figures that have already been retrieved are retained in accordance with the periods in Article 4, unless you ask us to delete them sooner via [email protected].

Google API Services User Data Policy. AIGeschikt’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6a. The AIGeschikt app in ChatGPT

You can connect AIGeschikt as an app in ChatGPT. You then sign in with your AIGeschikt account; ChatGPT does not get access to your password. The app only works with the data of your own account and websites.

What we receive from ChatGPT. Only what ChatGPT sends along in a call to the app, and only for the action you ask for:

Blog texts you have saved or scheduled: title, text, description, section, the chosen moment and, if you add one, an image.
Your choices and settings, such as what you think of a suggested topic and whether your blogs address the reader formally or informally.
Messages you pass on to us through the app (a question, request or problem).
The outline of a blog that the app shows you, possibly with a few practical details about your business that go into that blog. We only show that outline; we do not store it.

We do not receive your conversations with ChatGPT, your chat history or ChatGPT’s memory. We do record when you last used the app, and which actions you took with it (such as saving, scheduling, cancelling or taking offline), so that you and we can check what happened to your blogs.

For what purpose. To store your blogs and publish them on your own website at the moment you chose, to apply your settings, and to answer your messages. What you store is not used for other customers and not used to train general AI models.

What ChatGPT receives from us. The app sends ChatGPT the data that belongs to your question: your measurements, topics, writing brief and the blogs in your account. OpenAI processes this as part of your conversation, under OpenAI’s own terms and privacy policy; OpenAI is responsible for that itself.

Retention and disconnecting. What you store through the app falls under the retention periods for account and content data in article 4. You can disconnect the app at any time in ChatGPT’s settings; your blogs then remain in your AIGeschikt account. If you want them deleted, email [email protected].

7.Transfers outside the European Economic Area

Some of the sub-processors listed above are established in the United States. To the extent that personal data is processed outside the EEA in that context, this takes place on the basis of appropriate safeguards within the meaning of the GDPR, in particular the standard contractual clauses (Standard Contractual Clauses) adopted by the European Commission and, where applicable, the EU-US Data Privacy Framework. We process as little personal data as possible through these parties.

8.Your rights

Under the GDPR, you have the following rights:

Right of access – you can request which of your data we process.
Right to rectification – you can have inaccurate data corrected.
Right to erasure – you can request that your data be deleted.
Right to restriction – you can request that the processing be restricted.
Right to object – you can object to processing based on legitimate interest.
Right to data portability – you can receive your data in a commonly used format or have it transferred.
Right to withdraw consent – where processing is based on consent, you can withdraw it at any time.

We do not make decisions about you that are based solely on automated processing and that produce legal effects or otherwise significantly affect you (Art. 22 GDPR). The AI models we use analyze websites and write content; they do not decide anything about individuals.

You can send requests to [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

9.Cookies

AIGeschikt does not use advertising cookies and does not share data with advertising networks. We use two types of cookies and similar browser storage:

Functional cookies – strictly necessary for the operation of the service, such as keeping track of the fact that you are logged in.
Analytical cookies from PostHog – on our website and in the dashboard, PostHog places a cookie and an entry in your browser’s local storage (both with a name beginning with ph_). These contain a random visitor ID, so that consecutive page views are recognized as a single visit. The cookie is valid for a maximum of 1 year.
Analytical cookies from Google Analytics – only on our website, not in the dashboard. Google Analytics places cookies with a name beginning with _ga, containing a random visitor ID. We have configured them for a maximum of 1 year.

With PostHog, we measure how our website and the dashboard are used, in order to improve the service; we capture technical errors in your browser; and we make session recordings: a replay of what happened on the screen (clicks, scrolling, navigation). In these recordings all input fields are masked, so that what you type (such as passwords and connection credentials) is not recorded, and we remove access codes from the recorded web addresses. Visitors who are not logged in remain anonymous; anyone who logs in is linked to their account. PostHog stores this data in the EU.

With Google Analytics, we see where visitors to our website come from (for example a search engine or an AI assistant such as ChatGPT), which pages they view and whether they, for example, start a scan or get in touch. We do not share this data with Google for advertising: Google signals and ad personalization are turned off, and we have accepted Google’s data processing terms. Google Analytics does not store IP addresses. We remove access codes from the recorded web addresses before they are sent to Google. Google may process this data in the United States (see Article 7).

Your choice. We place the analytical cookies only if you consent to them on your first visit. Until you make a choice, and if you decline, PostHog and Google Analytics record nothing and place nothing; in that case Google Analytics is not loaded either. We remember your choice in your browser’s local storage. You can change it or withdraw your consent at any time via ‘Cookie settings’ at the bottom of every page of our website; upon withdrawal, we remove the PostHog and Google Analytics cookies from your browser. You can also always delete or block cookies through your browser settings. The service continues to work normally without analytical cookies.

10.Security

We take appropriate technical and organizational measures to secure your personal data, including encrypted connections (HTTPS/TLS), encrypted storage of sensitive data such as CMS login credentials, restricted access to personal data, and regular security checks.

11.Data protection officer

Given the nature and scope of our processing activities, we are not legally required to appoint a data protection officer and have not done so. For all privacy questions, you can contact us at the contact address below.

12.Changes to this privacy policy

We may amend this privacy policy from time to time. The most current version is always available on this page, stating the version number and the effective date. In the event of material changes, we will actively inform you where possible.

13.Contact

VSMD V.O.F. · trading under the brand name AIGeschikt
Westzeedijk 102 (unit 1), 3016 AH Rotterdam
Email: [email protected]
Phone: 06-15602095
Chamber of Commerce (KvK): 42097283 · VAT ID: NL869705234B01

Privacy Policy