Privacy statement What data we process, and why.

Who is responsible?

stipt B.V. acts as a processor (Article 28 GDPR) on behalf of its customers. The customer is the controller for data stored in stipt, including lead and CRM data. For our own processing, such as account data of customer staff, billing, demo requests and the stipt.ai website, stipt is the controller.

What data do we process?

On behalf of customers: lead and contact data (name, email, phone, address), CRM records, appointments, quotes, completed forms with photos and signatures, and the related communication by email and WhatsApp, phone calls (transcripts and summaries) and data about the work of their staff and technicians, such as planning and work reviews. For our own service: customer staff account data, technical logs, IP addresses, billing data and what you send us through the demo form or by email (name, company, email address, phone number). Subscriptions and AI credits are billed through Stripe (Stripe Payments Europe, Ltd., Ireland): for this we share the company name and the administrator's email address, and you enter your payment details directly with Stripe. stipt.ai uses no tracking or analytics cookies.

Google user data (Gmail)

If you connect a Gmail mailbox (Google Workspace) to stipt, stipt requests access through Google OAuth with the scopes gmail.readonly, gmail.modify and gmail.send, plus openid, userinfo.email and userinfo.profile. With these, stipt processes the messages in that account's inbox (sender, recipient, subject, content, attachments, time, thread, read status and labels) and the name and email address of the Google account. Only mail that arrives after you connect is fetched, not older mail.

We use this data only to provide the features you use in stipt yourself: showing incoming mail as a conversation in the inbox, sending replies from the connected address, marking messages as read and applying the label "stipt." in Gmail, and the AI features of your own workspace (classifying, summarising, draft replies). We do not use it for advertising or profiling, we do not sell it and we do not share it with data brokers.

We share data from your mailbox only with the sub-processors needed to run stipt (hosting, database and AI models, see the table below), and with third parties only when the law requires it, for security or abuse prevention, or with your explicit consent. We do not use Google user data to develop, improve or train AI or ML models and we do not pass it to services that do; our AI providers are bound by commercial API terms under which content is not used for training. stipt staff do not read your mail, except with your consent, for security or abuse prevention, or when the law requires it.

The sign-in tokens of the connection are encrypted at application level with a separate key per connection. Message content is encrypted in transit (TLS) and at rest (AES-256) and is only accessible within your own organisation through Row Level Security. If you remove the connection in stipt, we delete the tokens immediately and revoke access at Google, after which stipt no longer fetches mail. Mail that has already been fetched remains part of the conversations and records in your workspace until you delete it or the agreement ends (see Retention). You can also revoke access yourself at myaccount.google.com/permissions. Want us to delete the Google data we have fetched? Email [email protected].

stipt's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Purposes

Operating and securing the stipt platform, fraud prevention, debugging, following up on demo requests, billing and meeting legal obligations.

Legal basis

For processing on behalf of customers: the data processing agreement between stipt and the customer; the customer determines its own legal basis towards data subjects.

For our own processing, the basis per purpose is:

Performance of the contract: entering into and performing the subscription, to the extent you are the customer yourself (for example as a sole trader).

Legitimate interest: data of contact persons and users at our business customers (they are not themselves a party to the contract), support and reports, securing the platform and preventing fraud and abuse, recording who accepted which version of our terms, following up on demo requests and the website's server logs.

Legal obligation: keeping invoices and accounts (statutory tax retention) and responding to requests from competent authorities.

Retention

We retain customer data for as long as the customer has an active contract with stipt, unless otherwise agreed in writing or the customer deletes it earlier. After the contract ends, the customer can export its data for another 30 days; after that we delete it, unless a statutory retention obligation prevents this. Backups are overwritten no later than 35 days after deletion. We keep technical logs for no more than 30 days and error reports in our error monitoring (stripped of email addresses, IP addresses and request content) for no more than 90 days. We keep billing data for 7 years (statutory tax retention). We keep other contact and account data of our customers and their staff for up to 2 years after the contract ends, proof of acceptance of our terms for up to 5 years after the contract ends, and demo request data for up to 2 years after the last contact.

Automated decisions

stipt does not take decisions about you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). AI features in the app, such as dot, make suggestions or carry out tasks that our customer turns on itself; that customer is responsible for what happens with them within its workspace.

Data subject rights

Data subjects have the right to access, rectification, erasure, restriction, objection and data portability. For data we process on behalf of a customer, requests must be directed to the controller (our customer). For our own processing, requests can be sent to [email protected]. You have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

International transfers

The database and files are stored in the EU (Frankfurt) and the application runs on servers in Germany, but not all processing takes place in the EU. Some of our sub‑processors are established outside the EEA or process data there: Anthropic (AI), Resend (email), Cloudflare (network), Sentry (error monitoring), Linear (user reports) and Apple and Google (push notifications to the mobile app) are based in the United States, Cohere (knowledge base) processes data in the United States and Supabase (database) is based in Singapore. Where a customer enables the WhatsApp channel, message content and contact identifiers are processed through the WhatsApp Business Platform (Meta Platforms Ireland Limited), which may transfer data to the United States. Where a customer enables the AI phone assistant, Deepgram (speech recognition; processed in the EU, company based in the United States) and ElevenLabs (voice; United States) process call data. Where a customer uses the Legplan module (solar panel layout), the roof outline and its coordinates go to Cobalt to calculate the mounting structure. Transfers rely on the European Commission's Standard Contractual Clauses (SCCs) or, where applicable, the EU‑US Data Privacy Framework. The table below lists the location and transfer basis for each sub‑processor.

Security

Encryption in transit (TLS) and at rest (AES‑256). Integration credentials are additionally encrypted at the application level, with a separate key per integration or per customer environment; the email addresses and phone numbers in the contact file with a separate key per customer environment. Message content is encrypted at rest but not at the application level, so it stays searchable. Access is enforced through Row Level Security per organisation. Two‑factor authentication is available and can be required per workspace for administrators or for all internal staff; the portal for field technicians and partners is outside that requirement.

Data breaches

In the event of a breach affecting a customer's data, we will notify that customer without undue delay and no later than 72 hours after discovery, in line with our data processing agreement. The customer, as controller, then handles any notification to the Dutch Data Protection Authority.

Changes

We may update this statement. Changes will be published on this page; material changes will be actively communicated to customers.

Contact

stipt B.V., Gedempte Oude Gracht 101 C, 2011 GN Haarlem, the Netherlands, Chamber of Commerce (KvK) 42115688. Questions about privacy or security? Email [email protected].

Sub‑processors

We engage the following sub‑processors; this is the current list from Schedule 1B of our data processing agreement. We have a data processing agreement with each, providing protection at least equivalent to our agreement with the customer.

• Hetzner Online GmbH

  Application hosting

  EU (Germany)

• Supabase Pte. Ltd.

  Database, file storage and authentication

  EU (Frankfurt), company in Singapore, SCCs

• Cloudflare, Inc.

  Network security and handling of web traffic

  Global network, US company, EU‑US DPF / SCCs

• Resend (Plus Five Five, Inc.)

  Email sent from stipt (quotes, appointment messages, system emails)

  US, EU‑US DPF / SCCs

• Meta Platforms Ireland Limited

  WhatsApp Business messaging

  EU (Ireland), US transfers under SCCs

• Anthropic Ireland, Limited (Anthropic PBC)

  AI models for classification, summaries, draft replies, the WhatsApp assistant and dot, among others

  US, SCCs

• Cohere Inc.

  Making the knowledge base and documents searchable

  US (company in Canada), SCCs

• Sentry (Functional Software, Inc.)

  Error monitoring

  EU (Germany), US company, EU‑US DPF / SCCs

• Linear Orbit, Inc.

  Handling of reports about bugs and ideas: the text of the report (without email addresses, phone numbers and IBANs), a summary, the reporter's first name and company name, a user ID and technical context; no screenshots

  EU, US company, SCCs

• Apple Inc.

  Push notifications to the mobile app; no names or message content

  US, EU‑US DPF / SCCs

• Google LLC (Firebase Cloud Messaging)

  Push notifications to the mobile app; no names or message content

  US, EU‑US DPF / SCCs

• Cobalt Mounting Systems

  Calculating the mounting structure for a roof layout (roof outline with coordinates), only when the customer uses the Roof layout module

  [to be completed]

• Deepgram, Inc.

  Speech recognition for the AI phone assistant, only if the customer turns it on (off by default); audio is not stored or used for training

  EU (EU processing), US company, SCCs

• Eleven Labs Inc.

  Voice of the AI phone assistant (only the text the assistant speaks), only if the customer turns it on (off by default)

  US, EU‑US DPF / SCCs

• OpenAI LLC

  AI models, only if the customer expressly chooses them (off by default)

  US, EU‑US DPF / SCCs

• Google LLC (Gemini)

  AI models, only if the customer expressly chooses them (off by default)

  EU/US, EU‑US DPF

• Mistral AI SAS

  AI models, only if the customer expressly chooses them (off by default)

  EU

Services you connect to stipt yourself, such as your own email provider (Microsoft 365, Google Workspace, IMAP), your accounting package (such as Exact Online), your own Twilio account for telephony or integrations you configure in workflows, process on your own instructions and are not sub‑processors of stipt. For addresses, travel times and maps we share only address and location data (and, for requests from your browser, your IP address) with Google Maps Platform (as a fallback for travel times) and OpenStreetMap (Nominatim and map tiles), which act as independent controllers. Public government data services (PDOK, 3D BAG, PVGIS) queried only with address or location data are not sub‑processors either.