Privacy policy

The data controller is YRproject B.V. (KvK 97813974), IJsseldijk 402, 2922 BN Krimpen aan den IJssel, the Netherlands. We respect your privacy: we use no trackers and no advertising cookies, and we do not sell or share your data for marketing. Questions or requests: redactie@yrproject.nl.

Account data (name, work email, company, job title, hashed password) — to provide and secure the service (basis: performance of a contract).

Your AI-system register & compliance data — processed on your instructions to deliver the monitoring you configure. For this data your organisation is the controller and we are the processor, governed by a Data Processing Agreement entered into at onboarding.

Early-access leads (email, optionally name, company, AI footprint) — solely to contact you about early access (basis: consent / legitimate interest).

Server & audit logs (IP address, requested page, time, browser type) — for security and aggregated, non-identifying statistics (basis: legitimate interest).

Content you register may be processed by our EU AI provider to draft documents and answer questions, always grounded in cited sources and reviewed by a human before it counts. Your content is not used to train its models.

All data is processed and hosted within the European Union; every sub-processor (hosting, AI, email) is EU-based. See our trust & data page.

The app uses a single, strictly necessary session cookie (an HttpOnly cookie holding a signed login token) to keep you logged in. No third-party or marketing cookies — and therefore no cookie banner.

Account data: for the duration of your subscription plus 90 days. Early-access leads: up to 24 months, or until you ask us to remove them. Server and audit logs: 90 days. (Where billing applies in future, invoice data is kept for 7 years under statutory tax retention.)

You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time — email redactie@yrproject.nl. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We may update this statement; the current version is always here. Last updated: 27 June 2026.