1. Identity of the controller

Copifai is a product of Klarifai.

Company name: Klarifai

Chamber of Commerce number: [KVK_NUMBER]

Address: [ADDRESS]

Email: privacy@copifai.com

2. Purposes and legal bases

We process personal data for the following purposes:

Purpose	Category of data	Legal basis
Account management	Name, email, company	Performance of a contract (Art. 6(1)(b))
AI content generation	Brand information, content profiles	Performance of a contract (Art. 6(1)(b))
Social media publishing	OAuth tokens, published content	Performance of a contract (Art. 6(1)(b))
Analytics and reporting	Anonymised usage data	Consent (Art. 6(1)(a))
Billing	Name, email, payment details (tokenised)	Performance of a contract (Art. 6(1)(b))
Marketing email	Email address	Consent (Art. 6(1)(a))

3. Categories of personal data

We process the following categories of personal data:

Account data (name, email address, company name)
Client brand information (tone, audience, content profiles)
OAuth tokens for social media platforms
Content data (generated articles, social posts)
Payment details (tokenised via Stripe — no full card numbers)
Usage statistics (anonymised)

4. Retention periods

Category	Retention period
Account data	For as long as your account exists. After the account is deleted there is a 30-day grace period; after that we erase all data.
Inactive accounts	Erased after 2 years without a sign-in. You receive an email warning 30 days in advance.
Content, sources and news items	For as long as your account exists; after that, as account data.
Conversations with the Vraagbaak (help assistant)	30 days
Sessions, invitations, and verification and reset links	Deleted daily once they have expired
Payment details	7 years (statutory tax retention)
Analytics	26 months
Application logs	30 days
Backups	About 90 days (7 daily, 4 weekly and 3 monthly). Erased data then also disappears from the backups.

5. Recipients and sub-processors

We use third parties (sub-processors) that process personal data on our behalf. The list of these parties, including for each party whether a data processing agreement is in place, is available at:

Our sub-processor list (/processors)

6. Transfers outside the European Economic Area

Some of our sub-processors are established outside the EEA, in particular in the United States. The transfer mechanism for each party, such as Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, is still being determined. Until that is done, our sub-processor list states the mechanism as "Unknown".

7. Rights of data subjects

Under the GDPR you have the following rights:

Right of access (Art. 15) — You have the right to know which personal data we process about you.
Right to rectification (Art. 16) — You have the right to have inaccurate or incomplete data corrected.
Right to erasure (Art. 17) — You have the right to have your data erased, unless we are legally required to retain it.
Right to restriction of processing (Art. 18) — You can request that the processing of your data be temporarily restricted.
Right to data portability (Art. 20) — You have the right to receive your data in a structured, commonly used format.
Right to object (Art. 21) — You can object to processing based on legitimate interest.

To exercise a right, send an email to privacy@copifai.com. We respond to your request within 30 days.

8. Right to withdraw consent

Where processing is based on your consent, you can withdraw that consent at any time via your account settings or by contacting privacy@copifai.com. Withdrawing consent does not have retroactive effect.

9. Lodging a complaint with the Dutch Data Protection Authority

If you believe we are not processing your personal data correctly, you have the right to lodge a complaint with the supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens:

Autoriteit Persoonsgegevens

Website: autoriteitpersoonsgegevens.nl

10. Contact

For questions about this privacy policy or to exercise your rights: