Privacy Policy
Version 1.1, October 2026
This page is an English translation of the Dutch original, which you can read at mindsora.io/privacy.
Who are we?
Mindsora is an AI automation agency for service businesses in the Netherlands. We build systems that automate business processes, from lead generation to administration.
- Legal form: Sole proprietorship (eenmanszaak)
- Trade name: Mindsora
- Chamber of Commerce (KvK) number: 87325489
- Place of business: Nieuw-Beijerland, the Netherlands
- Email: hello@mindsora.io
- Website: mindsora.io
Mindsora has not appointed a Data Protection Officer (DPO). Given the nature and scale of our processing, this is not required under GDPR Article 37. For questions about your data you can contact us directly at hello@mindsora.io.
In short
We only collect data that we need to help you. We do not sell your data. We do not share it with third parties unless it is necessary for our services. You always have the right to view, change or delete your data.
What data do we collect?
When you schedule a call
- First and last name
- Email address
- Phone number
- Company name
- Your answer to the question "What can we help you with?" (optional)
When you visit the website
- Technical data: IP address (anonymised), browser type, device type, operating system
- Behavioural data: pages visited, time on the site, click behaviour
Cookies
We place necessary cookies for the website to work and analytical cookies to understand and improve the use of our website. We do not use advertising cookies.
| Cookie | Purpose | Retention | Type |
|---|---|---|---|
| Session cookie | Website functionality | Until the browser is closed | Necessary |
| Cookie preferences | Remembers your cookie choice | 12 months | Necessary |
| Microsoft Clarity (_clck, _clsk, CLID, ANONCHK, SM, MR) | Usage analysis: heatmaps, scroll depth, anonymous session recordings | Up to 12 months | Analytical |
| Google Analytics 4 (_ga, _ga_<id>) | Measuring website visits and enquiries | 2 years | Analytical |
We only place analytical cookies after you give consent. Microsoft Clarity processes pseudonymous usage data, such as a unique code per visitor and data about your session. That is also personal data. Session recordings automatically mask sensitive input fields (such as email addresses and passwords).
When you become a client
- All of the data above
- Invoicing data: company name, address, KvK number, VAT number
- Communication history: emails, messages, call notes
- Access to systems we build for you (only when needed for maintenance and only with your knowledge)
What we do not collect
Our services are not aimed at people under 16. We do not knowingly collect data from minors. If you suspect we have unintentionally collected data from a minor, contact us at hello@mindsora.io and we will delete it immediately.
Why do we collect this data?
| Purpose | Legal basis (GDPR) | Explanation |
|---|---|---|
| Scheduling and preparing your call | Art. 6.1b · Performance of a contract | Needed to make the appointment |
| Sending you a proposal after the call | Art. 6.1f · Legitimate interest | You actively requested a call |
| Delivering and maintaining our services | Art. 6.1b · Performance of a contract | Needed to build and maintain |
| Sending invoices | Art. 6.1c · Legal obligation | Tax retention obligation |
| Informing you about updates to your system | Art. 6.1f · Legitimate interest | Relevant technical updates, no marketing |
| Improving the website | Art. 6.1f · Legitimate interest | Anonymised analysis of usage |
| Sending marketing communication | Art. 6.1a · Consent | Only after explicit opt-in |
Automated decision-making and profiling
Mindsora does not make decisions based solely on automated processing that have legal effects for you or significantly affect you (GDPR Article 22). The AI systems we build for clients do not make autonomous decisions about people. Human oversight is always part of the process.
Who do we share your data with?
We only share your data with parties that are necessary for our services (processors within the meaning of GDPR Article 28). We have made suitable agreements with each party.
| Party | Purpose | Location | Transfer basis |
|---|---|---|---|
| GoHighLevel (HighLevel Inc.) | CRM, email, booking system | US | EU-US Data Privacy Framework + SCCs |
| Zoom Video Communications | Video calls | US | EU-US Data Privacy Framework |
| Google (Alphabet Inc.) | Calendar, email, website analytics (Google Analytics) | US | EU-US Data Privacy Framework |
| Vercel Inc. | Website hosting | US / EU | EU-US Data Privacy Framework + SCCs |
| Microsoft Corporation (Clarity) | Website analytics: heatmaps and session recordings | US / EU | EU-US Data Privacy Framework |
| Hostinger International Ltd. (Cyprus) | Server for our automations (n8n) | Germany (Frankfurt) | The server is located in the EEA. Hostinger may process data through sub-processors outside the EEA; SCCs apply to transfers to countries without an adequacy decision (Hostinger data processing agreement, article 9) |
| Resend (Plus Five Five, Inc.) | Sending emails, such as the confirmation of an intake or quotation | US | EU-US Data Privacy Framework + SCCs |
Supabase (a database for intake and quotation data) and Stripe (online payments) are prepared in our code but not yet in use. Before we switch either one on, we will add it to this table with its location and transfer basis. You can request a copy of the standard contractual clauses (SCCs) that apply to a processor at hello@mindsora.io.
We never sell your data. We do not share it with advertisers. We do not use it for purposes that are not described in this policy.
How long do we keep your data?
| Type of data | Retention period | Basis |
|---|---|---|
| Call requests (not a client) | 12 months after last contact | Legitimate interest |
| Client data | Duration of the agreement + 7 years | Tax retention obligation (Art. 52 AWR) |
| Invoicing data | 7 years after the end of the financial year | Legal obligation (Art. 52 AWR) |
| Website data | 12 months | Legitimate interest |
| Communication history | Duration of the agreement + 2 years | Legitimate interest |
How do we protect your data?
- Encrypted connections (SSL/TLS) on all our systems and websites
- Access restriction: only people who need the data have access
- Two-factor authentication (2FA) on all internal accounts
- Strong, unique passwords managed through a password manager
- Regular review of our security measures
- Processors selected for their security level and GDPR compliance
What do we do in case of a data breach?
Despite our security measures, a data breach can never be ruled out completely. If a data breach occurs that poses a risk to your rights and freedoms:
- We report the breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours (GDPR Article 33)
- We inform you as soon as possible if the breach is likely to result in a high risk for you (GDPR Article 34)
- We take immediate measures to limit the consequences
- We document the incident internally, including the measures taken
Your rights
Under the GDPR you have the following rights:
- Access (Art. 15): you can ask which data we hold about you
- Rectification (Art. 16): you can have incorrect data corrected
- Erasure (Art. 17): you can ask us to delete your data
- Restriction (Art. 18): you can ask us to pause the processing temporarily
- Objection (Art. 21): you can object to processing based on legitimate interest
- Portability (Art. 20): you can ask to receive your data in a common format
- Withdraw consent (Art. 7): always possible, without retroactive effect
How do you submit a request?
Send an email to hello@mindsora.io describing your request. We may ask for proof of identity to make sure the request comes from you. We respond within 30 days. Submitting a request is always free of charge, unless the request is manifestly unfounded or excessive.
Making a complaint
Do you disagree with how we process your data? Please contact us first at hello@mindsora.io, we prefer to solve it together. If we cannot work it out, you have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
Changes
We may change this privacy policy. For material changes we inform you by email before the changes take effect. You can always find the latest version, including version number and date, on this page. Earlier versions are available on request at hello@mindsora.io.