Privacy statement

Gunnie processes personal data of visitors to gunnie.nl, of its clients and of the people who use Gunnie.ai. This statement describes what that data is, why we process it, how long we keep it and which parties it is shared with.

Who is responsible

Gunnie, Brouwersstraat 23, 5473 HB Heeswijk-Dinther, the Netherlands. Chamber of Commerce 74961438, VAT NL002204359B58. For questions about your data: info@gunnie.nl or +31 85 060 3876.

The contact form

What we ask for: your name, email address and message, and if you like your company name and the URL of your store. We also record the topic you pick, the language you viewed the page in, when you sent the form, your IP address and your browser type. Name, email address and message are needed to reply; the rest is optional.

Why: to answer your question. The IP address and browser type help us recognise abuse of the form. The lawful basis is the performance of a contract or, before one is in place, our legitimate interest in being able to respond to a substantive enquiry.

Where it goes: the message is sent as email through Brevo, our email provider, and arrives in Gunnie's mailbox. Your name, email address and company name are also stored as a contact at Brevo, so we can find earlier conversations. This does not sign you up for the newsletter; that takes a separate sign-up (see below).

How long: we keep the correspondence and the contact for as long as they are relevant to the relationship, and for at most two years after that.

The newsletter

What we ask for: through the sign-up form, only your email address. If you sign up with the checkbox on the contact form, we also keep your name and company name.

Why: to send you the newsletter. The lawful basis is your consent: after signing up you receive one email with a confirmation link, and only when you click it is your address added to the list. Brevo records when you did so, so we can show that you consented. You can withdraw your consent at any time through the unsubscribe link in every mailing or by emailing info@gunnie.nl.

Where it goes: your address is stored in a contact list at Brevo. We do not sell or rent addresses and do not share them with other parties.

How long: until you unsubscribe. If you do not confirm the sign-up, you are not added to the list.

Form protection

Both forms are protected by Cloudflare Turnstile, an alternative to CAPTCHA. Turnstile assesses whether a submission comes from a human and processes technical data from your browser and your IP address to do so. Turnstile sets no tracking cookie and does not use the data to profile you or follow you across other websites.

Statistics and cookies

The website uses Google Analytics 4 to measure which pages are visited and through which channels visitors arrive. Google Analytics sets two cookies for this, _ga and _ga_<id>, which hold a random number that recognises a later visit as the same one. They expire after two years. According to Google, Google Analytics 4 does not store IP addresses. We use the data only in aggregate, do not link it to individuals and do not use it for advertising.

The website also counts page views and visits with Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser and does not recognise you on a later visit.

The website sets no other cookies. If you do not want to be measured, you can block cookies for gunnie.nl in your browser; the website keeps working.

Hosting and logging

The website runs on Cloudflare Workers. Cloudflare processes technical request data, including IP addresses, in order to serve the site and protect it against abuse. Error messages and technical logs of the website are kept for at most seven days.

DevLog articles are fetched from Storyblok, our content provider. Your browser loads the images in those articles directly from Storyblok, which sees your IP address when it does.

Clients

For clients we process the data needed to carry out and invoice the work: names, email addresses and phone numbers of contacts, company details and the correspondence about the work. We keep invoices and the records around them for seven years, because Dutch law requires it.

When we build, maintain or host a web store, we also process data of that store's customers. In that role we are a processor on behalf of our client, and the agreements with that client apply, not this statement.

Gunnie.ai

Gunnie.ai (gunnie.ai and app.gunnie.ai) connects a company's AI assistant and Gunnie's routines to that company's own systems, such as its issue tracker, code host and web store.

What we store about the people who use it: their email address and role in their organisation, when they log in, and a call log of who used which tool, when, with what outcome and through which assistant. For code reviews and routines we store who started them, when, the model used and the cost, the result of each routine run, and the changes waiting for approval with their outcome. The questions people ask, the arguments and answers of tool calls, and the products, tickets, designs and code in the connected systems are not stored.

Why: to give people access to their organisation's systems through Gunnie.ai, to show their admins what happened, and to invoice the use. The lawful basis is the performance of the contract with the organisation the user belongs to.

How long: the call log, routine results and decided approvals are deleted after 30 days, or the period the organisation's admin chose (7 to 365 days). Counts of what each run did are kept to show the organisation's history; they hold no ticket text, code or arguments. Accounts stay as long as the person is a member of their organisation. Usage and costs are kept with the invoices, for seven years.

Slack: when an organisation installs the Gunnie.ai app in its Slack workspace, we store the workspace's id and name, the app's access token (encrypted), the channel the organisation chose for reports, and for each report we post, its channel and thread reference and what it is about (such as a ticket key). When someone replies in such a thread or reacts to such a post, we look up their email address in Slack to check that they are a member of the organisation; we store who acted in the call log, not the message. An admin can keep a list of people to tag, with their name, email address and Slack user id. Message text is never stored. Removing the app from the workspace deletes the token and the channel; the rest is deleted when the organisation is removed, and an admin can delete the list of people to tag at any time.

Data from the connected systems: when Gunnie.ai reads a ticket, a piece of code or a store's server logs for a customer, any personal data in it belongs to that customer. Code reviews and routines send what they need to Claude, Anthropic's AI model, and the scraper watch keeps the IP addresses, networks and customer numbers of suspected scrapers in a list for the customer's admins. In all of this we are a processor on behalf of the customer, and the agreements with that customer apply, not this statement. Nothing that passes through Gunnie.ai is used to train AI models.

Processors

The parties above process data on our instructions:

• Brevo: email and newsletter, with storage within the European Union.
• Cloudflare: hosting, security, Turnstile and Web Analytics, with processing also in the United States.
• Google: Google Analytics, with processing also in the United States.
• Storyblok: the DevLog content, with storage within the European Union.
• Hetzner: the server Gunnie.ai runs on, in the European Union.
• Stytch: logging in to Gunnie.ai, with processing also in the United States.
• Anthropic, directly or through Gunnie's own Microsoft Azure, AWS or Google Cloud account: Gunnie.ai's code reviews and routines, through regions in the European Union.

A data processing agreement is in place with each of them. Where data is processed outside the European Economic Area, that happens on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We take no decisions about you that are based solely on automated processing.

Your rights

You have the right to access your data, to have it corrected or deleted, to have its processing restricted, to object to the processing and to have your data ported. Where you gave consent, you can withdraw it at any time; what we processed before that remains lawful. Send a request to info@gunnie.nl; we respond within a month.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.