Privacy policy

Gilsta, is responsible for the processing described here. Questions or requests: info@josvangilst.nl.

• Free site scan: the website address you enter and the scan results. To prevent abuse we store a one-way hash of your IP address, not the address itself.
• Demo requests and contact forms: your name, email address, company, website and message, so we can reply and plan the call.
• Client accounts: name, email address and a securely hashed password, plus the information you add about your business in the knowledge base.
• Payments: handled by Stripe. We receive your name, email, billing address, VAT number if given, and the subscription status. We never see or store card details.
• Website data: scan results, pages we write for you and the changes we make to your site.

We process this data to deliver the service you asked for (contract), to send invoices (legal obligation), and to answer requests and prevent abuse (legitimate interest).

If you connect Google Search Console, we ask Google for read-only access (the webmasters.readonly scope). We use it only to show your search performance in your dashboard, to find pages worth writing or improving, and to report results to you. We store the clicks, impressions, positions and search terms Google returns, and a token that lets us refresh them daily.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising and do not use it to train general AI models. You can disconnect at any time in your dashboard or in your Google account; we then delete the token.

We use a small number of processors, each only for their part of the service:

• Vercel: hosting of this website and dashboard.
• Supabase: the database.
• Stripe: payments and invoices.
• Anthropic: generating draft texts from your knowledge base. Data sent through their API is not used to train their models.
• Google: Search Console data and PageSpeed measurements of your website.
• Zoom: when you book a demo call.

Some of these companies are based in the United States. Transfers take place under the EU standard contractual clauses or the EU-US Data Privacy Framework.

Scan results and demo requests: up to 12 months. Client account data: for as long as the subscription runs, and up to 3 months afterwards unless you ask us to delete it sooner. Invoices: 7 years, as Dutch tax law requires.

We only use a functional cookie to keep you logged in to the dashboard. We do not use tracking or advertising cookies.

You can ask to see, correct, export or delete your data, or object to how we use it. Contact info@josvangilst.nl; we respond within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).