Privacy notice

Who is responsible

Tim Van Damme BV, De Croixlaan 13, 1910 Kampenhout, Belgium. Enterprise/VAT number: BE0700900818. Email: tim@maxvoltar.be. Telephone: +32 468 02 94 48.

We act as controller for account administration, service security, our billing and legal obligations. For content processed on behalf of a business Team customer, that customer may be the controller and we act as processor under the Team data-processing agreement. Contact us at the email above for privacy matters. We have not designated this contact as a data protection officer.

What we process and why

Account details include your name, email address, verification status, password hash, authentication factors and session metadata including sign-in and expiry times, IP address, browser/device information and security-factor verification status. We use them to enter into and perform the service contract and protect access. We process passwords and recovery secrets in protected form; your account export does not disclose credentials.

Library content, collection structure, revisions, proposals, connection permissions and Team memberships are processed to provide the features you choose. This can include personal data you or other authorized users supply. Team invitations contain recipient contact details supplied by the inviter. If someone else has provided your data, contact us or the relevant Team organization about it.

We process security and access records, abuse-prevention signals such as IP-related rate-limit keys, and minimal administration logs to protect the service and investigate misuse. Our legal basis is our legitimate interest in a secure, reliable service, balanced against affected individuals' rights. We record successful authenticated app/API activity to support account administration; background connection reads do not count as active-user visits.

Subscription references, billing/contact and tax details, payments, refunds and contractual acceptance records support the contract and applicable accounting, tax and consumer-law obligations. Privacy and withdrawal requests are processed to comply with legal obligations and establish or defend relevant claims. Necessary service processing is not based on a blanket 'privacy consent'. We do not use this release for marketing profiling, advertising tracking or solely automated decisions with legal or similarly significant effects.

Required account and billing information is needed to provide the requested service or comply with law. Without it we may not be able to create the account or supply the subscription. Optional content and connections are your choice.

Who receives information

Our hosting, database, transactional email and payment providers receive the information necessary for their services. The provider list at /subprocessors identifies their roles and locations. Payment providers may also act as independent controllers for fraud prevention, regulated payment operations and legal compliance.

You control which information to make available through connection links. The AI tool or other recipient you choose may process or retain fetched copies under its own terms. It is not automatically our subprocessor merely because you connect it. Team administrators and members receive access according to the Team's configured permissions. We may disclose necessary records to advisers or competent authorities where required by law or for legitimate legal claims.

We do not claim end-to-end encryption or processing exclusively in the EEA. Cloudflare infrastructure can process data globally; an observed Western Europe database location is not a contractual EU-only jurisdiction. Resend's EU sending region does not mean EU storage: its documentation states US storage. Stripe uses international entities and service providers. Applicable provider contracts describe safeguards such as Standard Contractual Clauses and, where valid and applicable, Data Privacy Framework participation. Contact us for information about safeguards relevant to your data.

How long information is kept

Content is stored while your account exists, including when a paid plan pauses, until removed through the relevant deletion or erasure process. Canceling a subscription does not itself erase the account or library. Ordinary item deletion retains version history; it is not a promise of immediate erasure of every copy. You can request specific erasure or raise third-party data concerns using the privacy request function or our contact address.

Expired sessions, verification records and rate-limit entries are cleaned up daily. Unverified accounts older than 30 days are eligible for cleanup only when they have no real product or billing data. Minimal security/admin audit records are normally kept for 90 days. Completed non-financial request payloads are normally removed 90 days after completion; the minimal non-financial decision record is also normally removed after 90 days. If a specific dispute or legal hold requires longer retention, we record its reason and review it when that matter ends. Unresolved requests remain available until resolved.

Accounting records are retained for the applicable statutory period, separately from private context. Belgian invoice and related accounting/VAT documents generally require 10-year retention, with the starting point depending on the record. Necessary legal evidence can be retained for the applicable claim period. We do not apply accounting retention to all library content.

Active application records can be erased before provider backup copies expire. Our current paid Cloudflare D1 database has a 30-day Time Travel recovery window. Resend's current Free plan retains email/log data for 30 days and backups for 7 days; earlier deletion may require provider support. Stripe may retain transaction and compliance records after a customer record or Bring With account is removed. Manual backups are restricted and tracked separately. If we restore a backup, we must reapply completed erasure decisions before restored data is made available. We will explain relevant exceptions when responding to an erasure request.

Your rights and how to exercise them

Depending on the circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing actually relies on consent, you can withdraw it without affecting earlier lawful processing. An account export provides structured JSON of your own account and personal-library data; it does not automatically disclose other people's private data or all Team content. Access and portability are distinct rights: portability applies to qualifying data you provided that we process automatically on the basis of consent or contract. Contact us about portability or additional personal data not included in the account export.

Use the privacy tools in your account or contact tim@maxvoltar.be, including if you are suspended or do not have an account. We may proportionately verify your identity. The normal response period is one calendar month from receipt; identity checks do not silently restart that clock. If complexity or volume justifies an extension of up to two further months, we will explain it within the initial month. We will explain any refusal, limits or retention exception and the available complaint or judicial remedies.

You can complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Belgium, https://www.dataprotectionauthority.be, or to another competent supervisory authority, including in the EEA country where you live or work. Contacting us first is helpful but is not a condition for exercising that right.