Legal

Privacy policy

We process as little personal data as possible, and we tell you exactly which. Below you can read what we do, why, how long we keep it and what your rights are.

In short: we process data from customers who have an account and from visitors to this website. The conversations visitors hold with an assistant, we process on behalf of our customer — that's their data, not ours. We never sell data and we don't train any AI models on it.

Last updated: 13 June 2026.

1. Who is responsible

This privacy policy belongs to:

De Codebrouwerij B.V., trading under the name Codebrouwerij
Berndijksestraat 103 B, 5171 BB Kaatsheuvel
Chamber of Commerce number: 96285826
Email: info@codebrouwerij.nl

Have a question about privacy or want to exercise a right? Then email info@codebrouwerij.nl.

2. Two roles: controller and processor

Our role under the GDPR differs per type of data:

We are the controller for the data of our own customers and of visitors to this website (think of your account, billing and the contact form). This privacy policy applies to that.
We are the processor for the conversations end users hold with a customer's assistant. We process that data solely on behalf of and on the instruction of that customer; the customer is the controller for it. We set out the agreements about this in our data processing agreement. If you want to know how a specific organisation handles those conversations, take a look at that organisation's privacy policy.

3. Which data we process

From customers and account holders:

name, email address and (business) contact details;
login credentials and account settings;
billing and payment details;
usage data from the portal (for example which features you use), to make the service work and improve it.

From visitors to this website:

the data you leave via the contact form;
technical data needed to keep the site secure and working, such as your IP address in server logs.

From end users of an assistant (as processor, on behalf of our customer):

the messages in a conversation and what the assistant sends back;
technical data about the conversation, such as time and language;
any data the customer supplies about a logged-in visitor.

As an end user, don't share sensitive personal data in a chat if it isn't necessary.

4. Why we process that data

We process personal data only for clear purposes, and always with a basis from the GDPR:

To deliver the service — making your account, your assistants and the conversations work (performance of the contract).
To invoice and keep our records (legal obligation and performance of the contract).
To stay in touch when you send us a message or need support (legitimate interest and performance of the contract).
To improve and secure the service — tracking down errors, countering misuse, safeguarding quality (legitimate interest).
To inform you about important changes, and — if you've given consent for it — about news or offers (consent, which you can always withdraw).

5. AI processing and our processors

To let your assistant answer, we bring in external AI providers. The relevant parts of a conversation and of the connected content are sent to their business APIs to generate an answer:

OpenAI — for language models (GPT) and making content searchable.
Anthropic — for language models (Claude).

These parties process the data solely to deliver the answer. Under their business terms, they do not use this data to train their models. Which model an assistant uses is the customer's own choice in the portal.

Besides the AI providers, we use processors for things like hosting, email and payments. We conclude data processing agreements with all of these parties and choose them with care.

6. How long we keep data

Account data we keep for as long as you have an account, and after that for a reasonable period for administration and any disputes.
Billing data we keep for as long as the law requires us to (seven years for tax records).
Chat conversations we keep on the customer's behalf, according to the retention settings the customer chooses. The customer can view and delete conversations in the portal.
Contact messages we keep for as long as is needed to handle your query.

7. Sharing with others

We don't sell your data and don't share it with third parties for their own purposes. We only share data with the processors needed to deliver the service (see point 5), or if the law obliges us to.

8. Transfers outside the EEA

Some of our providers — including the AI providers — are established outside the European Economic Area or process data there. In that case we ensure appropriate safeguards, such as the European Commission's standard contractual clauses, so that your data is protected there too.

9. Security

We take appropriate technical and organisational measures to protect your data, such as encrypted connections, shielded access and careful handling of keys and passwords. No system is completely watertight, but we work hard to keep risks small. Suspect a breach? Let us know straight away via info@codebrouwerij.nl.

10. Cookies

The widget and the portal only use the storage needed to work, for example to remember an ongoing conversation. We don't place advertising cookies and don't track you across other websites. If a customer sets up their own analytics or tag solution on their site, that falls under that customer's privacy policy.

11. Your rights

Under the GDPR you have a number of rights over your personal data. You can ask us for:

access to the data we hold about you;
correction of data that's wrong;
erasure of your data;
restriction of the processing;
transfer of your data (data portability);
objection to a processing, and the withdrawal of consent given earlier.

Send your request to info@codebrouwerij.nl. We respond within the statutory period. Are you an end user of an assistant and is your request about a conversation? Then turn to the organisation whose assistant you used; we'll point you in the right direction if needed.

12. Complaint to the supervisory authority

Don't agree with how we handle your data? We're happy to sort it out together — email us. On top of that, you always have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

13. Changes

We may amend this privacy policy if the service or the law calls for it. The most current version is always on this page, with the date of the latest change at the top. For an important change, we'll let you know.

14. Contact

Questions about your privacy or about this policy? Email info@codebrouwerij.nl — you'll get a reply from a human.