Privacy statement

1. Who we are

Re:group B.V., Albertusstraat 32, 5261 AD Vught, the Netherlands. Chamber of Commerce 98144081, VAT NL868374416B01. For privacy questions, write to luuk@inconcept.ai.

2. Two roles, and the difference matters

For our own data we are the controller: your account details, your organisation's details, your invoices and the contact we have with you. That is what this statement covers.

For what you put into inConcept we are the processor and you are the controller: your sources, your brand information and the texts you write. We only do with it what you instruct us to. Those arrangements are in the data processing agreement, which you can request from us and which we enter into when the subscription starts.

3. What we process

Four kinds, each for a different reason.

• Account data: your name, email address, password (stored encrypted), your role and which organisations you belong to.
• Content: what you put into the system. Brand information, uploaded sources, briefs and texts. That can contain personal data, for instance when you write about an employee or a resident. What goes in is up to you.
• Usage data: when someone signed in, which actions were taken, how much text was generated and what that cost in processing capacity. We use it to run the service, spot misuse and keep an eye on costs.
• Payment data: your billing details, VAT number and the status of your payments. We never see your card or account number; that stays with our payment provider.

4. Websites and social accounts we read

A brand or person in inConcept can be connected to a website and to an account on LinkedIn, Instagram or Facebook. The customer sets up that connection, or inConcept fills it in when the brand's website links to the account. We only read what is public there, and we never sign in to an account.

What we read and keep:

• From a website: the text of public pages, such as news items, blog posts and the page about the organisation.
• From an account: what it says about itself publicly, meaning the name, the bio, the profile picture and the web address.
• From that account's posts: the text, the link, the date and the number of likes and comments. Not who commented or liked, no private messages and no followers.

What for: so inConcept knows what the organisation does and how it writes. The text of a website goes to the language model to derive the brand voice and the description of the brand. Of the posts, we suggest the best ones as example texts, and we adopt a profile picture or logo as long as the brand or person has none yet. A post kept as an example text goes to the language model when inConcept writes a text.

How: we read LinkedIn, Instagram and Facebook through Apify, and only the last three posts of an account at a time. We read websites ourselves, and we follow what a site asks in its robots.txt.

What we do not do with it: we do not sell this data, do not use it for advertising, share it with no one outside the parties in article 6, and do not use it to train language models.

This data belongs to the account of the customer who made the connection. We are the processor for it, as article 2 describes. When the customer removes a connection, we delete the posts read and the bio right away. How to have data deleted, also if you are not a customer yourself, is on inconcept.ai/gegevens-verwijderen.

5. Why we process it

To perform the agreement: creating an account, having texts written, tracking credits, invoicing.

Because we have a legitimate interest: securing the service, spotting misuse and excessive use, resolving faults and improving the product based on how it is used.

Because the law requires it: our accounting and tax records.

We don't sell data, and we don't use your content to train language models.

6. Who we involve

We work with a small number of parties needed to run inConcept. They may only use the data to provide their service to us.

• Supabase: database, sign-in and file storage. Data is held in the European Union.
• Vercel: hosting of the application and cookieless visitor statistics.
• Simple Analytics: visitor statistics for the public website, without cookies and without profiles. The data is held in the Netherlands. The signed-in part of inConcept is not measured.
• Anthropic: the language models that write the texts. What you include in a brief goes to their servers to produce the result.
• Apify: fetching public posts and profile information from connected LinkedIn, Instagram and Facebook accounts.
• Stripe: payments, invoices and VAT calculation.
• Resend: sending email, such as invitations and notifications.

7. Data outside the European Union

Anthropic is based in the United States, and Stripe and Vercel have US parent companies. Those transfers are covered by the European Commission's standard contractual clauses, together with the arrangements these parties make with us. The current position is set out in the data processing agreement.

8. How long we keep it

Not everything for the same length of time, because not everything has the same reason.

• Your account and your content: for as long as your subscription runs, and 30 days after that so you can still come back.
• Conversations with inConcept: 30 days after the last message. What comes out of them, assignments and texts, simply stays.
• Data from connected websites and accounts: for as long as the connection exists, and gone as soon as the connection, the brand or the person is deleted. A post kept as an example text stays until you delete it. After the subscription ends, the term for your content above applies.
• Backups: rolling, around 30 days, after which they are overwritten automatically.
• Usage and security logs: 12 months.
• Invoices and accounting records: 7 years, because Dutch tax law requires it.
• Contact details from enquiries and conversations: 3 years after our last contact.

9. Cookies

inConcept uses two functional cookies: one to keep you signed in and one to remember your language. Without those two the app doesn't work, so no separate consent is needed for them.

Our visitor statistics are cookieless: nothing is stored on your device and you are not tracked across websites. If we start measuring more for marketing later, we'll ask for consent first and update this statement.

10. How we secure it

Data is encrypted in transit and at rest. In the database, each row records which organisation may access it, so data from different customers can never touch. Access within our team is limited to those who need it and requires two-factor authentication.

11. When we look in

To help with a fault or a question, an administrator of our platform can look inside an organisation. That is read-only: in that mode nothing can be changed, created or deleted. Every occasion is recorded, including who looked, at which organisation and when. You can request that overview from us.

12. Your rights

You may access, correct, delete or transfer your data, and you may object to certain processing. Send a request to luuk@inconcept.ai; we respond within a month.

How to have data from a connected website or account deleted is set out step by step on inconcept.ai/gegevens-verwijderen.

If your request concerns data held in a customer's account, we are the processor for that and we'll refer you to that organisation. We help them carry out your request.

13. If something goes wrong

In the event of a data breach we notify the customers involved within 72 hours, with what happened, which data is affected and what we are doing about it. Where the law requires it, we also report it to the Dutch Data Protection Authority.

14. Changes and complaints

We may update this statement as the service changes. We'll announce substantial changes in advance.

If you disagree with how we handle your data, tell us. You can also lodge a complaint with the Dutch Data Protection Authority.