Privacy statement

1. Who we are

Mika Duineveld, trading as Segmentec (sole proprietorship), Reigerlaan 46, 2211 LH Noordwijkerhout, the Netherlands, KvK 97075841. This statement applies to segmentec.ai and to the app at app.segmentec.ai.

Questions about privacy, access or deletion: mika@segmentec.ai. All company details are on the contact page.

2. What data we process, why and for how long

There are four groups of people whose data we hold. For each group, you will find below what, why, on what legal basis and for how long.

a. You have an account in the app

For this data we are the controller.

Account

Name, email address, password (only as an unreadable derivative) or your Google identity if you sign in with Google; whether your email address is confirmed; when the account was created.

Purpose Signing in, recognising you, emailing you about your account (confirmation, password reset).

Retention As long as your account exists.

Project

Project name, who is a member and in which role, who created the project, the chosen plan (free or beta).

Purpose Making the app work and deciding who sees which conversations.

Retention As long as the project exists.

Invitations

Email address of the person you invite, who invited them, when, and whether the invitation was accepted. We store the invitation link only as a hash (an unreadable derivative).

Purpose Adding someone to your project.

Retention The link expires after 7 days; we keep the invitation itself as long as the project exists.

Beta keys

A label (who it is for), the hash of the key, who redeemed it and when.

Purpose Opening the beta only to people who received a key.

Retention As long as the beta runs.

Acceptance of the beta terms

Who accepted, on behalf of which project, when and which version.

Purpose Proof that the terms were accepted.

Retention As long as your account exists, and after that as long as we need it to show that acceptance.

Feedback

From the feedback button: type (bug, idea, question, other), your message, the page you were on, your browser, screen size and language, your project's plan and the app version. You only send a screenshot if you choose to; it may show content from your project.

Purpose Improving the app and answering your question.

Retention Screenshots: 90 days, then deleted. The message itself: until the beta ends, then at most 30 days (or anonymised). Screenshots are kept in private storage that only we can read.

Usage and activity log

What happens in a project (who changed a segment or theme, and when), the processing queue with status and error messages, and short technical logs from our hosting provider (without conversation content).

Purpose Making the app work, fixing faults, keeping track of costs.

Retention Project log: as long as the project exists. Hosting logs: briefly, at the provider.

Legal basis: the agreement with you (the beta terms). For feedback and the activity log: our legitimate interest in running and improving the app.

No analytics. We do not use tracking software to measure how you use the app. There is no Google Analytics, no pixel and no session recording.

Deletion. Emailmika@segmentec.ai and we will delete your account, your project or a conversation within 30 days. For now we do this by hand; a button in the app will follow. Deleted data may remain in our database provider's backups for a limited time.

Signing in with Google

If you choose to sign in with Google, Google sends us your name, your email address and your profile picture. We use your name and email address to create your account and sign you in; we do not use your profile picture. We do not ask for access to your Gmail, Drive, calendar or contacts.

We do not share data we receive from Google with anyone and do not use it for anything else. Our use of that data adheres to the Google API Services User Data Policy, including the Limited Use requirements.

b. You appear in a conversation that one of our customers uploaded

Our customers upload transcribed sales conversations. These contain names, roles and everything that was said. The customer decides which conversations to upload and for what purpose. The customer is the controller for this; we are the processor. We only process those conversations on the customer's instructions, to turn them into analyses, segments, profiles and copy. Not for our own marketing and not to train AI models.

How we do that is set out in the data processing agreement every customer concludes with us (part B of the beta terms). It also states that we send every conversation for analysis to Anthropic's AI model, which runs outside the EU (see section 4).

Do you appear in such a conversation and want to know what is stored about it, or have it deleted? Please contact the company that held the conversation with you. They are responsible and can instruct us. If your request reaches us, we will forward it to them.

c. You are a business contact or potential customer of ours

To find customers, we approached entrepreneurs who advertise an information product or coaching online. Since 8 October 2026 we no longer send cold emails, but we still keep the data we collected.

Where the data comes from: Meta's public Ad Library (Facebook and Instagram), the company's website, public social media profiles, and services that find a business email address for a company domain (Hunter, Apify). If you reply or book a call, we add what you tell us yourself.

What we hold: company name, website, first and last name, job title, business email address, sometimes phone number and social media profiles; the copy and transcribed videos of your public ads; an AI-made assessment of whether you fit our target audience and a sample analysis of your ad (the demo); the emails we sent and your replies; whether you viewed the demo; and if you booked a call: that, and what you filled in when booking. For the sample analysis we also use public reviews and comments from buyers in your market, without the names or usernames of their authors.

Legal basis: our legitimate interest in approaching businesses that could benefit from our product (business-to-business marketing). We only approach businesses, at business addresses, and only about Segmentec.

Unsubscribing: every email from us has an unsubscribe link. Reply with "not interested" or email mika@segmentec.ai and we will put you on our unsubscribe list. Your email address then stays on that list, so we do not approach you again.

Retention: as long as we see you as a potential customer, and at most 2 years after our last contact. We keep the unsubscribe list longer, because that list is what makes sure we leave you alone.

d. You email us or book a call

If you email mika@segmentec.ai or another of our addresses, we keep your email and our reply to help you and to be able to look back at the conversation later. If you book a call through our booking link, we receive your name, email address, the time and what you fill in. Legal basis: our legitimate interest in replying to your message, or the agreement we enter into with you. Retention: as long as needed for the contact, and at most 2 years after the last message.

3. Who receives your data

We use other companies to run Segmentec. They only process data on our instructions, except where stated otherwise below. The letters refer to the groups in section 2.

Supabase Pte. Ltd. (Singapore)

Database and sign-in. This holds the data of the app and of our customer system (CRM).

Where Servers in the EU (AWS): Frankfurt for the app, Paris for our CRM.

Applies to a, b, c, d

Vercel Inc. (VS)

Hosting of the website, the app, our CRM and the server functions; short technical logs.

Where Functions in Frankfurt (EU); the company is based in the US.

Applies to a, b, c

Anthropic Ireland, Limited (Ireland; parent company Anthropic PBC, US)

The AI model (Claude). Reads every uploaded conversation in full for the analysis; for our own customer outreach it assesses ad copy and creates a sample analysis. During the beta, part of the analyses runs through a Claude subscription (consumer terms, training turned off).

Where Processing outside the EU, mainly in the US.

Applies to b, c

Google LLC (US) and Google Ireland Limited (Ireland)

Google LLC only if you sign in with Google: Google gives us your name and email address; Google itself is responsible for your Google account. Google Ireland for our business email (Google Workspace).

Where Workspace under Google's EU terms. Google LLC is certified under the EU-US Data Privacy Framework.

Applies to a, d

Resend, Inc. (VS)

Sends invitation and sign-in emails. Sees only email address and name.

Where Sent from the EU; the company is based in the US.

Applies to a

Lucarius (sole proprietorship of E.L. Versluis), Leiden, KvK 42050944

Builds and runs the app and the servers. Has technical access to all data for that purpose, under a confidentiality and data processing agreement.

Where The Netherlands

Applies to a, b, c, d

Meta Platforms (Ireland/US)

Source, not a processor: we read the public Ad Library.

Where —

Applies to c

Hunter Web Services, Inc. (VS)

Finds a business email address for a company domain and checks that it exists.

Where Servers in Belgium; the company is based in the US.

Applies to c

Apify Technologies s.r.o. (Czech Republic, EU)

Collects public contact details from company websites and ad pages.

Where The company is based in the Czech Republic. Apify does not say exactly where the data is stored; transfers outside the EU are allowed.

Applies to c

Groq UK Limited (United Kingdom)

Transcribes the spoken text of public video ads. Under Groq's terms the contracting party for European customers; the service itself runs at the US-based Groq LLC.

Where US (Google Cloud)

Applies to c

Foo Monk, LLC (trading as Instantly.ai, US)

Sends our outreach emails, receives the replies and manages the unsubscribe link.

Where US

Applies to c

Cal.com, Inc. (VS)

The booking link for a call.

Where US

Applies to c, d

Telegram Messenger Inc.

Receives the short notifications our system sends to our own phone when a reply or booking comes in (name and company, never full emails). Telegram is a controller for this itself; there is no data processing agreement.

Where Data centres in the Netherlands for users in the EU; the group is based outside the EU.

Applies to c

With Supabase, Vercel, Anthropic, Google, Resend, Hunter, Apify, Groq and Instantly, a data processing agreement included in their terms applies, with the European Commission's standard contractual clauses where data leaves the EU. No data processing agreement with Cal.com has been signed yet. Telegram is not a processor. See section 4.

What we do not do: sell your data, share it with advertisers or use it to train AI models.

4. Outside the EU

The app's data is stored in Frankfurt and our CRM's data in Paris: both in the EU. Some data goes to companies outside the EU, mainly in the United States:

• Anthropic reads every uploaded conversation, including names, for the analysis. Anthropic's data processing agreement with the European Commission's standard contractual clauses applies. Anthropic does not train on data received through its commercial API; inputs and outputs are deleted within 30 days, except during an investigation into misuse (then longer). Our contracting party is Anthropic Ireland, Limited.
• Vercel is a US company; our functions run in Frankfurt. Vercel is certified under the EU-US Data Privacy Framework and we have a data processing agreement with standard contractual clauses.
• Hunter, Groq and Instantly (prospects only, section 2c) process (partly) in the US under their data processing agreements with standard contractual clauses. Hunter's servers are in Belgium, but the company and some of its suppliers are in the US.
• Cal.com (the booking link, sections 2c and 2d) processes in the US. No data processing agreement with Cal.com has been signed yet.
• Telegram only receives short notifications with a name and company name. Telegram is a controller for this itself and stores the messages in data centres in the Netherlands; the group is based outside the EU.

5. Cookies

The app uses four cookies, all functional: one for your sign-in session, one that remembers which project you had open, one for your language choice (Dutch or English) and one that holds your beta key while you sign up. The app does not work without them. There are no tracking cookies, no analytics and no pixels; that is why we do not ask for consent and you see no cookie banner.

We do not set cookies on segmentec.ai. If you choose a language there, your browser remembers it in its local storage.

The app also keeps a few things in your browser's local storage, such as drafts in the writing environment (Canvas) and text you have not saved yet. These stay on your device and never reach us. We host fonts ourselves; your browser does not contact Google when you visit.

6. Security

Data is encrypted in transit (TLS) and at rest. Each project is shielded in the database: a user only sees the projects they are a member of. Two people have administrator access (Mika Duineveld and E.L. Versluis), both bound by confidentiality. We store invitation and beta keys only as hashes. Every response from the AI model is logged immutably. The full list of measures is in annex 2 of the beta terms every customer receives.

7. Your rights

You have the right to:

• access your data
• have incorrect data corrected
• have your data deleted
• have the processing restricted
• receive your data in a common file format
• object to processing based on our legitimate interest, such as the prospect emails

Email your request to mika@segmentec.ai. We respond within a month; we carry out deletion and exports within 30 days. If you appear in a customer's conversation (section 2b), please contact that customer; we will help them.

If you are not satisfied, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Changes

If anything changes, we update this statement and put the new date at the top. For an important change we email account holders.