Privacy policy | Innovablast

Who is responsible

Innovablast B.V. provides Innovablast and is the controller (verwerkingsverantwoordelijke) of the personal data this policy describes.

Innovablast B.V. · Triangelweg 9, 2992 GR Barendrecht, Netherlands · Chamber of Commerce (KvK) 42043332 · VAT NL869447087B01 · info@innovablast.com

Your account

We process your account data to perform our contract with you.

Data: email address, sign-in details.
Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
Retention: Kept until you delete your account.
When you delete your account, its sign-in is suspended at once and we finish deleting the rest within one month; a step that fails is tried again until it completes.

Your content

We store the content you create so the product can show it to you and do what you ask of it, to perform our contract with you.

Data: the agents you set up, with their runs.
Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
Retention: Kept until you delete it or your account.

Email about your account

We email you about your account and what happens in it, such as sign-in codes, a welcome when you create your account, security alerts and notices about your data export or the deletion of your account. We send no newsletters or advertising email.

Data: email address, name, what the email is about.
Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
Retention: Kept for 90 days.
Of an email with a sign-in code we keep only the delivery record, without your address, after 7 days. A notice we must be able to show we sent, such as a billing notice, a change to our terms or the notice that your data export is ready, is kept for 10 years from the end of the year it concerns.

Security and error logs

We log requests and errors to keep the service secure.

Data: requests and errors, device and browser details.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), namely our legitimate interest in security; you may object to it at any time.
Retention: Kept for 90 days.

Requests to delete an account

When you ask on our website to delete your account, we email you a confirmation link and keep the request, so that only the account holder can have the account deleted.

Data: which account the request is for, the IP addresses the request was made and confirmed from.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), namely our legitimate interest in making sure only the account holder can have an account deleted; you may object to it at any time.
Retention: Kept for 30 days.

Backups

We keep short-lived backups so we can restore the service after an incident.

Data: a copy of the product database.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), namely our legitimate interest in being able to restore the service; you may object to it at any time.
Retention: Kept for 7 days.
Deleted data leaves backups within 7 days.

Product analytics

We measure how the product is used only if you agree.

Data: the pages and features you use, a random device id, your internal account number.
Legal basis: your consent (Art. 6(1)(a) GDPR).
Retention: we have not fixed this period yet; ask us at info@innovablast.com and we tell you the current setting.
You can withdraw this consent at any time in Cookie settings, without affecting what happened before.

Support and contact

When you write to us, we use your message to answer you.

Data: name, email address, your message.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), namely our legitimate interest in answering your questions; you may object to it at any time.
Retention: Kept while we are in contact and for 24 months after.

Special categories of personal data

Innovablast does not ask for special categories of personal data, such as health information, and needs none to work.

What we do not do

We do not sell your data.

Who receives your content

These processors handle the content you create, on our instructions:

Amazon Web Services (Amazon Web Services EMEA SARL), Germany: Hosting, sign-in, file storage, email delivery and logs; under a data processing agreement.
Expo (650 Industries, Inc. (Expo)), United States: Delivers push notifications and app updates; we require a data processing agreement from it and are completing the agreement.
Neon (Neon, LLC (Databricks)), Germany, United States: Hosts the product database in Frankfurt; under a data processing agreement.

Who receives your account and billing data

These processors handle account, billing and operational data, on our instructions:

Airtable (Formagrid, Inc. (Airtable)), United States: Internal records the company keeps about its own operations; we require a data processing agreement from it and are completing the agreement.
Amplitude (Amplitude, Inc.), Germany, United States: Product analytics on how features are used, stored in its EU data centre; only with your consent; under a data processing agreement.
Better Stack (Better Stack, Inc.), Germany, United States: Error monitoring of the apps and websites without IP addresses or email addresses, collected with the open-source Sentry SDK and sent only to Better Stack, uptime checks, incident alerts, the status page, and server logs with personal data removed before sending, all stored in its EU data region; under a data processing agreement.
Google Workspace (Google Cloud EMEA Limited (Google LLC)), Ireland, United States: Email and documents for the company mailboxes, including support and legal correspondence; under a data processing agreement.

Authorities

We give personal data to authorities only where the law requires us to.

Transfers outside the European Economic Area

Innovablast runs on servers in Frankfurt, Germany. Where a recipient processes personal data outside the European Economic Area, the transfer relies on:

You can ask for a copy of these safeguards: write to info@innovablast.com.

Airtable (United States): we require the European Commission's Standard Contractual Clauses in the data processing agreement we are completing with it.
Amplitude (Germany, United States): the European Commission's Standard Contractual Clauses.
Better Stack (Germany, United States): the European Commission's Standard Contractual Clauses.
Expo (United States): we require the European Commission's Standard Contractual Clauses in the data processing agreement we are completing with it.
Google Workspace (Ireland, United States): the European Commission's Standard Contractual Clauses.
Neon (Germany, United States): the European Commission's Standard Contractual Clauses.

Your rights

You have the right to access, correct, delete and export your personal data, and to object to or restrict its processing. Much of it you can do yourself in Innovablast; for the rest, write to info@innovablast.com. We answer without undue delay and in any event within one month.

In Innovablast you can download a copy of your data yourself: one .zip file with your records as JSON and any files you added. We tell you when it is ready and keep it for 7 days. If you can no longer sign in, write to info@innovablast.com from the email address of your account and we help you get a copy.

You can withdraw any consent at any time without affecting what happened before.

Where we rely on legitimate interest you can object at any time; write to info@innovablast.com.

We do not take decisions about you based solely on automated processing that significantly affect you.

You can complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the data protection authority where you live.

What you must give us

You must give an email address to create an account; without it we cannot provide the service.

Children

Innovablast is not meant for children. You must be at least 16 years old to create an account.

Changes

When we change this policy, we publish the new version here with its date and tell you about material changes before they apply.

Contact

Privacy questions and requests: info@innovablast.com. Help with Innovablast: support@innovablast.com.