Privacy policy

1. Who we are

Besona B.V., with its registered office at Kralingen 49, 1566 CC Assendelft, and registered with the Dutch Chamber of Commerce under number 42179813, is the data controller for personal data processed through the werkbonnen.ai website and app, as described in this policy.

2. Who this policy applies to

• Visitors to our website;
• Customers who have purchased a licence to use the app (“account holders”);
• Employees added to an account by a licence holder or administrator.

3. What data we collect and why

3.1 Website visitors

When you visit our website, we may collect your IP address, browsing activity and device information through cookies and similar technologies (see section 8).

We also collect information you provide yourself, such as your email address when you join our waiting list.

3.2 Licence holders (account holders)

When you purchase a licence, we process the primary user’s name, email address and telephone number, as well as the company name, Chamber of Commerce registration number, VAT number and bank account number. Bank account details are processed through our payment provider, Stripe.

3.3 Employees added by a licence holder

A licence holder (administrator) can add employees to their account. We process these employees’ names, email addresses and telephone numbers to provide their individual (sub)licences and give them access to the app.

3.4 Customer data entered by licence holders

Licence holders can enter information about their own private and business customers into the app, for example for work orders, reports and invoices.

For this data, Besona acts as a data processor on behalf of the licence holder. We do not use this data for our own purposes. The arrangements for processing this data are set out in our data processing agreement with the licence holder.

3.5 Data collection and processing

3.5.1 To provide, operate, secure and improve the Werkbonnen.ai platform (“the platform”), we may process various types of data. Depending on how account holders and their users use the platform, this may include:

• account and user details, including names, contact details, permissions and roles;
• work orders, tasks, appointments, schedules and time records;
• information about materials and services used or supplied;
• photos, documents and other attachments uploaded by account holders or users;
• notes, transcripts and information generated or organised by AI features;
• audio recordings and voice data when users use voice features, such as dictating a work order;
• technical information, including device details, login and security data, crash reports and diagnostic data;
• push notification tokens and other information needed to send and deliver push notifications;
• data imported or exchanged through integrations with accounting software or other third-party services.

3.5.2 This data may be provided directly by account holders or users, collected automatically when they use the platform, generated by platform features, or obtained through third-party integrations activated by the account holder.

3.5.3 We process this data as needed to provide and operate the platform. This includes fulfilling our agreement with the account holder, providing the features they use, processing and synchronising data, securing and maintaining the platform, investigating and resolving technical issues, and running AI features where applicable.

3.5.4 We may use third parties to provide certain features, including hosting, infrastructure, notification, accounting and AI service providers.

These providers may process data to the extent necessary to deliver the relevant service. Where this involves personal data, processing takes place in accordance with our data processing agreement, this privacy policy and applicable data protection laws.

3.5.5 Our data processing agreement provides further information about the categories of personal data we process, the purposes and legal bases for processing, recipients or categories of recipients, retention periods and individuals’ rights.

3.6 App usage statistics

To improve the app, we measure how it is used, such as which features you use, your app version and type of device. We link this to your account through an internal ID. Content such as customer details, work orders, photos and voice recordings is not included. You can object by emailing privacy@werkbonnen.ai.

4. Legal bases for processing

We process personal data on the following legal bases:

• Performance of a contract: to provide the app and licence and process payments.
• Legal obligations: for example, to meet tax record-keeping requirements.
• Legitimate interests: for example, to secure our systems, carry out basic website analysis and collect app usage statistics (see 3.6).
• Consent: where required, for example for non-essential cookies (see section 8).

5. How long we keep your data

We keep licence holders’ account data for as long as their licence is active. After the licence ends, we keep this data for a further 30 days before deleting it.

We keep invoice data for 7 years to meet statutory tax record-keeping requirements.

For trial accounts, we keep account data for 30 days after the trial ends, giving businesses time to convert their trial account into a full licence.

6. Who we share data with

We use the following service providers (sub-processors) to deliver our services:

• Supabase — Frankfurt, Germany (EU)Database, file storage and sign-in
• Railway — Amsterdam, the Netherlands (EU)Hosting our server (API)
• Vercel — Global network, Vercel Inc. (US)Hosting the website and web app
• OpenRouter — USRouting AI requests, such as speech to text and filling in work orders
• OpenAI — USAI models for speech recognition and text processing
• Resend — Dublin, Ireland (EU)Sending emails, such as login codes and invitations
• PostHog — Frankfurt, Germany (EU)Website analytics with consent, app usage statistics, feature flags and technical logs
• Stripe — Ireland (EU) and USProcessing subscription payments
• Apple — USDistributing the iOS app and push notifications on iPhone
• Google — USDistributing the Android app and push notifications on Android
• PDOK (Kadaster) — the Netherlands (EU)Looking up addresses while you type
• e-Boekhouden, Moneybird, Jortt and Exact Online — the Netherlands (EU)Accounting integrations, only if you turn them on

7. Transfers outside the EEA

We generally process your data within the European Economic Area (EEA). If data is processed outside the EEA, we put appropriate safeguards in place in accordance with Chapter V of the General Data Protection Regulation (GDPR), for example by using the EU Standard Contractual Clauses.

9. Security

We take appropriate technical and organisational measures to protect your data against loss or unlawful use. These include encrypted connections and role-based access controls.

10. Your rights

You have the right to access, correct and delete your personal data, and the right to data portability. You can also object to processing or request that we restrict it.

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise your rights, please contact us using the details below.

11. Changes to this policy

We may update this privacy and cookie policy from time to time. The latest version is always available on our website.

12. Contact

If you have questions about this policy or how we process your personal data, please email privacy@werkbonnen.ai.