Privacy policy

Gilsta, is responsible for the processing described here. Questions or requests: info@josvangilst.nl.

• Free site scan: the website address you enter and the scan results. To prevent abuse we store a one-way hash of your IP address, not the address itself. We email you your results once. Only if you tick the box on the scan form do we send a few follow-up emails with tips and offers (consent); every email has an unsubscribe link, and you can withdraw consent at any time.
• Demo requests and contact forms: your name, email address, company, website and message, so we can reply and plan the call.
• Client accounts: name, email address and a securely hashed password, plus the information you add about your business in the knowledge base.
• Payments: handled by Stripe. We receive your name, email, billing address, VAT number if given, and the subscription status. We never see or store card details.
• Website data: scan results, pages we write for you and the changes we make to your site.

We process this data to deliver the service you asked for (contract), to send invoices (legal obligation), to answer requests and prevent abuse (legitimate interest), and, only when you opted in, to send follow-up emails after a scan or to measure our ads with Meta (consent).

If you connect Google Search Console, we ask Google for read-only access (the webmasters.readonly scope). We use it only to show your search performance in your dashboard, to find pages worth writing or improving, and to report results to you. We store the clicks, impressions, positions and search terms Google returns, and a token that lets us refresh them daily.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising and do not use it to train general AI models. You can disconnect at any time in your dashboard or in your Google account; we then delete the token.

We use a small number of processors, each only for their part of the service:

• Vercel: hosting of this website and dashboard.
• Supabase: the database.
• Stripe: payments and invoices.
• Anthropic: generating draft texts from your knowledge base. Data sent through their API is not used to train their models.
• Google: Search Console data and PageSpeed measurements of your website.
• Zoom: when you book a demo call.
• Resend: sending our emails.
• Meta: measuring our Facebook and Instagram ads, only if you accept the Meta cookie (see Cookies below).

Some of these companies are based in the United States. Transfers take place under the EU standard contractual clauses or the EU-US Data Privacy Framework.

Scan results and demo requests: up to 12 months. Client account data: for as long as the subscription runs, and up to 3 months afterwards unless you ask us to delete it sooner. Invoices: 7 years, as Dutch tax law requires.

We use functional cookies to keep you logged in to the dashboard, to remember a partner link you came through, and to remember your cookie choice.

With your permission only, we use the Meta pixel (Meta Platforms Ireland) to see which of our Facebook and Instagram ads lead to a scan. It places the cookies _fbp and _fbc for up to 90 days. When you run a scan after agreeing, we also send Meta that a scan took place, with your email address in hashed (unreadable) form, so it can match the scan to the ad you saw. If you decline, nothing is sent to Meta.

When you arrive through one of our ads, we keep the campaign name from the link (UTM tags) with your scan, so we know which ads work. This stays with us.

Change your cookie choice

You can ask to see, correct, export or delete your data, or object to how we use it. Contact info@josvangilst.nl; we respond within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).