Privacy Policy

A short overview. The full policy below is the legally binding version.

• We collect your contact details only when you give them to us, and basic website statistics only when you accept analytics cookies.
• If you have an account on our downloads or licence portal, we keep the details needed to run your account and licences.
• We use your data to answer you, run our services, keep the sites secure and meet our legal duties. We never sell it.
• Our AI features use your own account with an AI provider. The text you send goes to that provider, not to us.
• You can ask to see, correct, delete or export your data, object to its use or withdraw consent at any time. You can also complain to the Dutch Data Protection Authority.
• Questions? Email info@centipod.io.

Centipod B.V. is the controller of the personal data described in this policy. Our details are Centipod B.V., Mauritsstraat 40, 2271 SE Voorburg, the Netherlands, Chamber of Commerce number 67295444, email info@centipod.io.

We have not appointed a data protection officer, as the law does not require one for our activities. Questions about privacy go to the address above.

This policy covers centipod.io and the websites and portals we run under it, including the downloads and licence portals, and the Centipod software products. When we process personal data on behalf of a client as part of an engagement, we act as that client’s processor under a data processing agreement, and the client’s own privacy notice applies, not this policy.

• Contact details: name, email address, phone number, organisation and message sent through the contact form or by email. We use these to answer you and, where requested, prepare an engagement. The legal basis is steps at your request before entering into a contract, Article 6(1)(b) GDPR, or our legitimate interest in answering enquiries, Article 6(1)(f).
• Portal accounts and licences: name, email address, organisation, licences issued to you, server names a licence is registered for, and records of downloads and sign-ins. We use these to run your account, issue and check licences, and provide support. The legal basis is performance of the contract with you or your organisation, Article 6(1)(b).
• Website statistics: pages visited, browser type, time on page, referral source and an approximate location derived from your IP address, collected with Google Analytics. We use this to understand and improve the sites. The legal basis is your consent, Article 6(1)(a), given in the cookie banner.
• Security and operations: IP addresses, request details and error logs created by our hosting, and the Google reCAPTCHA spam check on the contact form. We use this to keep the sites available and secure, and prevent abuse. The legal basis is our legitimate interest in the security of our services, Article 6(1)(f).
• Updates about our work: only if you ask for them. The legal basis is your consent, Article 6(1)(a), which you can withdraw at any time.
• Business records: agreements and invoices. We use these to meet our legal duties, including Dutch tax law. The legal basis is legal obligation, Article 6(1)(c).

You are not required to give us personal data. Without contact details we cannot answer an enquiry, and without account details we cannot provide a portal account. We do not use automated decision-making, including profiling, that has legal or similarly significant effects for you.

• Essential cookies: strictly necessary for the sites to work, for example to remember your cookie choice or keep you signed in to a portal. They do not need consent.
• Analytics cookies: Google Analytics cookies, such as _ga and _ga_*, are placed only after you accept them in the cookie banner on centipod.io or downloads.centipod.io. Your choice is stored separately for each site. Use Cookie preferences at the bottom of either site to change it or withdraw consent at any time.
• We do not send contact-form contents, client names, licence details, signed download links or URL query strings to Google Analytics. Advertising personalisation and Google signals are switched off. We do not use advertising or social media tracking cookies.

We do not sell your personal data. We share it only with service providers that process it on our behalf under a data processing agreement, and with others only where the law requires it:

• Amazon Web Services: hosts the sites and portals, provides sign-in to the portals through Amazon Cognito and sends email through Amazon SES. Data is stored in the European Union, Ireland. Some global services, such as content delivery, may process request data outside the EU.
• Google: provides Google Analytics, only with your consent, and Google reCAPTCHA on the contact form. Google may process data in the United States.
• Professional advisers and authorities: where necessary to meet a legal obligation or establish, exercise or defend legal claims.

Where a provider processes personal data outside the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified US companies, or on the Commission’s standard contractual clauses with additional safeguards where needed. You can ask us for more information about these safeguards.

• Enquiries: up to 12 months after the enquiry is closed, unless it leads to an engagement.
• Portal accounts: as long as the account is active, and deleted within 12 months after it is closed.
• Licence and invoice records: seven years, as Dutch tax law requires.
• Website statistics: event-level data for 2 months and user-level data for 14 months. New activity resets the period for the user identifier. Aggregated reports contain no personal data.
• Security logs: no longer than 90 days, unless needed to investigate a specific incident.

When data is no longer needed, we delete or anonymise it securely.

We protect personal data with appropriate technical and organisational measures, including encryption in transit, access controls, and access only for people who need it for their work. If a data breach is likely to put your rights at risk, we inform the Dutch Data Protection Authority and, where required, you.

Some Centipod products offer optional AI features that use large language models from providers such as Anthropic, OpenAI and Google.

• Only on your action: content is sent to an AI provider only when you start an AI action, never automatically or in the background.
• Your own account: most products use your own account with the AI provider. Your API key is stored on your device, for example in the macOS Keychain, and never sent to Centipod. The provider processes your content under your own agreement with it. Centipod does not receive the content and is neither the controller nor the processor of it.
• What Centipod does not do: we do not store, log or read the content you send to AI features, use it to train or evaluate models, or link your AI use to your identity or account with us.
• On-device AI: where a product processes content entirely on your device, no data leaves the device.
• Provider policies: Anthropic, OpenAI and Google. We list new providers here when a product starts using them.

Under the GDPR you have the right to access your personal data, have it corrected or deleted, restrict its use, object to processing based on our legitimate interests, and receive your data in a portable format. Where processing is based on consent, you can withdraw it at any time. This does not affect processing before the withdrawal.

To use your rights, email info@centipod.io. We may ask you to confirm your identity. We answer within one month. If a request is complex, we may extend this by up to two months and will tell you why.

You also have the right to lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, or the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.

Our sites and services are intended for professionals and are not directed at children under 16. We do not knowingly collect their personal data.

We may update this policy. The current version is always published on this page with the date it took effect. We announce significant changes on the sites and, where we have your email address and the change affects you, by email.

For questions about this policy or to use your rights, email info@centipod.io or write to Centipod B.V., Mauritsstraat 40, 2271 SE Voorburg, the Netherlands.