Privacy policy

1. Who we are

InBrandevoort connects residents with local organizations, events and initiatives. We are the data controller for your personal data. Address: De Plaetse 26, 5708ZJ, Helmond, The Netherlands.

2. Age requirements

You must be 18 years or older to use our services, or have parental/guardian consent if you are under 18. By using our services, you confirm that you meet this age requirement or have obtained the necessary consent.

3. What data we collect

We collect the following types of data:

• Account information: email address, first name, last name, password (stored as a secure hash)
• Profile information: display name, avatar image, language preference, address (street, house number, city, zip code)
• Usage data: login timestamps, last login date, device information, user agent
• Communication data: newsletter subscription preferences, contact form submissions
• Content data: posts, comments, reactions, chat messages, event registrations, organization memberships
• Security data: failed login attempts, account status, security stamps, session information
• Usage statistics: anonymous page views, sessions, and entity views (with your consent, processed on our servers)
• Advertising measurement: conversion events such as app-store clicks (with your marketing consent via Google Ads)

4. How we use your data

We use data for the following purposes:

• To provide and maintain our services: account management, authentication, and service delivery
• To facilitate community connections: matching residents with organizations, events, and local initiatives
• To communicate with you: sending newsletters (with consent), service updates, and responding to inquiries
• To moderate content: ensuring compliance with our terms of service and community guidelines using automated content moderation
• To improve our services: analyzing usage patterns and user feedback to enhance functionality
• To measure marketing effectiveness: conversion tracking via Google Ads (with your consent)
• To ensure security: detecting and preventing fraud, abuse, and unauthorized access
• To comply with legal obligations: meeting regulatory requirements and responding to legal requests
• To provide multilingual support: translating content using Google Translate for better accessibility

5. Legal bases

We rely on different legal bases depending on the purpose:

• Contract performance: processing necessary to provide our services and fulfill our terms of service
• Consent: for newsletter subscriptions, usage statistics, and Google Ads conversion measurement (you can withdraw at any time)
• Legitimate interests: for security monitoring, fraud prevention, and service improvement
• Legal obligation: to comply with applicable laws and regulations, including the Digital Services Act (DSA)

You can withdraw consent at any time.

6. Third-party data sharing

We share data with the following third-party services:

• EdenAI (via OpenAI): for automated content moderation and NSFW detection to ensure community safety and compliance
• Google Translate: for multilingual content translation (independent data controller)
• Resend: for email delivery and transactional communications
• Azure (Microsoft): for secure file storage and cloud infrastructure
• Google Ads (Google): for conversion and campaign measurement on the website (with your marketing consent)
• Expo Insights: for mobile app analytics and crash reporting (with your consent)
• Web3Forms: for contact form submissions and email processing

Some parties (such as Google) are independent data controllers with their own privacy policies. Service providers operate under their standard data processing terms. We ensure adequate safeguards in both cases.

7. Data retention

We retain data for the following periods:

• Account data: retained for the duration of your account, deleted or anonymized within 30 days of account deletion
• Content data: posts, comments, and reactions retained while your account is active, anonymized upon account deletion
• Security logs: retained for up to 2 years for security and fraud prevention purposes
• Usage statistics: retained according to our internal retention policies (typically up to 1 year)
• Google Ads data: retained according to Google's retention settings (typically up to 14 months for ads-related data)
• Mobile analytics: retained according to Expo Insights retention policies (typically up to 1 year)
• Legal compliance data: retained as required by applicable laws and regulations
• Anonymized data: may be retained indefinitely for statistical and reporting purposes

When you delete your account, we will either delete your personal data or irreversibly anonymize it within 30 days. Anonymized data may be retained for statistical, reporting, or security purposes, but can no longer be linked to you.

Public contributions (comments, reactions, chat messages) may remain visible to preserve conversation continuity. In these cases, the sender's personal data will be irreversibly anonymized so the author can no longer be identified.

8. Security measures

We implement the following security measures:

• Password protection: BCrypt hashing algorithm for secure password storage
• Authentication: JWT (JSON Web Token) management for secure session handling
• Access control: role-based access control (RBAC) to restrict data access based on user roles
• Input validation: extensive validation of all user inputs to prevent injection attacks and data corruption
• Security monitoring: continuous monitoring of security events and failed authentication attempts
• Account protection: automatic account locking after multiple failed login attempts
• Session management: secure session termination and security stamp invalidation for compromised accounts
• Data encryption: encryption in transit (HTTPS/TLS) and at rest for sensitive data
• Audit trails: comprehensive logging of security incidents with preservation of audit trails

9. Your GDPR rights

You have the following rights:

• Right of access: you can request a copy of your personal data we hold
• Right to rectification: you can request correction of inaccurate or incomplete data
• Right to erasure ('right to be forgotten'): you can request deletion of your personal data
• Right to restriction of processing: you can request that we limit how we use your data
• Right to data portability: you can request your data in a structured, machine-readable format
• Right to object: you can object to processing based on legitimate interests
• Right to withdraw consent: you can withdraw consent for data processing based on consent at any time

You can also withdraw consent for newsletter subscriptions at any time.

If we anonymize your data instead of deleting it, the anonymization is irreversible and the data is no longer personal data. We may ask you to provide additional information to confirm your identity before we process your request. You can submit requests via the email address below.

10. International data transfers

Some third-party services may process data outside the EU:

• Google Translate: may process data in the United States (independent data controller with its own privacy policy)
• Azure (Microsoft): data stored in EU data centers where possible, with standard contractual clauses for any transfers
• EdenAI (via OpenAI): processes data in compliance with GDPR requirements for content moderation
• Resend: email service with GDPR-compliant data processing
• Google Ads (Google): may process data in the United States (independent data controller with its own privacy policy)

We rely on standard contractual clauses and the service providers' standard data processing terms to ensure adequate protection.

11. Cookies and local storage

We use the following technologies:

• Essential cookies: required for basic functionality (authentication, session management)
• Local storage: consent preferences stored locally in your browser (inb_consent_v1)
• First-party usage statistics: anonymous page, session, and entity views sent to our API (with consent)
• Google Ads (Google tag): conversion and campaign measurement cookies (with marketing consent, only when you accept all)
• Expo Insights: mobile app analytics (with consent) for crash reporting and usage statistics

For placing and reading cookies and similar technologies, we follow the Telecommunications Act. Non-essential cookies and similar identifiers are only placed after your consent via the cookie banner. You can withdraw consent at any time by clearing site data in your browser.

12. Data breach notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach
• Inform affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms
• Provide clear information about the nature of the breach, likely consequences, and measures taken or proposed to address it
• Document all breaches in our security incident log with full audit trail preservation

13. Security incident response

We monitor for security events, track failed authentication attempts, and have procedures for compromised accounts (security stamp invalidation, session termination). All security incidents are logged and investigated with audit trail preservation.

14. Changes

We may update this policy. We will communicate material changes via our services or by email.

15. Contact & complaints

We have not appointed a Data Protection Officer (DPO) as this is not mandatory under the GDPR. For privacy questions, you can contact our contact person: Mark Schroders. If you are not satisfied with our response, you can contact the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).