Privacy policy

Who is responsible

SDG Development (Sem de Groot) is responsible for your account data in the app and for the data we keep about clients.

Inquiries and bookings that visitors send through a client's website are a different matter. That data belongs to the client, and the client is responsible for it. SDG Development only processes it on the client's behalf. The arrangements for this are in article 10 of the terms of service. The privacy policy on the client's website explains what else happens to that data.

What data the app processes

For your account we store your email address, your role on each site and your password. We store the password only as a hash (scrypt), so nobody can read it.

For each device you sign in on, we store its type (for example "iPhone 15 Pro"), the platform, the app version, when you were last active and a random code for that installation. We store that code hashed. With this data the app shows under Security where you are signed in, so you can sign a device out. We do not store an IP address or location with it.

If you turn on notifications, we store a push token. It lets us notify you about a new inquiry or booking.

Of your photos and videos we only see what you upload to your site yourself. The app cannot access the rest of your photo library.

If the app crashes, it sends an error report to Sentry. The report contains no name, email address or IP address.

Signing in with Face ID, Touch ID or your fingerprint happens on your device. The app only learns whether it worked.

If you are a client

For quotes, invoices and payments we keep your name, company name, address, email address and VAT number if you have one, along with the invoices and payments themselves. Payments go through Stripe. Only Stripe receives your card or bank details.

If we register a domain name for you, we pass your details as the holder to mijn.host and to the registry of the extension, such as SIDN for .nl.

What we use the data for

We use your data to make the app and our service work: to sign you in, secure your sessions, send notifications, fix errors and handle quotes, invoices, payments and domain names. We do not use it for advertising, we do not track you across other apps and we do not sell it.

The legal basis is the agreement between you or your employer and SDG Development. Security and fixing errors fall under our legitimate interest. We keep invoices and payments because the law requires business records.

Who else sees the data

These service providers process data on our behalf. Amazon Web Services runs the servers and sends email, from Frankfurt. Sentry receives the crash reports and is also based in Germany. Our own email runs through Microsoft. Push notifications go through Expo, Apple and Google. A push token may end up outside the European Union in the process. The European Commission's standard contractual clauses or similar safeguards apply to that.

Stripe receives the data it needs for payments. Mijn.host and the domain registries receive what they need for domain names. They are partly responsible themselves, for example for fraud checks or for the register of domain holders. Their own privacy policy applies to that.

How long we keep data

A session expires after 7 days without use. A device stays linked until you sign it out, with a maximum of 10 per account. Crash reports are deleted after at most 90 days. We keep your account, sessions, devices and push tokens for as long as you have access to a site. The Delete your account page explains how to have your account deleted.

We keep invoices and the data that belongs to them for 7 years because Dutch tax law requires it. We keep emails with clients until 5 years after we stop working together, because a claim under the agreement can run that long. If an email is part of the business records, the 7-year period applies.

This website

This website uses no cookies. We do keep track of how the site is visited: which pages people view, which website they came from, their language, their country and how long they stay. To add up visits within one day, we use your IP address with a key that changes every day. We do not store the IP address itself for this. We keep individual visits for 14 days and daily totals for 100 days.

The server also keeps technical logs, including your IP address and the page you requested. We use them to investigate outages and abuse. They are deleted automatically.

Your rights

You can access, correct or delete your data. You can also ask us to restrict its use, object to its use or request a copy. Email info@semdegroot.com to do so. You will get a reply within a month. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).