Privacy policy

Who is responsible

The controller is A101 B.V., trading as Vidalo, Factorij 80, 3071 AV Rotterdam, the Netherlands, KvK 42057858.

For questions and requests about your data, email support@vidalo.io, call +31 85 109 1393 or write to the address above. We have no data protection officer; we are not required to.

Who this is about

Vidalo is for businesses. Mostly we process details about a business, such as name, address and opening hours. Those are personal data when they relate to a person, for example a sole trader trading under the owner's name.

We also process details about the people who deal with us: who requests a check, who has an account or is a customer, who emails or calls us, who joins the ‘Coming soon’ list and who visits our website.

The free check

When you request a free check, we look up the business and ask AI assistants questions about it.

• Data: the name, place and public details of the business, such as address, phone number, website and opening hours; the answers of AI assistants and the sources they name; your email address, if you want the report by email. To limit abuse we turn your IP address and the date into a code and keep that code; we do not store your IP address itself.
• Origin: from you, and from public sources: Google (business details from Google Maps), the KvK Trade Register, the business's website and the sources AI assistants name.
• Basis: our legitimate interest, and yours, in showing what AI assistants say about a business (article 6(1)(f) GDPR). These are business details that are already public.
• Retention: the report can be viewed through the link for 30 days. We keep the data of the check for up to 12 months after the check, so a later check can show what changed; then we delete it. If you become a customer, the periods under ‘A paid plan’ apply.

If someone else checked your business, we use only public business details. If you do not want that, email us and we will delete that check.

Reminders after a free check

If you gave your email address for the report, we send you a short reminder about the result 7 and 21 days later.

• Data: your email address and the name of the business.
• Basis: our legitimate interest in helping you with the result of a check you requested yourself.
• Retention: until you unsubscribe or until the second reminder. Every email has a one-click unsubscribe link; after that we no longer send you these emails.

Your account and signing in

• Data: your email address, a number for your account, when you signed in, your language and which emails you want to receive.
• Basis: the performance of the agreement with you (article 6(1)(b) GDPR).
• Retention: as long as your account exists. You delete your account yourself, see ‘Your rights’.

Proof that you manage the business

Before we publish a business's details or ask for something on its behalf, you have to show that you manage the business. An email address alone is not proof.

• With Google: Google gives us a number for your account and which business profiles you manage. If it matches, we keep when the proof was given and the access key Google gives us, so we can update your business profile. We never see your password.
• With a code by phone: we call or text a code to the phone number Google Maps lists for the business; you do not type that number yourself. This goes through Twilio, which processes the number, the code and the details of the call or message. We keep only a partly hidden number (such as 020 ••• ••67), whether the code was right, when, and who asked.
• Basis: the performance of the agreement with you.
• Retention: as long as your account exists, or until you disconnect Google.

If we add another way to give the proof, we will add it to this privacy policy before we use it.

A paid plan

• Data: the details of your business that you confirm, with every earlier version; these may contain personal data, such as a name or phone number. Also the results of the checks, the errors we found, the correction requests we sent and the proof of a fix.
• What we do with it: we publish your confirmed details on your facts page, which anyone can see. We send them to sources containing an error to ask for a fix, and to your Google Business Profile if you connect it. AI assistants receive business details only, never your email address.
• Basis: the performance of the agreement with you.
• Retention: as long as you are a customer. After your subscription ends we keep your data for another 90 days. We then do one more free check and delete your data within 30 days after that. Only what the law requires for our accounts we keep for 7 years. What has been fixed at another party stays there.

Payment and invoices

You pay through Stripe. Stripe processes your payment details as an independent controller, under its own privacy policy; we do not see your card or account number.

• Data: your name, billing address, VAT number, email address, a Stripe customer number and whether your payment succeeded.
• Basis: the performance of the agreement and our legal obligation to keep accounts (article 6(1)(b) and (c) GDPR).
• Retention: invoices and the data on them for 7 years, because Dutch tax law requires it.

Contact and support

If you email, call or message us, we use your data to help you.

• Data: your name, email address or phone number, your message and our reply.
• Basis: our legitimate interest in answering your question, or the performance of the agreement if you are a customer.
• Retention: up to 2 years after the last contact, unless the message belongs to your customer records or our accounts.

If you send us a WhatsApp message, WhatsApp (Meta) also processes that message under its own terms.

The assistant on our website

The assistant on vidalo.ai is an AI system. To answer, we send your question and the earlier messages of the same conversation to OpenAI.

• Data: what you type in the chat window. We do not store the conversation; it exists only in your browser tab. To limit abuse we keep your IP address in memory for a few minutes.
• Basis: our legitimate interest in answering questions about Vidalo quickly.
• Do not type personal data or confidential information into the chat window.

The ‘Coming soon’ list

If you join the list on the ‘Coming soon’ page, we email you once when Vidalo opens. No newsletter and no advertising for anything else.

• Data: your email address, the language of the page, the time you signed up and the sentence with which you gave consent.
• Basis: your consent (article 6(1)(a) GDPR). You withdraw it by emailing hello@vidalo.io; we then remove your address from the list straight away.
• Retention: until we have emailed everyone about the opening; then we delete the list.

Your visit to the website

Our website runs on Cloudflare. On every visit Cloudflare receives your IP address, your browser and the page you request, to deliver the page and protect the site.

On the free check and on signing in we use Cloudflare Turnstile to tell people from robots. To do so, Turnstile reads characteristics of your browser and device.

Basis: our legitimate interest in a website that works and is secure.

Only if you consent in the cookie notice do we measure with Google Analytics how the site is used (statistics) and with the Meta pixel whether our advertisements on Facebook and Instagram lead to visits (advertising). Google and Meta then receive your IP address, your browser and the pages you view. For the Meta pixel we and Meta are jointly responsible for collecting and passing on the data. Basis: your consent, which you can always withdraw through ‘Cookie settings’ at the foot of every page. How long: see the durations in our cookie policy; in Google Analytics we keep data for 14 months.

Who we share data with

We do not sell data. We share it only with parties we need for the Service, with whom we have agreed on security and confidentiality:

• Supabase: database and sign-in; stored in the EU (Ireland).
• Cloudflare: hosting of the website and the facts pages, security and Turnstile; a worldwide network of a US company.
• Stripe: payments and invoices; EU and United States.
• Resend: sending our emails; United States.
• Google: our mailbox (Google Workspace), business details from Google Maps, Gemini, signing in with Google and your business profile; EU and United States.
• OpenAI: ChatGPT for the checks, and the assistant on our website; United States.
• Anthropic: Claude for the checks; United States.
• Twilio: calling or texting the code with which you show that you manage the business; United States.
• Google Analytics: visitor statistics, only with your consent; EU and United States.
• Meta (Facebook, Instagram): measuring our advertisements, only with your consent; EU and United States.
• Perplexity and SerpAPI (for the answers of Google AI), when we ask those AI assistants; United States.
• The KvK: we look up a business in the Trade Register by name and place.
• Sources containing an error, such as a website or directory: they receive the confirmed details of your business when we ask for a fix.

Otherwise we give data to others only with your consent, or when the law requires us to.

Data outside the European Economic Area

Some of these parties process data in the United States. We base that transfer on the European Commission's decision on the EU-US Data Privacy Framework where the party is certified under it, and otherwise on the European Commission's standard contractual clauses, with additional measures where needed. If you want to know which safeguard applies to a party, email us.

Automatic assessment

We automatically compare answers of AI assistants with the details of a business. That is an assessment of an answer, not a decision about you. We take no decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not profile people.

Security

We protect data with appropriate technical and organisational measures: encrypted connections, sign-in without a password, access per account to your own data only, as few people with access as possible, and checks against abuse. If we discover a data breach that poses a risk to you, we inform you and the Dutch Data Protection Authority as the law requires.

Your rights

You have the right to access your data, have it corrected or deleted, have its processing restricted, receive your data in a common file format, and withdraw a consent. Withdrawal works for the future.

Much of this you can do yourself, under ‘Account’ in your account: under ‘Your data’ you download everything we keep about your business, and delete everything once your subscription has ended. There you also choose which emails you want to receive.

For anything else, email support@vidalo.io. We respond within a month. Sometimes we first ask you to show that the request comes from you.

Providing data is not a legal requirement. Without an email address we cannot send you a report or give you an account, and without payment and business details we cannot deliver a plan.

Your right to object

Where we process your data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation. We then stop, unless we have compelling reasons that override it. Against emails you can switch off, your objection always works: unsubscribing takes one click.

A complaint

If you disagree with us, please tell us first so we can find a solution together. You can also always lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), at autoriteitpersoonsgegevens.nl.

Changes

We update this privacy policy when the Service or the law changes. The new version is on this page, with its date. If we are going to use data for a new purpose, we tell you in advance so you can object.