Privacy policy

This policy explains what personal data Klusio processes, why we use it, how long we keep it and who we share it with. Klusio has two different roles, described separately below. This is the English version of the full privacy policy.

Last updated: 21 October 2026

1. Who we are

Klusio is a sole proprietorship registered with the Dutch Chamber of Commerce under KVK number 78654785. Our VAT number is NL003361082B76. Contact us at info@klusio.nl or +31 85 115 5195.

2. Our two roles

Our role depends on where you use the service.

You visit klusio.nl: For example, you request a growth scan, ask us to call you or arrange a meeting. Klusio determines why and how your information is used and acts as the data controller. Sections 3 to 8 cover this situation.
You use a Klusio chatbot on another company’s website: That company determines why your information is used and acts as the data controller. Klusio processes the information on its behalf as a data processor. Section 9 covers this situation.

3. Information we process on klusio.nl

The information requested depends on the form you use. We ask only for information needed for that form’s purpose.

Growth-scan request: Your name, company name, website, email address, phone number, preferred contact method, industry, region, objective, reason for contacting us and how you found us.
Callback request: Your name, company name and phone number.
Demo booking: Your name and email address, entered with our scheduling provider. See section 7.
AI report newsletter: Your email address, your chosen language, the times you subscribed and confirmed, the place on the site where you subscribed, and an irreversible code derived from your IP address to prevent unlimited sign-ups from one address. We send the newsletter only after you confirm using the link in our email.
Every website visit: Our server logs record your IP address, visit time, requested page and browser information. We use this to investigate faults and prevent abuse, such as unlimited form submissions.
Only with your consent: Information about site activity through Google Analytics and Google Ads, and measurement of confirmed demo bookings through LinkedIn. See section 6.

4. Purposes and legal bases

We do not make decisions about you that are based solely on automated processing and have legal effects on you.

Answering your request and contacting you: Performance of a contract, or steps taken at your request before entering into a contract.
Preparing and sending your growth scan: Performance of a contract.
Delivering and invoicing the service: Performance of a contract, and our legal obligation to maintain financial records.
Security, abuse prevention and troubleshooting: Our legitimate interest in operating a working, secure service.
Emailing the quarterly AI report: Your consent, given through a confirmation link. You may withdraw it at any time using the unsubscribe link in each email.
Statistics and advertising measurement: Your consent.
Research into how AI systems answer, from 29 October 2026: Our legitimate interest in understanding AI answers for customers and the market. Answers to questions asked by Klusio are anonymised and aggregated for research and publications. Results are never identifiable to a company or person, every figure covers at least five companies, and information from your Google integrations is never included.

5. Retention

You may ask us to delete information earlier. Section 10 explains how to exercise your rights.

Enquiries that do not become a customer relationship: We delete these twelve months after your last contact with us.
Free Klusio start: During and immediately after the free growth round, we send three short progress emails: after approximately 24 hours, approximately one hour before the end, and immediately after it ends. They contain only results actually produced and include an unsubscribe link. If you do not become a customer, the trial account and its data are subject to the same maximum twelve-month period. If you request deletion earlier in Settings, we close access immediately and the cleanup worker removes the associated trial data. To prevent unlimited reuse of the free start, we retain only an irreversible verification code derived from the email address and domain using a secret key for up to twelve months. We cannot recover the email address or domain from that code.
Customer information: While the contract is active. Afterwards, we retain only what we are required to keep. Invoices and related financial records are retained for seven years to comply with Dutch tax requirements.
Chat conversations: Twelve months.
Newsletter: While you are subscribed. An unconfirmed subscription is automatically deleted after thirty days. If you unsubscribe, we retain only your email address and the unsubscribe record so that we do not email you again. To have that record removed as well, email info@klusio.nl.
Server logs: No longer than six months.
Google Business Profile: OAuth tokens are stored encrypted while the connection is active. Raw profile and review information retrieved from the Google Business Profile API is used temporarily and refreshed or deleted within thirty days. Text supplied or approved by the customer and technical evidence of completed actions follow the normal customer-account retention period.
Google Analytics, Google Ads and Google sign-in: The storage and retention details for these connections are in section 7 below.

6. Cookies and storage on your device

We use cookies and browser storage. We ask for prior consent for anything that is not strictly necessary. Without that consent, the corresponding scripts are not loaded and no request is made to the relevant provider.

Necessary cookies: klusio_csrf: thirty days, to protect forms against abuse; it contains a random string rather than information about you. klusio_consent: 180 days, to remember your choice. PHPSESSID: until your browser closes, to recognise a signed-in dashboard session.
Analytics, only with consent: _ga and _ga_CYBRSS6MPN: two years. Google Analytics 4 helps us understand which pages visitors use and where they leave.
Google advertising measurement, only with consent: _gcl_au and related Google Ads conversion cookies: ninety days. They measure whether an advertisement led to an enquiry.
LinkedIn advertising measurement, only with consent: The LinkedIn Insight Tag is used only on the Dutch or English demo-booking page after Calendly confirms a booking. LinkedIn may use advertising and recognition cookies; its current cookie list gives their names and durations. The sessionStorage entry klusio-linkedin-demo:… remains until the tab closes and contains an irreversible booking code to prevent duplicate measurement.
What our LinkedIn connection sends: The fact that a demo was booked, the demo-page address without URL parameters, and an irreversible booking code. We do not send the booking form’s name, email address or answers and do not use email matching. The LinkedIn tag also receives technical information, including IP address, browser information, referring page and time, and may measure interaction on the demo page. LinkedIn may associate this information with a LinkedIn member for advertising reporting. Without marketing consent, we do not load the tag; you can still book a demo.
Opening the scheduling module: Our scheduling module loads when you open it. From that point, the scheduling provider uses its own cookies. If you do not open it, that does not happen.
Chatbot storage: The chatbot uses localStorage, which stays in your browser until you clear it, including after closing the tab or browser. It can store the conversation, details you entered such as your name, email address and phone number, summaries of previous conversations, and the time of your last visit and interaction so a conversation can resume. This storage is created only after you open the chatbot. You can remove it by clearing this site’s browser storage.
Changing your choice: Use Cookie preferences at the bottom of any page. You can withdraw consent as easily as giving it and can also delete cookies in your browser settings. We do not use a cookie wall: the site remains available with necessary cookies only.
Google Consent Mode v2: Until you consent, ad_storage, ad_user_data, ad_personalization and analytics_storage are set to denied.

7. Who we share information with

We do not sell your information. We use service providers to deliver the service and make processing arrangements for work performed on Klusio’s behalf. Advertising platforms such as LinkedIn also process information under their own privacy terms after you consent.

AI language-model provider: Processes chat content and generates content. Everything you type into the chat passes through this provider. Processing may take place in the United States.
Google: Analytics and Ads for klusio.nl itself. After a signed-in customer deliberately connects a service, also that customer’s Google Analytics, Google Ads, Google Business Profile and Search Console, and sign-in with Google. Processing may take place in the United States. The connections are explained below.
Stripe: Customer payments and subscriptions. Processing may take place in the United States.
Calendly: Scheduling demo appointments. Processing may take place in the United States.
Search and market-data provider: Keyword and competitor information for the growth scan and dashboard. Processing may take place in the United States.
Hosting provider: Storage of the website and database and email delivery, within the EU.
LinkedIn Ireland Unlimited Company: Measurement of confirmed demo bookings. Processing may also take place outside the EU, including in the United States. Section 6 explains the information used by our connection.

Google Business Profile

A signed-in customer can connect Google Business Profile using the business.manage scope. We use that access to list managed accounts and locations, read the selected location, publish customer-created or approved posts, verify live status and process reviews or replies within the features the customer uses.

Publication permission: Automatic publication is off by default. Klusio records when consent was given and its version.
Disconnecting: You can disconnect in the dashboard. Klusio then also attempts to revoke Google permission, deletes stored tokens and disables automatic publishing. You can revoke access at any time in your Google account’s security settings.
Protection and use: Access and refresh tokens are stored encrypted. We do not sell Google user data or use it for advertising. Staff access is limited to necessary support or security. Google data use and transfer follow the Google API Services User Data Policy, including Limited Use.

Google Analytics

A signed-in customer can connect Google Analytics using analytics.readonly. This is read-only access: Klusio cannot change your Analytics account, manage users or alter settings.

Information read: Names and IDs of accessible Analytics accounts and properties, and the website URLs of their data streams, so Klusio can suggest the property for your site. From the property you select, Klusio reads aggregate figures: views per page; sessions from AI platforms by day, source and landing page; totals such as page views, active users and average session duration; visits and enquiries by landing page and channel; event names and counts; and which events are configured as key events. Klusio does not retrieve information about individual visitors.
Purpose: To show visits to your articles and pages, visits from AI platforms, and to help choose which existing articles need attention first.
Storage and retention: Google tokens are encrypted in Klusio’s database at our hosting provider. Retrieved figures are stored with your account in that database. Tokens are kept while connected and deleted immediately on disconnection. Figures remain so your history is visible, subject to the customer retention period in section 5. For earlier removal, email info@klusio.nl.
Access: Users of your Klusio account can see the figures. Klusio staff may access them only in the situations described under All Google connections below.
Disconnecting: Disconnect under Google Analytics in your Klusio account. Klusio deletes stored tokens and stops retrieval. Revoke the underlying Google permission yourself in your Google account. Klusio does not revoke it automatically because the same permission may serve another Klusio account connected to that Google account.

Google Ads

A signed-in customer can connect Google Ads using the adwords scope. Google offers this single scope rather than a separate read-only scope. The consent screen therefore says Klusio can view, edit, create and delete Ads information. The following describes what Klusio actually does.

Information read: Accessible Ads accounts and their names. For the selected account: campaigns, ad groups, ads, keywords, assets and settings such as budget, target area and schedule; search terms; conversion actions; Google recommendations; performance including impressions, clicks, cost and conversions; and account change history, including the email address of the person who made a change.
Purpose: To show results and opportunities in the Ads cockpit and campaign manager, flag wasted spend or sudden changes, and distinguish changes made by you, Klusio or Google. The email address in change history is used only for that distinction.
Permitted changes: Only specific actions you choose and then confirm in Klusio: publishing a campaign created in the campaign builder, initially paused and without spending until enabled; pausing or enabling a campaign, ad or keyword; changing a daily budget or moving budget between campaigns; adding, replacing or removing keywords; excluding keywords or search terms; applying a recommendation such as a schedule; or pausing the weaker ad in an A/B test. Klusio makes no automatic changes and does not delete campaigns, ad groups or ads. Changes are recorded in the Ads cockpit and Google Ads change history.
Storage and retention: Encrypted Google tokens and the selected Ads customer ID are stored in Klusio’s database at our hosting provider. Retrieved data is stored with your account. Tokens remain while connected and are deleted immediately on disconnection. Retrieved data remains for account history under the retention period in section 5; request earlier removal at info@klusio.nl.
Access and disconnection: Your Klusio-account users can see the data. Staff access follows All Google connections below. Disconnect in the Ads cockpit or campaign manager to delete tokens and stop retrieval and changes. Revoke the underlying permission in your Google account.

Sign in with Google

Google sign-in uses only openid, email and profile. It does not grant access to Gmail, your calendar, files or other Google services.

Information received: Your name, email address, whether Google verified it, profile-picture URL and the identifier Google uses for your account.
Purpose: To verify your identity, find and sign you into an existing Klusio account, or prefill your name and email address for a new registration.
Storage and retention: We store only an irreversible verification code derived from the Google account identifier with your Klusio user so you can use the same Google account next time. It remains while your user exists. For a new registration, your name, email address and picture URL remain in the session for no longer than one hour. Klusio stores no Google access tokens for sign-in.
Removing the connection: Email info@klusio.nl to remove the connection from your Klusio user. You can also revoke access in your Google account.

All Google connections

Google information is used only for the functions described above that you use in Klusio.

Use restrictions: We do not sell this data, use it to serve or target advertising, retarget people, assess creditworthiness or train general AI models. Managing your own Google Ads campaigns at your request is the service itself and is separate from using your data for ad targeting.
Sharing: We transfer the information only when a feature you use requires it: to our hosting provider for storage and, for summaries, ad text or keyword advice, to the AI language-model provider or search and market-data provider listed above. Otherwise, sharing takes place only where required by law.
Human access: Klusio staff view this information only when you request it, for example for support; when needed for security or investigating abuse; or when the law requires it.
Revoke access: You can revoke access through your Google account’s third-party connections at any time. Klusio can then no longer retrieve or change information.
Limited Use: Klusio’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Provider names and international transfers

Some providers are described by category because we consider their identity commercially confidential. On request, we will identify the provider, country and basis for transfer that applies to your situation. Email info@klusio.nl.

Outside the EU: Some providers process information in the United States. We rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses with supplementary measures.
Required disclosures: We also provide information where legally required, for example to a regulator or in response to a lawful request from judicial authorities.

8. Security

Traffic between your browser and our servers uses TLS/HTTPS encryption. Dashboard access is protected by two-factor authentication. System access is limited to those who need it, access is logged and systems are monitored for unauthorised use. Passwords are stored in a protected form that we cannot read.

Encrypted connections, not end-to-end encryption: We can access chat content because we store and process it to provide the service. We therefore describe an encrypted connection rather than end-to-end encryption.

9. Chatbots on another company’s website

When you use a Klusio chatbot on a customer’s website, that company is the data controller. It determines what information to request, its purposes and retention. Its privacy policy applies.

Klusio’s role: Klusio acts as a processor and processes the information only on the company’s instructions and to provide and secure the service. We do not use it for our own purposes. Conversation content is also processed by the providers in section 7. Business customers receive the complete list of subprocessors, including names and countries, in their data processing agreement.
Access or deletion requests: Address your request to the company whose chatbot you used. If you need help finding the right contact, email info@klusio.nl.

10. Your rights

You may request access, correction, deletion or restriction of processing; object to processing based on legitimate interests; receive your information in a commonly used format or have it transferred; and withdraw consent at any time without affecting processing that took place before withdrawal.

Making a request: Email info@klusio.nl. We respond within one month. We may ask you to identify yourself to avoid disclosing information to the wrong person.
Complaints: If you are dissatisfied with how we handle your request, you may complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.

11. Data breaches

If a breach occurs, we promptly assess its nature and extent, limit the harm and record it in our breach register. Where there is a risk to your rights and freedoms, we report it to the Dutch Data Protection Authority within 72 hours. Where the risk is high, we also inform you. If a breach affects a customer for whom we act as processor, we inform that customer without undue delay.

12. Changes and questions

We update this policy when our service or regulations require it. The date at the top shows the last update. We actively communicate significant changes. Questions about this policy or the information we process about you can be sent to info@klusio.nl.