Introduction
This policy is publicly available at ai-werkers.nl/privacy and meets the requirements for Google OAuth verification, the Microsoft Identity Platform and the AVG/GDPR.
Contents
- Who are we?
- Which data do we process?
- Google login details and API access (OAuth)
- Microsoft login details and API access (OAuth)
- Purposes and legal bases (GDPR)
- How long do we keep your data?
- Sharing with third parties and sub-processors
- Security
- Your rights (GDPR)
- Cookies
- Changes to this policy
- Contact and complaints
1. Who are we?
aiwerkers B.V. (hereinafter: "ai-werkers", "we" or "us") is a Dutch company specialising in AI implementation and AI-driven SaaS products for small and mid-sized companies. Our products include VisitFlow (voice-to-CRM for B2B account managers) and CarWatch (AI vehicle analysis for automotive purchasing).
Company details
- Trade name: aiwerkers B.V.
- Address: Akkrumerraklaan 112, 3544 TS Utrecht, Netherlands
- Chamber of Commerce number: 42114106
- VAT number: NL869793627B01
- Email: privacy@ai-werkers.nl
- Website: https://ai-werkers.nl
ai-werkers processes personal data in two distinct capacities, depending on the purpose of the processing.
For the processing of personal data in the course of its own business operations — including this website, marketing, customer administration and product analytics — ai-werkers acts as controller within the meaning of Article 4(7) GDPR. Those processing activities are described in the remainder of this policy.
Where a client, in using the products of ai-werkers (including VisitFlow and CarWatch), has personal data of third parties processed — for example data of its own customers, prospects or employees — ai-werkers acts as processor in respect of that data, within the meaning of Article 4(8) GDPR. That processing takes place solely within the limits of and on the basis of the data processing agreement that the parties conclude when entering into the agreement (see Article 11.1 of the general terms and conditions of ai-werkers). In those cases the client itself remains the controller for the personal data it supplies.
2. Which data do we process?
Depending on the product you use and the permissions you grant, we process the following categories of personal data:
| Category | Examples | Source | Product(s) |
|---|---|---|---|
| Account data | Name, email address, profile photo, Google/Microsoft user ID | Google OAuth / Microsoft OAuth / direct registration | All |
| Calendar data | Appointments, titles, times, locations, participants, descriptions | Google Calendar API / Microsoft Graph API (only with explicit consent) | VisitFlow |
| CRM and visit data | Visit reports, customer notes, voice input (transcribed) | Entered by the user via VisitFlow | VisitFlow |
| Vehicle data | Registration number, RDW data, damage analysis, market value | User input + public RDW API + market value APIs | CarWatch |
| Usage data | Login times, session duration, features used, error logs | Generated automatically when the application is used | All |
| Technical data | IP address, browser type, device type, OS version | Automatically on website visits and app use | All |
| Scheduling request via the website | Email address you leave in the planner button on ai-werkers.nl | Entered by you in the scheduling form | HalloVera (Vera) |
No special categories. We do not process special categories of personal data as referred to in Article 9 GDPR (such as health data, ethnic origin or biometric data).
3. Google login details and API access (OAuth)
Google API Services — Limited Use Disclosure
The use of data obtained through the Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google user data solely for the functionality for which you have given explicit consent.
- We do not sell Google user data to third parties, for any sum or consideration whatsoever.
- We do not use Google user data to develop, improve or train generic AI or machine learning models.
- We do not share Google user data with third parties for their own advertising, marketing or analytics purposes.
- We limit the use of Google user data to the minimum necessary to carry out the requested function.
Which Google scopes do we request — and why?
We request only the OAuth scopes that are strictly necessary for the operation of the product concerned. Below is exactly what we request per scope, what we use it for, what we store and for how long.
| Scope | What it covers | What we use it for | Storage | Product |
|---|---|---|---|---|
| openid | Unique Google user ID | Authentication and linking to your ai-werkers account | Stored as account ID; never shared | All |
| Your primary Google email address | Account management, communication and password recovery | Stored for as long as the account is active | All | |
| profile | Display name and profile photo URL | Display in the application interface | Name stored; photo URL cached, not persistent | All |
| calendar.events | Reading and creating calendar entries in Google Calendar | Automatic scheduling of visit appointments and synchronisation of VisitFlow activities with your Google calendar | Calendar events processed temporarily (max. 90 days); not resold or shared | VisitFlow |
Least privilege principle: We never request more rights than strictly necessary. The calendar.events scope is activated only when you explicitly opt for calendar integration in VisitFlow. You can withdraw this consent at any time without your account being deleted.
Token storage and security
- Access tokens: are kept solely in server memory (in-memory) for the duration of the session and never written to disk.
- Refresh tokens: are stored encrypted (AES-256) in our secured database, solely to enable automatic task execution for which you have given consent.
- No permanent storage of access tokens: on logging out or withdrawal of consent, tokens are immediately invalidated and deleted.
What we do NOT do with your Google data
✕ Prohibited use — Google Limited Use Policy
- Selling your Google account data or calendar data to third parties
- Using your data for advertising purposes
- Sharing your data with third parties for those third parties' own marketing purposes
- Reading calendar entries that are not necessary for the task you have requested
- Using your Google data for training AI models
- Using your Google user ID or email address for profiling or retargeting
- Making Google data accessible to people who are not authorised for it within ai-werkers
Withdrawing consent (Google)
You can withdraw your OAuth consent at any time through your Google account settings → Apps with access to your account. After withdrawal:
- ai-werkers immediately stops requesting new Google data;
- existing tokens are invalidated and deleted;
- you can request via privacy@ai-werkers.nl that data already processed be deleted (handled without undue delay and in any event within one month).
4. Microsoft login details and API access (OAuth)
For users who sign in with a Microsoft account (Microsoft 365 / Azure AD), principles comparable to those for Google apply. We request only the permissions that are strictly necessary.
| Permission / Scope | What it covers | What we use it for | Storage | Product |
|---|---|---|---|---|
| openid | Unique Microsoft user ID | Authentication and linking to your ai-werkers account | Stored as account ID; never shared | All |
| Your primary Microsoft email address | Account management and communication | Stored for as long as the account is active | All | |
| profile | Display name | Display in the application interface | Name stored; no photo permanently cached | All |
| Calendars.ReadWrite | Reading and creating calendar entries in Outlook / Microsoft 365 | Automatic scheduling of visit appointments and synchronisation with the Outlook calendar | Calendar entries processed temporarily (max. 90 days); not resold or shared | VisitFlow |
Token storage and security (Microsoft)
- Access tokens: kept in-memory only, for the duration of the session.
- Refresh tokens: stored encrypted (AES-256); deleted immediately on withdrawal of consent.
Withdrawing consent (Microsoft)
You can withdraw access through your Microsoft account settings → Apps and services. After withdrawal, the same steps apply as described in section 3.
Microsoft Identity Platform: ai-werkers complies with the Microsoft Identity Platform requirements for consent and data use.
5. Purposes and legal bases (GDPR)
| Purpose | Data category | Legal basis (Article 6 GDPR) |
|---|---|---|
| Granting access to our products and services | Account data | Performance of a contract (Article 6(1)(b)) |
| Calendar synchronisation and visit planning (VisitFlow) | Calendar data | Consent (Article 6(1)(a)) |
| CRM registration and visit reporting (VisitFlow) | CRM and visit data | Performance of a contract (Article 6(1)(b)) |
| Vehicle analysis and market value assessment (CarWatch) | Vehicle data | Performance of a contract (Article 6(1)(b)) |
| Customer communication and support | Account data, correspondence | Performance of a contract / legitimate interest (Article 6(1)(b)/(f)) |
| Security and fraud prevention | Usage data, technical data | Legitimate interest (Article 6(1)(f)) |
| Scheduling an appointment after a request on the website — Vera, our AI scheduling assistant, emails you and arranges the appointment by email | Scheduling request via the website | Consent (art. 6(1)(a)) |
| Legal obligations (tax records) | Financial records | Legal obligation (Article 6(1)(c)) |
6. How long do we keep your data?
We do not keep personal data longer than necessary for the purpose for which it was collected (Article 5(1)(e) GDPR):
| Data category | Retention period | After the period |
|---|---|---|
| Account data (name, email) | Duration of the active account + 12 months | Deleted or anonymised |
| Google / Microsoft access tokens | Duration of the session (in-memory) | Automatically invalidated at the end of the session |
| Google / Microsoft refresh tokens | Duration of the consent or the account | Deleted immediately on withdrawal |
| Calendar data (VisitFlow) | No more than 90 days after processing | Deleted automatically |
| CRM notes and visit reports (VisitFlow) | Duration of the active account or on request | Deleted on request or after the account is closed |
| Vehicle analyses (CarWatch) | 6 months, unless actively retained in the account | Deleted automatically |
| Technical logs and usage data | No more than 90 days | Deleted automatically |
| Financial records | 7 years (statutory tax retention obligation, Article 52 AWR, the Dutch State Taxes Act) | Deleted after the statutory period |
7. Sharing with third parties and sub-processors
We never share your personal data with third parties for their own purposes. We use only the following sub-processors, which are contractually bound by strict confidentiality and security requirements and act solely on the instructions of ai-werkers (Article 28 GDPR):
| Sub-processor | Service | Country of establishment | Basis for transfer |
|---|---|---|---|
| Railway Corp. | Hosting, database and authentication | USA (servers: Frankfurt, EU) | SCCs (Article 46(2)(c) GDPR) |
| Google LLC | OAuth authentication, Google Calendar API | USA | EU-US Data Privacy Framework |
| Microsoft Corporation | OAuth authentication, Microsoft Graph API | USA | EU-US Data Privacy Framework |
| Anthropic PBC | AI language model processing in our tools | USA | SCCs (Article 46(2)(c) GDPR) |
| Mistral AI SAS | AI language model processing for Vera | France (EEA) | No transfer outside the EEA |
| Brevo SAS | Transactional email (notifications and form confirmations) | France (EEA) | No transfer outside the EEA |
International transfers: Data is transferred outside the EEA only on the basis of appropriate safeguards in accordance with Article 46 GDPR (Standard Contractual Clauses) or an adequacy decision of the European Commission.
8. Security
ai-werkers takes appropriate technical and organisational measures to protect your personal data in accordance with Article 32 GDPR:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
- OAuth access tokens are kept in-memory only; refresh tokens are stored encrypted.
- Access control on a need-to-know basis; only authorised staff have access to personal data.
- Periodic security reviews.
- Data breach procedure: in the event of a personal data breach we report it within 72 hours to the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority (Article 33 GDPR), and inform data subjects in accordance with Article 34 GDPR.
9. Your rights (GDPR)
Under the GDPR you have the following rights. You can exercise them via privacy@ai-werkers.nl. We handle your request without undue delay and in any event within one month, with a possible extension of two further months for complex requests (Article 12(3) GDPR).
| Right | What it means | Response time |
|---|---|---|
| Access (Article 15) | Requesting which data we process about you | One month |
| Rectification (Article 16) | Having incorrect or incomplete data corrected | One month |
| Erasure (Article 17) | Deletion of your data ("right to be forgotten") | One month |
| Restriction (Article 18) | Temporarily halting processing | One month |
| Portability (Article 20) | Receiving your data in a machine-readable format | One month |
| Objection (Article 21) | Objecting to processing based on legitimate interest | One month |
| Withdrawing consent (Article 7(3)) | Withdrawing OAuth consent (Google / Microsoft) | Effective immediately |
| Minors (Article 8 GDPR) | Use by persons under 16 requires the consent of a parent or legal guardian (Article 5 UAVG, the Dutch GDPR Implementation Act) | On request of the parent/guardian |
Not satisfied with our response? You can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl. You can also bring proceedings before the competent court in the place where aiwerkers B.V. is established (Article 79 GDPR).
10. Cookies
This section covers the cookies in our applications (VisitFlow, CarWatch and our other products). The cookies on the website ai-werkers.nl are covered by the separate Cookie Policy.
We use functional cookies that are strictly necessary for the operation of our services (session management, authentication tokens). We do not set tracking or advertising cookies without your explicit consent.
For a full overview of the cookies we set, we refer you to our separate Cookie policy at ai-werkers.nl/cookiebeleid.
11. Changes to this policy
We may amend this privacy policy from time to time. In the event of material changes we will inform you by email or through a notification in the application, at least thirty (30) days before the effective date. The most current version is always publicly available at ai-werkers.nl/privacy.
12. Contact and complaints
For questions about this privacy policy or the exercise of your rights, you can contact our privacy contact person:
Privacy — aiwerkers B.V.
- Email: privacy@ai-werkers.nl
- Address: Akkrumerraklaan 112, 3544 TS Utrecht, Netherlands
- Chamber of Commerce: 42114106
- Response time: without undue delay and in any event within one month, with a possible extension of two further months for complex requests (Article 12(3) GDPR)
Version 2.0 · Published at: ai-werkers.nl/privacy · Effective date: 28 August 2026