Who is responsible
Collabix.ai B.V., Singel 542, 1017 AZ Amsterdam, the Netherlands, Chamber of Commerce (KVK) 97088617, VAT NL867905876B01, is the controller for the data described here. Questions and requests: info@collabix.ai.
This statement covers the website collabix.ai and gives a summary of how the Collabix service handles customer data. For a customer organisation, the service is governed by the agreement and the data processing agreement (DPA) with that organisation; where this page and the DPA differ, the DPA applies.
On this website
The «Ask the founders» form
You give us your email address and your question. We also record which page you wrote from and in which language, and, if you came from the price card, the plan you configured (team spaces, users, extra hours, billing, price). We use it to answer you and, if you ask for an invoice or a demo, to prepare that. The message is stored in our CRM, HubSpot (EU data centre), with Jeroen Lausberg as the owner of the contact, and reaches us by email. We keep it for as long as the conversation lasts; if nothing comes of it, we delete it within twelve months of our last contact. Legal basis: steps prior to a contract and our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR).
Booking a demo
«Book a demo» opens Cal.com. Cal.com asks for your name, work email, company, role, which tracker your team uses and anything we should know, and it stores your calculator choices with the booking. The appointment lands in the calendar of the founder who gives the demo (Google Calendar) and the contact is created in HubSpot. Cal.com sends the confirmation and a reminder. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR). We keep demo bookings for as long as we are in contact and delete them within twelve months after that.
Analytics
We use Google Analytics 4 to see which channels bring teams here and which pages they read. It only loads after you allow it in the cookie notice; until then nothing is sent to Google. We send the page language and the events demo click, demo booked, subscribe click, form sent and calculator used. IP addresses are shortened. We keep analytics data for up to fourteen months. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time under «Cookie settings» at the bottom of every page.
Hosting
The website is served by Microsoft Azure Static Web Apps. Azure keeps standard access logs (IP address, browser, time, page) for the security and operation of the site. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Cookies and local storage
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| cbx-consent | collabix.ai (local storage) | Remembers your answer in the cookie notice | Until you clear it |
| cbx-utm, cbx-plan | collabix.ai (session storage) | Keeps the campaign you arrived with and the plan you configured, so a demo or invoice request carries them | Until you close the tab |
| _ga, _ga_* | Google Analytics | Distinguishes visitors; only after consent | Up to 2 years |
We do not load HubSpot's tracking script, advertising pixels or social media plug-ins. Cal.com sets its own cookies inside the booking window; see Cal.com's privacy policy.
In the Collabix service
When a customer organisation uses Collabix, we process the data that organisation connects: calendar events, meeting audio and transcripts, the goals, decisions and actions written in the product, and the tickets, documents and messages in the tools it connects (Jira, Google Workspace, Slack, Microsoft Teams, Zoom). The organisation is the controller; Collabix.ai B.V. is the processor under the DPA.
- Where. Collabix runs on Microsoft Azure with per-customer isolation. Data can be processed on EU or US Azure infrastructure; the exact production region for your environment is confirmed in writing in the DPA.
- AI. Azure OpenAI data is not used for model training. Your content never reaches OpenAI's consumer services and is not visible to other customers.
- Protection. Encryption in transit and at rest, secrets in Azure Key Vault, role-based access, MFA on administrator access. We are not yet SOC 2 or ISO 27001 certified. More on the security page.
- Sub-processors. Microsoft Azure (hosting and AI), Recall.ai (joining meetings and capture), Gladia (live transcription), Stripe (invoices and payments; card and bank details are entered on Stripe's pages and never reach our servers), a transactional email provider, HubSpot (CRM) and Cal.com (demo bookings). The current list with regions is in the DPA.
- Retention, per the policy. Account data while the account is active; meeting content for as long as the organisation keeps it; connector tokens deleted the moment a connector is disconnected; billing records 7 years (Dutch tax law); technical logs 90 days; after the account closes we delete or anonymise within 90 days, and out of backups within a further 35 days.
- Google data. Collabix's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Transfers outside the EEA
Where a provider processes data outside the European Economic Area, the transfer rests on the EU Standard Contractual Clauses or an adequacy decision (for the United States, the EU-US Data Privacy Framework where the provider is certified).
Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on our legitimate interest. Write to info@collabix.ai; we answer within a month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
Changes
We update this statement when the website or the service changes. The date at the top is the version you are reading; earlier versions are available on request.