Privacy Policy

1. Introduction

DigiData B.V. (Chamber of Commerce number: 96280328), located at Stationsweg 72, 9471 GT Zuidlaren (“DigiData”, “we”, “us”), is responsible for the processing of personal data as described in this privacy policy. We respect and treat your privacy personal data with the utmost care, in accordance with the General Regulation Data protection (GDPR).

2. What data do we collect?

We collect and process the following categories of data:

Account information

• Name and email address (when registering)
• Company name
• Login details (password is stored encrypted)

Integration data

• API keys and tokens for associated applications (stored encrypted)
• Sync settings and progress

Synchronized business data

• Data imported from your connected applications (e.g. customer data, invoices, projects, employee information)
• This data is and remains fully the property of you as a customer

Technical data

• IP address and browser information (for security and debugging)
• Synchronization activity logs

3. How do we collect data?

• Directly from you: when you create an account, log in or change settings.
• Via linked applications: When you set up an integration, DigiData automatically retrieves data via the API of the relevant application. This is done solely based on your configuration and with your permission.
• Automatic: technical data such as IP address is automatically collected when using our service.

4. What do we use your data for?

We only use your data for the following purposes:

• Services: synchronizing data from your linked applications and making it available to you.
• Account management: creating and managing your account.
• Security: protecting your account and our infrastructure.
• Communication: answering your questions or requests.

We do not use your synchronized company data for anything else. We do not have access to the content of your data and do not use it for analysis, marketing or any other purpose. Your data is and remains yours.

5. Basis for processing

We process personal data on the basis of the following legal grounds (Article 6 GDPR):

• Execution of an agreement: providing our service to you.
• Consent: When you set up an integration, you give permission for data to be retrieved from the relevant application.
• Legitimate interest: security of our service and infrastructure.

6. Retention periods

• Account details: are kept as long as you have an active account. After cancellation, your data will be deleted within 30 days.
• Synced data: is kept as long as the relevant integration is active. When deleting an integration, the associated data is immediately deleted.
• Log files: are kept for a maximum of 90 days.
• API keys and tokens: are immediately deleted when you unlink an integration.

7. Your Rights

Under the GDPR you have the following rights:

• Right of access: you can request which data we process about you.
• Right to rectification: you can have incorrect data corrected.
• Right to deletion: you can request the deletion of your data.
• Right to restriction: you can have the processing of your data restricted.
• Right to data portability: you can receive your data in a structured format.
• Right to object: you can object to the processing of your data.
• Right to withdraw consent: you can withdraw previously given consent at any time.

8. Withdraw consent and delete data

You can withdraw your consent and/or request deletion of submit personal data:

• In the app itself: You can disconnect your integrations and delete your data at any time via your DigiData account.
• By email: send a request to info@digi-data.nl and we will process your request as quickly as possible, at the latest within 30 days.

Once deleted, all your synced data, account information and saved credentials will be deleted permanently deleted. This cannot be undone.

9. Security

We take appropriate technical and organizational measures to protect your data against unauthorized access, loss or misuse. Your data is therefore protected at all times. This includes:

• Encryption of API keys and passwords
• Two-factor authentication (2FA) for account access, so only you can access your data
• IP whitelisting: you can set that only certain IP addresses have access to your account and data
• Separate storage per customer (multi-tenant isolation)
• Access restriction to production systems
• Regular security updates

10. Sharing with third parties

We do not share your data with third parties unless this is necessary for the delivery of our service (for example hosting providers) whether we are legally obliged to do so. With processors who have access to your data, we conclude a processing agreement.

External AI assistant via MCP, such as the DigiData app in ChatGPT

A DigiData administrator can connect an external assistant such as ChatGPT or Claude. The administrator approves that connection in DigiData and decides which sources, tables and columns the assistant may read. DigiData only passes on that data, and only when the assistant asks for it in a conversation.

If the administrator also allows the connection to manage, the assistant can create AI agents, change their data access, and view, create, change and delete the dashboards and measurements of the customer's AI agents. These use the data access set up for the agent itself; through the connection an agent only gets tables and columns the connection may read itself, and their results, such as measurement values and an image of a dashboard, then also go to the assistant. The connection cannot connect integrations, receive credentials, or change users, security or billing.

If the administrator switches this on, a viewer can also connect an assistant of their own. That assistant only reaches the AI agents the administrator shared with that viewer: it can ask questions about the data those agents may read and see their dashboards, and it cannot change anything.

For each call we only keep technical details: which function, when, how long it took, how many rows and whether it succeeded. We do not keep the questions from the conversation or the data retrieved. DigiData and the Azure model service configured for DigiData do not use customer questions or business data to train models. All user and application data that DigiData itself stores is kept in the EU.

The transfer via MCP is an export authorized by the customer. The chosen external assistant can then process or keep its own copy under that provider's contract, subscription, settings and retention periods. DigiData's guarantee of EU storage does not apply to that separate copy at the external provider, so check the workspace policy and privacy terms of the chosen assistant before connecting it. An administrator can always narrow or revoke the connection under Settings > AI connections.

The Digi Mates app for iPhone, iPad and Android

Digi Mates is our app for people who already have a DigiData account. You log in with that account; you cannot create an account or pay in the app. The app shows no ads and contains no analytics or tracking tools.

• Chats: your questions, the answers of your AI agents and the photos and files you add go to DigiData and are stored with your account, just like chats on the website. To answer, DigiData sends your question, your attachments and the business data the agent needs to the Azure model service configured for DigiData, which does not use them to train models.
• Voice mode: what you say is turned into text by your device's speech recognition: Apple's on iPhone and iPad, and the speech service set on your Android device (usually Google's). Only that text reaches DigiData; we receive no recording of your voice. To read answers aloud, DigiData sends the answer text to ElevenLabs, which turns it into speech. We store that audio with the chat.
• Push notifications: if you allow notifications, the app gives DigiData a device code to send them to. We send them through Apple Push Notification service (iPhone and iPad) and Google's Firebase Cloud Messaging (Android). A notification contains the name of the automation and a short preview of its result.
• Face ID and fingerprint: unlocking the app with your face, fingerprint or PIN happens entirely on your device. DigiData receives no biometric data.
• On your device: the app keeps your login session so you stay logged in. Logging out removes it.

11. Cookies

Our website uses functional cookies that are necessary for its functioning of the service (such as session cookies for logging in). We do not post tracking or marketing cookies without your explicit consent.

For website statistics we use PostHog, which processes the data for us on servers in the European Union. PostHog places an analytics cookie to recognise returning visits, and we record how visitors use the website in order to improve it. If you fill in the contact form, we link your visit to your name and email address.

A cookie notice on our website asks for your consent to ad measurement. Only if you give it do we load the measurement pixel from OpenAI. That pixel places cookies and sends data about your visit to OpenAI, such as the pages you view and the submission of the contact form. This is how we measure whether ads in ChatGPT deliver results. If you fill in the contact form, the pixel can include contact details such as your name, email address and phone number in hashed form to link your visit to an ad. You can change your choice at any time via "Cookie settings" at the bottom of every page.

If you reach our website through an ad in ChatGPT and then submit a form, we tell OpenAI that this ad click led to a request. We do this from our own server, without cookies and regardless of your cookie choice. We only send the click reference that OpenAI itself added to the ad link, and the page on which you submitted the form. We do not send your name, email address or message.

To protect our forms against spam we use Cloudflare Turnstile. As soon as you open a form, Turnstile checks in the background whether a person is using it. For this, Cloudflare processes data such as your IP address and properties of your browser, only to recognise spam and abuse. Usually you will not notice anything; only when the check is unsure do we ask you to tick a box.

12. Submit a complaint

Do you have a complaint about the processing of your personal data? Please contact us via info@digi-data.nl. You also have the right to file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

13. Changes

We reserve the right to change this privacy policy. Changes will be posted published this page. In case of substantial changes we will inform you by e-mail.

14. Contact

If you have any questions about this privacy policy or the processing of your personal data, please contact us: