Privacy Policy

The data controller responsible for the processing of your personal data is:

AI-Pro Talent B.V.
Amsterdam, The Netherlands
Email: privacy@ai-protalent.nl

Our Data Protection Officer can be reached at dpo@ai-protalent.nl.

• Identity & contact: name, email, phone, country of residence
• Professional data (Experts): CV, portfolio, skills, hourly rate, references
• Company data (Clients): company name, VAT number, billing address, contact person
• Financial data: IBAN, payout details, invoices (via Stripe)
• Verification data (Experts): ID document, proof of address for KYC/AML
• Usage data: device, IP address, browser, pages visited, timestamps
• Content: messages, project briefs, deliverables, agreement acceptance records

• Art. 6(1)(b) — Contract: to operate the marketplace, match talent, facilitate payments, and provide the services you request
• Art. 6(1)(c) — Legal obligation: KYC/AML, tax and accounting obligations
• Art. 6(1)(f) — Legitimate interest: platform security, fraud prevention, product improvement, non-circumvention enforcement
• Art. 6(1)(a) — Consent: marketing communications and non-essential cookies (see Cookie Policy)

• Account and profile data: for the duration of your account, plus 12 months after closure
• Invoicing and tax records: 7 years (Dutch statutory obligation)
• KYC/AML records: 5 years after the end of the business relationship
• Support tickets and messages: 24 months
• Server and analytics logs: 12 months
• Marketing consent records: until withdrawal of consent

All personal data is stored on servers located in the European Union. Our primary database and file storage run on Supabase infrastructure hosted in the Frankfurt (eu-central-1) region. Payment processing is performed by Stripe within the EU/EEA.

Where a limited number of sub-processors process data outside the EU, we rely on the European Commission's Standard Contractual Clauses and additional safeguards where necessary.

• Supabase (database, auth, storage) — EU
• Stripe (payments, KYC/AML) — EU/US with SCCs
• Resend (transactional email) — EU
• PostHog (product analytics, opt-in) — EU

You have the following rights under the GDPR:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / to be forgotten (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time
• Right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

To exercise your rights, contact privacy@ai-protalent.nl. We respond within one month.

We apply industry-standard technical and organizational measures: TLS in transit, encryption at rest, role-based access, least-privilege, audit logging, and Row Level Security in our database.

We may update this Privacy Policy. Material changes will be communicated by email and via the Platform.