Privacy Policy
Last updated: March 31, 2026
Bijstra AI & Engineering Consultancy (hereinafter: 'we', 'us', 'our') respects your privacy and processes personal data in accordance with the GDPR. This policy describes how we collect, use and protect your data when using AI Act Scanner.
1. Data Controller
Bijstra AI & Engineering Consultancy is responsible for the processing of your personal data.
- •Bijstra AI & Engineering Consultancy
- •Hoofdweg 246, 8475CE Nijeholtpade, the Netherlands
- •Email: info@aiactscanner.com
- •CoC: 97971898 | VAT: NL005300763B37
2. Data We Collect
- •Email address — upon registration and for scan notifications
- •Name — optional, upon registration
- •Website URLs — that you enter for scanning
- •IP address — for rate limiting and security
- •Payment data — via Mollie (we do not store credit card numbers)
- •Session data — for authentication (session token in cookie)
- •Log data — error logs, audit trail and rate limiting logs (IP address, route, timestamp)
3. Purpose of Processing
- •Performing website scans and reporting
- •Processing payments
- •Sending scan results by email
- •Security and abuse prevention
- •Legal obligations
4. Legal Basis
We process your data on the basis of: (a) performance of the contract (performing the scan), (b) legitimate interest (security, abuse prevention), and (c) consent (email notifications).
5. Third Parties
We share your data with the following processors:
- •Cloudflare — hosting, CDN and DDoS protection (EU/US)
- •Mollie — payment processing (Netherlands)
- •Mailjet — email delivery (France, EU)
- •Jortt — accounting and invoicing (Netherlands)
- •Mistral AI — AI analysis of scan results (France, EU)
6. International Data Transfers
Your data is primarily processed within the EU/EEA. Cloudflare also processes data in the United States under the EU-US Data Privacy Framework. All other processors (Mollie, Mailjet, Jortt, Mistral AI) are established in the EU/EEA.
7. Retention Periods
Scan results are stored for a maximum of 12 months. Account data is retained as long as your account is active. After account deletion, data is erased within 30 days. Payment data and invoices are retained for 7 years in accordance with Dutch fiscal legislation (Art. 52 AWR).
8. Automated Decision-Making
We use AI (Mistral AI) for the analysis of scan results. This does not constitute automated decision-making within the meaning of Article 22 GDPR — the results are purely informational and have no legal effects on you.
9. Your Rights
You have the right to access, rectification, erasure, restriction, portability and objection. Contact us at info@aiactscanner.com. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
10. Security
We implement appropriate technical and organisational measures: encrypted connections (HTTPS/TLS), hashed passwords (PBKDF2), rate limiting, SSRF protection and regular security updates.
11. Changes
We may update this privacy policy. The most recent version is always available on this page.