Privacy statement
Version 1.2 · effective from 10 October 2026. This statement applies to the data of Keepstone customers and visitors to keepstoneai.eu. For the data about your own clients that you give to Keepstone, the data processing agreement applies. This statement exists in Dutch and English. If the versions differ, the Dutch version prevails.
Who Keepstone is. Keepstone is a trading name of Den Otter Consulting, Koningshoeven 13, 5235 BW 's-Hertogenbosch, the Netherlands, Chamber of Commerce (KVK) 94619735. Keepstone is the controller of your personal data. Send questions about privacy to [email protected].
Which data Keepstone uses, why, and on what basis.
| Data | Purpose | Legal basis (GDPR and UK GDPR, art. 6) | Retention |
|---|---|---|---|
| Name, email address, business name, company registration number and VAT number (optional) | Performing the contract, contact | Contract | Until 30 days after delivery |
| Payment details | Payment | Contract | Stripe keeps these itself. Keepstone does not see full card or account numbers |
| Invoice details | Bookkeeping | Legal obligation | 7 years (Dutch tax retention period) |
| Answers in the form and the interview, uploaded documents, the draft and the second brain | Making your second brain | Contract | Uploads: deleted as soon as they have been read. Everything else: until 30 days after delivery |
| Record of the personal review of your draft (what was checked, a short note) | Showing how the service was treated for VAT. The record contains no data about the customer's own clients | Legal obligation (Dutch tax retention) | 7 years |
| VAT number check: VAT number, result of the VIES check, country | Applying the right VAT treatment | Legal obligation | 7 years |
| IP address and technical data of website visits | Keeping the website secure | Legitimate interest | Keepstone does not store these data itself. Cloudflare keeps them under its own policy |
| Google click code (gclid) when you arrive through a Keepstone advert | Seeing whether a payment came from an ad | Legitimate interest | With your payment in Stripe, for as long as the payment is kept |
| Contact form: name, email address, business name (optional), subject and message | Answering your question | Legitimate interest | Arrives as an email and is deleted once your question has been dealt with, at the latest after 12 months |
What Keepstone does not do. Keepstone does not sell data, does not use your data for targeted advertising and does not place tracking cookies. The click code from a Google ad is not sent back to Google. Keepstone does not make decisions about you that are taken by a computer alone. The AI asks questions and makes a draft. Every draft is personally checked before you receive it.
Who else processes your data. Keepstone works with service providers that process your data on Keepstone's behalf. They are listed under sub-processors. Stripe processes payment data partly as a controller in its own right, for example to prevent fraud.
Transfers outside the EU and the UK. The analysis and the interview run through the API of Anthropic, a company in the United States. The transfer is covered by the European Commission's standard contractual clauses in Anthropic's data processing agreement, with the UK addendum for data from the UK. Anthropic does not use these data to train its models and in principle deletes them within 30 days. Names you give in the form, and email addresses and phone numbers, are replaced by codes before the analysis. That limits what is transferred, but does not rule out that personal data are included. For other service providers with US companies in the chain, such as Cloudflare and Microsoft, the transfer is covered by the EU-US Data Privacy Framework or by standard contractual clauses.
Your rights. You can ask Keepstone for access to your data, rectification, erasure, restriction of processing or data portability, and object to processing based on legitimate interest. You receive an answer as soon as possible, within one month at the latest. If you disagree with how Keepstone handles your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If you live in the UK, you can also complain to the Information Commissioner's Office (ICO).
Do you have to provide data? Without your name, email address and answers, Keepstone cannot make your second brain. Uploads are optional.
Changes. Keepstone may update this statement. The date at the top shows which version applies. If a change is significant, customers with an open order are told.