01 Introduction
This Privacy Policy explains how Vertical Real Estate B.V., registered with the Dutch Chamber of Commerce (KvK) under number 99566346, located at Zanddwarsstraat 12, 1011 HP Amsterdam, the Netherlands (“Company”, “we”, “us”, or “our”), trading under the brand name BrickPilot, collects, uses, shares, and protects your personal data when you access or use our website and the BrickPilot platform (collectively, the “Service”).
This Privacy Policy should be read together with our Terms of Service, Cookie Policy, and, where applicable, the Data Processing Agreement (“DPA”). In the event of a conflict, the order of precedence set out in the Terms of Service applies.
By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, you should not use the Service.
02 Privacy contact
We have not appointed a Data Protection Officer as this is not required under Article 37 GDPR given the nature and scale of our processing activities. For all privacy-related questions, requests, or complaints, you can contact our designated privacy contact:
Laurens van Duin, Privacy Contact
Email: [email protected]
03 Personal data we collect
3.1 Data you provide to us
- Account registration data: name, email address, company name, and authentication credentials (including via Google and Microsoft SSO).
- Payment and billing data: payment method details and transaction history. We do not store your payment card details; these are processed by our payment provider Mollie.
- Project data: documents, files, project descriptions, addresses, and other materials you upload or create through the Platform.
- Communications: messages, support requests, and feedback you send to us.
- Demo bookings: if you book a demo in the Calendly scheduling page of our demo dialog, your name, email address, any answers you give to the booking questions, and the date and time you choose.
- Report requests: if you request a report through a form on our website, the address, your name and email address, the page you sent it from, the campaign of your visit (target group and UTM parameters), and your IP address.
3.2 Data collected automatically (Usage Data)
- Device and browser information: IP address, browser type and version, operating system, device type, unique device identifiers.
- Usage information: pages visited, time and date of visits, time spent on pages, referral URLs, click patterns, and feature usage.
- Log data: server logs, error reports, and diagnostic data.
- Website measurement: with your consent, the data that Google Analytics 4, Mixpanel, Hotjar and the LinkedIn Insight Tag collect through cookies and similar technologies, as described in our Cookie Policy.
3.3 Data from third-party authentication
If you register or log in through Google or Microsoft, we may collect your name, email address, and profile picture as made available by those providers. The scope of data depends on your privacy settings with the relevant provider.
3.4 Public source data
The Platform retrieves data from public sources (Kadaster, BAG, DSO, PDOK) on your behalf. This data typically does not constitute personal data, but where it does (e.g. property ownership records), we process it solely to provide the Service on the basis of the performance of our contract with you.
04 How we use your personal data
We process your personal data for the following purposes and on the following legal bases:
| Purpose | Description | Legal basis |
|---|---|---|
| Providing the Service | Operate, maintain, and improve the Platform; manage your account; process AI-assisted project workflows, document analysis, and data retrieval from public sources. | Performance of contract (Art. 6(1)(b) GDPR) |
| Public source data retrieval | Retrieve and process data from public registries (Kadaster, BAG, DSO, PDOK) on your behalf, which may incidentally include personal data such as property ownership records. | Performance of contract (Art. 6(1)(b) GDPR) |
| Payment processing | Process subscription payments and one-time purchases via Mollie. | Performance of contract (Art. 6(1)(b) GDPR) |
| Demo scheduling | Let you book a demo through Calendly’s scheduling page in our demo dialog, and prepare and hold that demo with you. | Steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Report requests | Handle a report request you send through our website and contact you about it. | Steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Communication | Contact you regarding account matters, security updates, service notifications, and support requests. | Legitimate interest (Art. 6(1)(f) GDPR) |
| Marketing | Send information about products, services, and events similar to those you have used. You can opt out at any time. | Legitimate interest (Art. 6(1)(f) GDPR) with opt-out |
| Analytics and improvement | Analyse usage trends, measure campaign effectiveness, and improve the Service and AI model performance. Google Workspace Data is expressly excluded from these analytics and model-improvement purposes. Website measurement with cookies is covered in the next row. | Legitimate interest (Art. 6(1)(f) GDPR) |
| Website analytics and advertising measurement | Measure how our website is used (Google Analytics 4, Mixpanel and, on our landing pages, Hotjar) and the results of our LinkedIn advertising (LinkedIn Insight Tag), as described in our Cookie Policy. | Consent (Art. 6(1)(a) GDPR) |
| Security and fraud prevention | Monitor for and prevent unauthorised access, misuse, or security incidents. | Legitimate interest / Legal obligation (Art. 6(1)(c)/(f) GDPR) |
| Business transfers | Evaluate or conduct mergers, acquisitions, or asset sales where personal data may be among transferred assets. | Legitimate interest (Art. 6(1)(f) GDPR) |
05 Google Workspace API data
This section applies specifically to information that BrickPilot receives from Google Workspace APIs, including Gmail data and data derived from it (“Google Workspace Data”). If this section conflicts with a more general provision elsewhere in this Privacy Policy, this section controls for Google Workspace Data.
5.1 Data we access
When you connect Gmail, BrickPilot may access your Google account email address and the recipients, subject, and body of new drafts that you ask BrickPilot to create. BrickPilot requests the narrowergmail.compose permission for this purpose. The current integration does not read or search existing inbox messages, access mailbox labels or read/unread state, archive messages, or access Gmail attachments.
5.2 How we use the data
We use Google Workspace Data only to connect your account and create new Gmail drafts at your request. The BrickPilot AI assistant never sends an email automatically. You must review and send each draft yourself from Gmail.
5.3 Storage and retention
OAuth access and refresh tokens are encrypted at rest and retained only while your Gmail connection remains active. BrickPilot sends only the draft content that you provide to Gmail and does not retrieve or create a copy of your mailbox. Content that you deliberately place in a BrickPilot conversation or draft is retained as part of that user-requested output under the retention periods in section 10. When you disconnect Gmail, we revoke the Google authorisation where technically available and delete the stored connection credentials. You can also revoke access in your Google Account or ask us to delete related data by contacting [email protected].
5.4 Sharing, human access, and AI
We do not sell Google Workspace Data, use it for advertising, share it with data brokers, or use it for credit, lending, or insurance decisions. We transfer it only to service providers that are necessary to deliver the specific feature you requested, such as our secured hosting and AI-inference providers, under contractual confidentiality and data-protection obligations; when required for security or applicable law; or with your explicit consent. We do not permit human access except with your affirmative agreement for specific data, when necessary for security or abuse investigation, when required by law, or for internal operations after the data has been aggregated and anonymised.
Google Workspace Data is used only to produce the specific, user-facing result you requested. It is not used to develop, improve, or train generalised or non-personalised AI or machine learning models, foundation models, or models for other customers.
5.5 Google Limited Use
BrickPilot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
08 International data transfers
Your information, including personal data, is processed at our offices and by our Service Providers, some of which are located outside the European Economic Area (EEA), including in the United States.
Where personal data is transferred outside the EU/EEA to a country without an adequate level of data protection, transfers are protected by EU Standard Contractual Clauses (SCCs) or other approved safeguards under Chapter V GDPR, supplemented by additional measures where required.
You can request information about safeguards in place by contacting us at [email protected].
09 Service providers and sub-processors
The following third-party Service Providers may access your personal data to provide services on our behalf:
| Provider | Processing activities | Location | Transfer mechanism | Category |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, computing, storage, hosting; AI model inference via AWS Bedrock (Anthropic) | Global cross-region inference; primary storage in EU / Switzerland | AWS DPA; SCCs for international transfers | Infrastructure & AI |
| Railway (Railway Corp.) | Application and frontend hosting, backend services, edge delivery, logging, container orchestration | US | Railway DPA; SCCs | Infrastructure |
| Storyblok (Storyblok GmbH) | Content management system (CMS) for website and platform content | EU | Storyblok DPA | CMS |
| OpenRouter (OpenRouter, Inc.) | AI model routing and API gateway; forwarding prompts to Mistral and other AI providers for inference | US | OpenRouter DPA; SCCs | AI Inference |
| Slack (Salesforce, Inc.) | Internal team communication, including support request handling and project coordination where User data may be referenced | US | Slack DPA; SCCs; DPF | Communication |
| GitHub (Microsoft) | Source code hosting, version control, CI/CD pipelines | US | GitHub DPA; SCCs; DPF | Development |
| Mollie B.V. | Payment processing for subscriptions and purchases | EU (NL) | Mollie DPA | Payments |
| Google (Google LLC) | Marketing lead capture — website scan and contact form submissions (name, email, company, address) are received and stored via Google Apps Script / Google Sheets | US | Google DPA; SCCs; DPF | Marketing |
| Google (Google Ireland Ltd / Google LLC) | Google Tag Manager and Google Analytics 4 for website analytics, used only on the brickpilot.ai marketing site and loaded only after active analytics consent | EU (Google Ireland Ltd, contracting party); onward transfer to Google LLC in the US may occur | DPF for Google LLC; SCCs where applicable | Consent-based analytics |
| Calendly (Calendly, LLC) | Demo scheduling: shows the scheduling page in the demo dialog (loaded only when you open it) and processes bookings (name, email address, any answers, chosen time) and technical data such as IP address | US | DPF; SCCs | Demo scheduling |
| Mixpanel (Mixpanel, Inc.) | Website analytics: page views and steps such as clicking a demo or report button, with a random visitor ID and the campaign of the visit, on our website and in the vergunningvrij check on app.brickpilot.ai; loaded only after active analytics consent | US company; data sent to Mixpanel’s EU servers | See Mixpanel’s privacy policy | Consent-based analytics |
| Hotjar (Hotjar Ltd) | Analytics of how visitors use our landing pages, such as clicks and scrolling; loaded only on landing pages and only after active analytics consent | EU (Malta) | See Hotjar’s privacy policy | Consent-based analytics |
| LinkedIn (LinkedIn Ireland Unlimited Company) | LinkedIn Insight Tag: measuring and targeting our LinkedIn advertising (page URL, referring page, IP address, device and browser characteristics, timestamp, LinkedIn cookie identifiers); loaded only after active marketing consent | EU (Ireland) | See LinkedIn’s privacy policy | Consent-based marketing |
| HubSpot (HubSpot, Inc.) | Customer relationship management: report requests sent through our website (name, email address, address, page, campaign of the visit) are stored as contacts; sent from our servers, without HubSpot scripts or cookies on the website | US | See HubSpot’s privacy policy | CRM |
| Postmark (AC PM LLC, part of ActiveCampaign) | Sending email from our platform and website, including the internal notification to our team of a report request (name, email address, address, page, campaign of the visit, IP address) | US | See Postmark’s privacy policy | Email delivery |
| Telegram (Telegram Messenger Inc.) | Internal notifications to our team, for example of new sign-ups, demo bookings, quick-scan requests and report requests (name and email address and, depending on the notification, address, company, page or booking answers) | See Telegram’s privacy policy | See Telegram’s privacy policy | Internal communication |
| Sentry (Functional Software, Inc.) | Error reports from the website: technical details of the error, browser and device information, and the page address without query parameters; configured not to send user details, cookies, or form contents, and without cookies on your device | US | See Sentry’s privacy policy | Error monitoring |
Note regarding OpenRouter: OpenRouter routes inputs to downstream AI model providers (including Mistral). We require OpenRouter to contractually ensure equivalent data protection obligations from each downstream provider.
Note regarding AWS Bedrock: AI inference via Anthropic models is provided through AWS Bedrock. Data processed through Bedrock is subject to AWS’s data processing terms, may be routed globally within AWS’s cross-region inference infrastructure, and does not leave AWS infrastructure.
Note regarding Calendly: Calendly processes the details of a demo booking on our behalf. For the cookies it sets in the demo dialog and other data it processes for its own purposes, Calendly is responsible under its own Privacy Notice. Calendly states that it relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for transfers from the EEA.
Note regarding LinkedIn: LinkedIn also uses the data it receives through the Insight Tag under its own Privacy Policy, and can link it to your LinkedIn account if you have one.
10 Data retention
- Account data: retained for the duration of your active account and deleted two (2) years after deactivation or inactivity.
- Project data: retained for the duration of your active account. Upon termination, project data is retained for thirty (30) days to allow export, after which it is securely deleted.
- Google connection credentials: retained only while your Google connection is active and deleted when you disconnect it, revoke access, or delete your account, subject only to short-lived backups and legal or security obligations.
- Demo bookings: retained for as long as needed to prepare, hold, and follow up on the demo, and deleted no later than twelve (12) months after the demo date, unless you become a customer, in which case they become part of your account data. We delete the booking in Calendly on the same schedule. Data Calendly processes for its own purposes is retained under Calendly’s Privacy Notice.
- Website analytics and advertising data: how long Google, Mixpanel, Hotjar and LinkedIn keep the data they receive through cookies on our website is determined by the provider and, where the provider offers a choice, by the settings of our account with that provider. According to LinkedIn, it removes members’ direct identifiers within seven days and deletes the remaining pseudonymised data within 180 days. The durations of the cookies themselves are in our Cookie Policy.
- Legal compliance data: retained for one (1) year after the purpose of collection has been fulfilled, to comply with legal obligations and resolve disputes.
- Usage data: retained for internal analysis purposes for a maximum of twenty-four (24) months, unless required for security or legal purposes.
11 Your rights
Under the GDPR and applicable data protection laws, you have the following rights:
- Access: request a copy of the personal data we hold about you.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your data, subject to legal retention obligations.
- Restriction: request restriction of processing in certain circumstances.
- Data portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interests, including direct marketing.
- Withdraw consent: where processing is based on consent, withdraw at any time.
You can exercise these rights through your account settings or by contacting us at [email protected]. We will respond within one (1) month, unless complexity requires up to two additional months.
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your national supervisory authority.
12 Data Processing Agreement
If you upload personal data to the Platform in a professional capacity, we operate as a Data Processor and you as a Data Controller under the GDPR. The Data Processing Agreement, available as a separate document, sets out the details of this arrangement.
13 Children’s privacy
The Service is not directed at anyone under 18. We do not knowingly collect personal data from minors. If we become aware of such collection without parental consent, we will delete it promptly.
14 Security
We implement appropriate technical and organisational safeguards, including encryption in transit, access controls, least-privilege access, monitoring, and incident-response procedures. Google OAuth tokens are encrypted at rest and are accessible only to systems and authorised personnel that need them to operate the connected service. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
15 Changes to this privacy policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new version and, where appropriate, by email. The version date at the top indicates when it was last revised.
16 Contact us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:
Vertical Real Estate B.V. (trading as BrickPilot)
Zanddwarsstraat 12, 1011 HP Amsterdam
The Netherlands
KvK: 99566346
VAT: NL869042221B01
Privacy contact: Laurens van Duin
Email: [email protected]