Privacy policy

Introduction and contact details

Stripbuilder ("Stripbuilder", "we" or "us") takes the protection of personal data seriously. This privacy policy explains which personal data we process through our website (stripbuilder.nl) and our application (app.stripbuilder.nl), for which purposes, and what rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act.

Stripbuilder is registered with the Dutch Chamber of Commerce (KvK) under number 69423962, with VAT number NL857869796B01, and has its registered office at Lijnbaan 3C, 2352CK, Leiderdorp, the Netherlands. For questions about privacy or to exercise your rights, contact us at info@stripbuilder.nl.

Our role: controller and processor

For some processing we are the controller, for other processing we are the processor. For data about our own visitors and subscribers - such as account data, billing data and website usage - we are the controller.

When an operator (our subscriber) uses the platform to process personal data about their own clients - for example names, event details and uploaded photos - the operator is the controller and Stripbuilder acts as the processor. A data processing agreement applies to that processing. If you are a client of an operator and have questions about your data, please contact that operator.

What personal data we process

Account data: name, email address, company name and login credentials of operators.

Billing data: subscription details and payment status. Payments are handled by our payment provider; we do not store full credit card details ourselves.

Content and usage data: designs created by operators and their clients, uploaded images, questionnaire answers and chosen extras.

Operators' client data: data an operator enters, or has entered, about their clients to handle an event.

Technical data: IP address, browser type, device information and log data, collected to keep the service secure and reliable.

Contact data: name, email address and message content when you use the contact form.

Purposes and legal bases

We process personal data only for clearly defined purposes and on a basis set out in Article 6 GDPR.

Performance of the contract: to provide and maintain your account, subscription and the platform.

Legitimate interest: to secure the service, prevent abuse and improve our products, insofar as your interests do not override this.

Legal obligation: to comply with, for example, tax retention requirements.

Consent: for optional analytics cookies and any newsletters. You can withdraw consent at any time.

AI Magic and image processing

The AI Magic feature generates backgrounds from a text description or an uploaded image (such as an invitation). To generate a result, we send the relevant text and image to our AI provider (OpenAI), which acts as a sub-processor. The input is used to produce the result and is not used by us to train models.

Do not upload or describe data for which you have no right or legal basis. Operators are responsible for ensuring that they, and their clients, hold the necessary rights and consents for the images they process through AI Magic.

Sub-processors and other recipients

We never sell personal data. To deliver the service we engage carefully selected providers, including: Vercel (hosting), Supabase (database and storage), Lettermint (transactional email), OpenAI (AI Magic) and Stripe (payments). Data processing agreements are in place with these parties.

We only share data with third parties where necessary for the service, where you have given consent, or where we are legally required to do so.

Transfers outside the European Economic Area

Some of our providers are located outside the EEA, including in the United States. Where personal data is processed outside the EEA, we ensure appropriate safeguards, such as the European Commission's Standard Contractual Clauses or a valid adequacy decision.

Retention

We do not keep personal data longer than necessary for the purposes for which it was collected. We keep account data for as long as you have an account; after termination we delete or anonymize it within a reasonable period, except for data we are legally required to keep longer (such as invoices for the statutory tax retention period). We keep contact messages for as long as needed to handle your question.

For personal data we process on behalf of an operator, the retention periods set by the operator as controller apply, subject to our data processing agreement.

Security

We take appropriate technical and organizational measures to protect personal data against loss and unlawful processing, including encrypted connections, access restrictions and secure hosting providers. No service can guarantee absolute security; in the event of a data breach we act in accordance with our legal obligations.

Your rights under the GDPR

You have the right to access, rectify, erase, restrict processing of, and port your data, and the right to object to certain processing. Where we process on the basis of consent, you can withdraw it at any time.

To exercise a right regarding data for which we are the controller, contact us at info@stripbuilder.nl. If it concerns data that an operator processes about you as a client, that operator is the controller and it is best to address your request directly to that operator.

Cookies

Our website uses functional cookies and, only with your consent, analytics cookies. Read more about this in our cookie policy.

Filing a complaint

If you believe we do not handle your personal data with due care, we would like to hear from you at info@stripbuilder.nl. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes to this policy

We may update this privacy policy from time to time. The most current version is always available on this page, with the date of the latest change shown at the top.