Privacy policy

1. Who is responsible for your data?

For your account data and your use of the platform, the controller is [À COMPLÉTER : dénomination sociale - ex. WaaS Foundry SRL], [À COMPLÉTER : adresse du siège, Belgique] (Company no. [À COMPLÉTER : n° BCE]). Contact: waasfoundry@gmail.com.

For the data of your own visitors and customers (for example messages sent through your website’s contact form), you are the controller; we act as processor and use this data only to provide you with the service.

2. The data we process

Account: e-mail address, name (optional), language, communication preferences, technical sign-in identifiers.

Your websites: information about your business (name, description, address, hours, contact details), texts, photos and logos you provide or import, version history.

Payment: customer identity, billing address, VAT number and invoice history. Card data is processed exclusively by Stripe.

Usage: technical logs (errors, security), AI calls (step, model, cost, duration - not the content of exchanges beyond what your website needs) and aggregated usage statistics.

Visitors to your website (plans with statistics): anonymous audience measurement (page views, clicks on call or directions buttons). No cookie is set and IP addresses are not stored; an anonymous visitor identifier is computed irreversibly and changes every day.

3. Why, and on what legal basis

Performance of the contract: creating your account, generating, publishing and hosting your websites, managing the subscription and billing, sending you service e-mails (sign-in, invoices, payment reminders, your website’s monthly report).

Legitimate interest: securing the platform, preventing fraud and abuse, measuring and improving service quality, controlling costs.

Legal obligation: keeping accounting and tax records.

Consent: tips and news to grow your business (optional checkbox, one-click unsubscribe in every message). You can withdraw your consent at any time.

4. Artificial intelligence

To write and adapt your texts, we send our AI provider the information needed (description of your business, website content, imported reviews). We do not send it your e-mail address, your payment data or your photos. The provider has committed not to use this data to train its models.

5. Who do we share your data with?

Only with the providers needed to run the service: Vercel (hosting), Supabase (database, storage and authentication, European region), Stripe (payment and invoicing), Anthropic (artificial intelligence), Resend (sending e-mails), Google (sign-in with Google and import of a business listing, if you use them) and Cloudflare (anti-bot protection, if enabled).

Some providers are located outside the European Union, notably in the United States. Transfers are covered by the European Commission’s standard contractual clauses or by the EU–US Data Privacy Framework. We never sell your data.

6. Retention periods

Account and websites: as long as your account exists, then deleted on your request. Drafts not linked to an account are deleted after 30 days.

Invoices and accounting records: 7 years (Belgian legal requirement).

Technical logs and sent e-mails: 12 months. Audit log of sensitive actions: 24 months. Anonymous statistics: 25 months. Anonymous visitor identifiers: 48 hours.

7. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to receive it in a readable format (portability). Export and deletion of your account are available directly in “My account”.

To exercise your rights in any other way, write to waasfoundry@gmail.com. We reply within one month. You may also lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be).

8. Security

Communications are encrypted (HTTPS), access is separated by account, there are no passwords (sign-in by link or Google account) and our team’s sensitive actions are logged. As no system is infallible, we will notify you within the legal deadlines in case of a data breach affecting you.