Privacy notice
Draft: 23 October 2026.
Template – to be reviewed by a lawyer before launch. This text is a draft for Stafeta's launch; the double-bracketed parts wait to be filled in, the rest waits for legal review. Not legal advice.
1. The controller
The sole proprietorship (Dutch eenmanszaak) of Vince Baráth, trading as Stafeta (the platform) and Artavizo (consulting). Chamber of Commerce (KvK) number: KvK number. VAT ID (btw-id): VAT ID. Registered address: registered address, the Netherlands. Contact: hello@stafeta.ai.
We are not required to appoint a data protection officer under GDPR Article 37; privacy questions go to the address above.
2. Two roles: controller and processor
On the website (waiting list, Runner sign-up, contact) and for account data (who signed up, which company, billing) we are the controller. This notice covers that.
For the content inside the platform – cards, e-mails, transcripts, contacts, HR and money records, registers – the customer company is the controller and we process on its instructions. That is governed by the data processing agreement; informing employees is the employer's job, and our consulting kit provides templates for it.
3. What data, for what purpose, on what legal basis
| What | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Waiting list and Runner forms: name, company, e-mail, company size, country | Contacting you about the launch; the referral programme | (a) consent |
| Account: name, e-mail, password hash, the authenticator secret (encrypted), hashes of the recovery codes | Two-step sign-in; the safety of the account | (b) contract; (c) legal obligation (security) |
| Sign-in log: time, first part of the IP address, browser, event (failed sign-in, lockout, new device) | Spotting abuse, notifying the owner | (f) legitimate interest: protecting accounts |
| Billing: company name, address, EU VAT ID, invoices, payment state (card details are handled by Stripe, we never see them) | Subscription, invoices, tax returns | (b) contract; (c) legal obligation (accounting, VAT) |
| Usage statistics: daily counts per workspace and feature – no person, no path, no IP | Improving the product | (f) legitimate interest; the owner can switch it off |
| Support correspondence | Answering your question | (b) contract; (f) legitimate interest |
We send no newsletters. We do no profiling and take no automated decisions about you. The AI model processes the platform's internal content only at the customer company's request, as its processor (see section 7).
4. Our processors
We use providers that process data on our behalf: database and file storage in the EU (Supabase, Frankfurt), web hosting (Vercel), artificial intelligence (Anthropic, Claude API), payments and invoicing (Stripe), bot protection (Cloudflare Turnstile), transactional e-mail (name of the SMTP provider). The full, current list with locations and transfer grounds: sub-processors.
Tools the customer company connects itself (Mailchimp, Google Drive/Docs/Gmail, Microsoft 365, WordPress) are not our sub-processors: the customer uses them with its own account and on its own instruction; we only perform the requested action, after approval.
5. Transfers outside the EU
The database, files and backups are in the EU. Anthropic (USA) processes under the EU–US Data Privacy Framework (DPF) and standard contractual clauses (SCCs); data sent through the API is not used to train models, and retention follows the commercial terms: Anthropic's retention and EU-processing terms to be checked on the day of signing. Stripe and Cloudflare process through their EU entities, their US parents under DPF/SCCs.
6. How long we keep it
- Waiting list and Runner sign-up: until you withdraw consent, at most 12 months after the public launch.
- Account and workspace: for the term of the contract. After cancellation everything stays readable and exportable for 60 days, then we delete it (we e-mail 14 and 3 days before).
- Deleting your own account: signed out at once, a 7-day grace with an undo link, permanent deletion after; the name is anonymised after 30 days ("Former member"), the work stays with the company.
- Sign-in log: 12 months. Invoices and tax records: 7 years under Dutch law.
- Usage statistics: 13 months, aggregate only. Backups: backup retention period.
7. Artificial intelligence – transparency (AI Act)
Stafeta uses a general-purpose AI model (Claude by Anthropic). The agents only draft and propose: they never send, delete or pay; everything that leaves the company is approved by a person. What the AI wrote is shown as a "draft" or "proposal" with its rationale.
The system does no emotion recognition, no biometric identification, no individual performance scoring and no monitoring of employees; workload is shown at team level only. The customer company can inform its staff with AI-literacy material under Article 4 of the AI Act – we provide a template. Stafeta's own classification (not a high-risk system) is being checked with a lawyer against Annex III of the AI Act.
8. Security
Two-step sign-in for everyone, encrypted connections, per-workspace isolation in the database, logging, EU hosting. Details on the Security page. In the event of a personal data breach we notify the authority within 72 hours as the law requires, and the people affected where needed.
9. Your rights
Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, withdrawal of consent. Write to hello@stafeta.ai; we answer within 30 days. A request about content inside the platform is forwarded to the customer company (your employer), because it is the controller there.
You can complain to the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or, as a data subject in Hungary, to the Nemzeti Adatvédelmi és Információszabadság Hatóság (naih.hu).
10. Connected accounts: Gmail, Microsoft 365, Facebook, Instagram, LinkedIn
A customer company can connect its own accounts to Stafeta: Gmail or Microsoft 365 for sending replies, a Facebook Page, an Instagram professional account or a LinkedIn company page for publishing posts. The connection is made by the person who owns the account, on the provider's own consent screen, and can be removed at any time in Stafeta (Settings → Connections, or Settings → E-mail for mailboxes) or in the provider's account settings.
Google user data (Gmail). Stafeta requests only the permission to send e-mail (gmail.send) and your e-mail address; it never asks for, and never has, permission to read, list, search, label or delete mail. What Stafeta does with the data: when a person has approved a reply on a task card, Stafeta sends exactly that message, once, from the person's own Gmail address, in the customer's thread; it keeps the sent message's id and its recipients on the card for the audit log; it stores the refresh token encrypted and deletes it when the account is disconnected. The thread context comes from the copy forwarded to Stafeta's address, not from the mailbox. Stafeta's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft 365 (Outlook). The same with the delegated Mail.Send permission and your basic profile: Stafeta sends only the approved reply from your own mailbox and never reads it.
Facebook, Instagram and LinkedIn. Stafeta stores the page or account access token (encrypted), the page or account id and name, and for every post the approved text, image, time and the id the platform returns, so that a post is never published twice. Nothing is published without a person's approval of the exact text, image and time. Stafeta reads only what this needs: the page's name, the connected Instagram account's username and publishing limit, and – after a network error – whether the approved post is already live. It reads no followers, private messages, comments or insights.
11. Deleting your data
You can delete your data in three ways, without giving a reason:
- Disconnect an account (Gmail, Microsoft 365, Facebook, Instagram, LinkedIn): Settings → Connections → Disconnect in Stafeta, or remove Stafeta under the provider's security settings (Google account → Security → Third-party access; Facebook → Settings → Business integrations). The stored token is deleted at once. What stays is the audit log of replies and posts already approved (text, time, the platform's id); the workspace owner deletes it with the card.
- Delete your own account: Settings → Account → Delete my account. You are signed out everywhere at once; for 7 days you can undo it with the link in the e-mail; then the deletion is permanent and your name is anonymised ("Former member") after 30 days, while the company's work records stay with the company.
- Ask us: e-mail hello@stafeta.ai with the subject "Delete my data", from the address concerned or naming the Google, Facebook or Instagram account you connected. We confirm receipt within 5 working days, complete the deletion within 30 days and tell you when it is done. Content a customer company controls (its workspace) is deleted by that company, or by us on its instruction.
Deleted data leaves the encrypted backups when they expire (retention: section 6).
12. Cookies and changes
Cookies and browser storage have their own page: cookies. When this notice changes, the new version is published here with its date; account holders are e-mailed about material changes.