Privacy policy
Last updated: 12 October 2026
This policy explains which personal data [Legal name B.V.] ("Mandistry", "we") processes, why, and what your rights are under the General Data Protection Regulation (GDPR / AVG).
1. Who we are
[Legal name B.V.], [Street + number], [1234 AB] [City], The Netherlands. Chamber of Commerce (KvK) [KvK number].
Privacy questions: [privacy@yourdomain.nl].
2. Controller or processor
For visitors of this website, people who contact us and the account and billing details of our customers, we are thecontroller. For the content our customers put into Mandistry (instructions, chats, tasks, files, memory, run logs) we are a processor acting on our customer's instructions; that is covered by ourdata processing agreement.
3. What we process, why, and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, e-mail, company, message (contact form & chat) | Answering your question, sales follow-up | Legitimate interest / steps prior to a contract (art. 6(1)(f) and (b)) | 12 months after last contact |
| Account data: name, e-mail, role, company, login data | Providing the service, support | Performance of the contract (art. 6(1)(b)) | Term of the contract + 30 days |
| Billing data: company name, address, VAT number, payment details | Invoicing and bookkeeping | Contract and legal obligation (art. 6(1)(b) and (c)) | 7 years (Dutch tax retention obligation) |
| Security and usage logs: IP address, timestamps, audit log | Security, abuse prevention, troubleshooting | Legitimate interest (art. 6(1)(f)) | Server logs 90 days; audit log as per your plan |
| Service e-mails (billing, security, changes) | Informing customers about their service | Performance of the contract | Term of the contract |
We do not use tracking cookies or third-party analytics on this website, we do not sell personal data, and we do not use customer content to train AI models.
4. Who receives data
We use the following categories of processors, with whom we have data processing agreements:
- Hosting and infrastructure: [Hosting provider, data centre in the EU]
- E-mail delivery: [provider]
- Payments and invoicing: [provider]
AI model providers (such as Anthropic or OpenAI) receive data only when our customer connects them and lets an agent use them; that happens on the customer's instruction, under the customer's own agreement with that provider.
5. Transfers outside the EEA
We host customer data in the EU. If a processor of ours transfers data outside the European Economic Area, we make sure an adequate safeguard applies, such as an adequacy decision (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.
6. Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, encrypted secrets, isolation between customers, role-based access, audit logging and encrypted backups. See oursecurity page.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time. Send your request to[privacy@yourdomain.nl]; we respond within one month. If your data is in a customer's Mandistry workspace, we forward your request to that customer.
You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), though we would appreciate the chance to solve it with you first.
8. Automated decision-making
We do not take decisions about you based solely on automated processing that have legal or similarly significant effects.
9. Changes
We may update this policy. The date at the top shows the latest version; we inform customers of material changes by e-mail.