Privacy statement

1. Who we are

Re:group B.V., Albertusstraat 32, 5261 AD Vught, the Netherlands. Chamber of Commerce 98144081, VAT NL868374416B01. For privacy questions, write to support@inconcept.ai.

2. Two roles, and the difference matters

For our own data we are the controller: your account details, your organisation's details, your invoices and the contact we have with you. That is what this statement covers.

For what you put into inConcept we are the processor and you are the controller: your sources, your brand information and the texts you write. We only do with it what you instruct us to. Those arrangements are in the data processing agreement, which you can request from us and which we enter into when the subscription starts.

3. What we process

Four kinds, each for a different reason.

• Account data: your name, email address, password (stored encrypted), your role and which organisations you belong to.
• Content: what you put into the system. Brand information, uploaded sources, briefs and texts. That can contain personal data, for instance when you write about an employee or a resident. What goes in is up to you.
• Usage data: when someone signed in, which actions were taken, how much text was generated and what that cost in processing capacity. We use it to run the service, spot misuse and keep an eye on costs.
• Payment data: your billing details, VAT number and the status of your payments. We never see your card or account number; that stays with our payment provider.
• Newsletter data: your e-mail address and whether you want product news from us, when you subscribe to it, create an account or ask for the report of a brand analysis by mail.

4. Websites and social accounts we read

A brand or person in inConcept can be connected to a website and to an account on LinkedIn, Instagram or Facebook. The customer sets up that connection, or inConcept fills it in when the brand's website links to the account. We only read what is public there, and we never sign in to an account.

What we read and keep:

• From a website: the text of public pages, such as news items, blog posts and the page about the organisation.
• From an account: what it says about itself publicly, meaning the name, the bio, the profile picture and the web address.
• From that account's posts: the text, the link, the date and the number of likes and comments. Not who commented or liked, no private messages and no followers.

What for: so inConcept knows what the organisation does and how it writes. The text of a website goes to the language model to derive the brand voice and the description of the brand. Of the posts, we suggest the best ones as example texts, and we adopt a profile picture or logo as long as the brand or person has none yet. A post kept as an example text goes to the language model when inConcept writes a text.

How: we read LinkedIn, Instagram and Facebook through Apify, and only the last three posts of an account at a time. We read websites ourselves, and we follow what a site asks in its robots.txt.

What we do not do with it: we do not sell this data, do not use it for advertising, share it with no one outside the parties in article 6, and do not use it to train language models.

This data belongs to the account of the customer who made the connection. We are the processor for it, as article 2 describes. When the customer removes a connection, we delete the posts read and the bio right away. How to have data deleted, also if you are not a customer yourself, is on inconcept.ai/gegevens-verwijderen.

5. Why we process it

To perform the agreement: creating an account, having texts written, tracking credits, invoicing.

Because we have a legitimate interest: securing the service, spotting misuse and excessive use, resolving faults and improving the product based on how it is used, for example by counting which steps an account goes through, such as creating a brand profile or writing a first text.

Because the law requires it: our accounting and tax records.

To keep you informed: whoever creates an account receives product news from inConcept now and then. We do that on the basis of the customer relationship, for our own, similar service; you can decline it when creating your account, and unsubscribe afterwards in every mail and in your account settings. Whoever asks for the report of a brand analysis by mail also receives product news now and then afterwards; the form says so, and you can unsubscribe in every mail. Whoever subscribes to the newsletter alone gives consent for it through the confirmation mail.

We don't sell data, and we don't use your content to train language models.

6. Who we involve

We work with a small number of parties needed to run inConcept. They may only use the data to provide their service to us, with LinkedIn as the exception, see below.

• Supabase: database, sign-in and file storage. Data is held in Zurich, Switzerland.
• Vercel: hosting of the application in Frankfurt and cookieless visitor statistics.
• Google (Google Analytics): visitor statistics for the public website, only if you consent to that in the cookie notice. The signed-in part of inConcept is not measured by Google.
• PostHog: statistics on how the website and the app are used, and session recordings, only if you consent to that in the cookie notice. In the signed-in part everything you type or read is made unreadable before it is recorded, and the ids of brands and people are left out of addresses. Without consent PostHog only receives the steps from section 5, under your user id, without a name or e-mail address. The data is held in Frankfurt.
• LinkedIn: measuring whether our ads on LinkedIn work, and showing you an inConcept ad there later, only if you consent to that in the cookie notice. That happens on the public website and when you create an account, not in the signed-in part. LinkedIn also uses this data for its own purposes and is itself responsible for that; LinkedIn's privacy policy explains how.
• Anthropic: the language models that write the texts and help plan. What you include in a brief goes to their servers to produce the result. So do the titles of news items and of appointments in calendars you follow, when inConcept judges whether they fit your brand.
• OpenAI: language models, only for the tasks we set them up for, on the same terms as Anthropic.
• Apify: fetching public posts and profile information from connected LinkedIn, Instagram and Facebook accounts.
• Stripe: payments, invoices and VAT calculation.
• Resend: sending e-mail, such as invitations, notifications and the newsletter, with the list of addresses that receive the newsletter.

7. Data outside the European Union

The database is in Switzerland. That is outside the European Union, but the European Commission has found that Switzerland offers an adequate level of protection, so no extra safeguards are needed for it. Anthropic and OpenAI are based in the United States, and Stripe, Vercel, PostHog and LinkedIn have US parent companies; PostHog holds our data in Frankfurt. Those transfers are covered by the European Commission's standard contractual clauses, together with the arrangements these parties make with us. The current position is set out in the data processing agreement.

8. How long we keep it

Not everything for the same length of time, because not everything has the same reason.

• Your account and your content: for as long as your subscription runs, and 30 days after that so you can still come back.
• Conversations with inConcept: 30 days after the last message. What comes out of them, assignments and texts, simply stays.
• Data from connected websites and accounts: for as long as the connection exists, and gone as soon as the connection, the brand or the person is deleted. A post kept as an example text stays until you delete it. After the subscription ends, the term for your content above applies.
• Backups: rolling, around 30 days, after which they are overwritten automatically.
• Usage and security logs: 12 months.
• Invoices and accounting records: 7 years, because Dutch tax law requires it.
• Contact details from enquiries and conversations: 3 years after our last contact.
• Newsletter: until you unsubscribe. We keep an unsubscription, so that we do not write to you again, not even when you create an account again later.

9. Cookies

inConcept uses two functional cookies: one to keep you signed in and one to remember your language. Without those two the app doesn't work, so no separate consent is needed for them.

For visitor statistics on the public website we use Google Analytics, for how the website and the app are used, PostHog, and to measure whether our ads work, LinkedIn. All three set cookies. That only happens if you consent to it on your first visit. You choose per kind: statistics (Google Analytics and PostHog) and advertising (LinkedIn). Without consent we measure nothing in your browser and no Google, PostHog or LinkedIn cookie reaches your device. You can change your choice at any time via the Cookie settings link at the bottom of every page of the website, and in the app on your account page.

10. How we secure it

Data is encrypted in transit and at rest. In the database, each row records which organisation may access it, so data from different customers can never touch. Access within our team is limited to those who need it and requires two-factor authentication.

11. When we look in

To help with a fault or a question, an administrator of our platform can look inside an organisation. That is read-only: in that mode nothing can be changed, created or deleted. Every occasion is recorded, including who looked, at which organisation and when. You can request that overview from us. While someone is looking along, nothing is measured.

12. Your rights

You may access, correct, delete or transfer your data, and you may object to certain processing. Send a request to support@inconcept.ai; we respond within a month.

How to have data from a connected website or account deleted is set out step by step on inconcept.ai/gegevens-verwijderen.

If your request concerns data held in a customer's account, we are the processor for that and we'll refer you to that organisation. We help them carry out your request.

13. If something goes wrong

In the event of a data breach we notify the customers involved within 72 hours, with what happened, which data is affected and what we are doing about it. Where the law requires it, we also report it to the Dutch Data Protection Authority.

14. Changes and complaints

We may update this statement as the service changes. We'll announce substantial changes in advance.

If you disagree with how we handle your data, tell us. You can also lodge a complaint with the Dutch Data Protection Authority.