01 Introduction
Clever Initiative is a Dutch B2B software company. We host and license a multi-tenant SaaS platform that other businesses run their own products on.
This page explains what personal data we process, why we process it, who we share it with, and the choices you have. If anything is unclear, write to hello@cleverinit.com and we will answer in plain English.
02 Who is responsible for your data
For data we collect about visitors, prospects and customers of cleverinit.com, the data controller is:
| Detail | Value |
|---|---|
| Entity | Clever Initiative B.V. i.o. — a Dutch BV in registration |
| Address | Titaan Saturnusstraat 95, 2516 AG The Hague, The Netherlands |
| KvK number | Soon — registration in progress |
| BTW / VAT number | Soon — registration in progress |
| Contact | hello@cleverinit.com |
| Phone | +31 6 2787 3000 |
Controller or processor
When we host the platform on behalf of a customer, we act as a data processor for the personal data that customer uploads about its own users. The customer remains the controller of that data. This policy describes only the processing for which we are the controller.
03 What personal data we process
We collect as little personal data as we can while still running a useful business. The categories below cover everything we touch.
- Website visitors
- Your IP address and request headers, used while the page is served and to rate-limit the contact form. The rate-limit record is held in memory only and is lost when the server restarts. If you allow the spam check on our contact form, Google also receives your IP address. If you allow visit counting, Google Analytics records the pages you view, the site you arrived from and a coarse location; Google states it does not log or store IP addresses of visitors in the EU, Switzerland or the UK.
- People who contact us
- Your name, work email and optional company, the subject you chose and your message. Alongside them we record the time of submission, your IP address and your browser's user-agent string. All of it is emailed to us, and a confirmation copy of your message is sent back to you.
- Customers and prospects in active conversation
- Business contact details, company information and the engagement model you are evaluating; contracts, non-disclosure agreements, proposals and supporting documents you exchange with us; and invoicing and payment information limited to what accounting and Dutch tax law require.
- End users on customer platforms — we are the processor here, not the controller
- Sign-in identifiers such as an email address or phone number, hashed credentials and session tokens; records of significant changes to the platform's own tables; and the business data our customer defines. We have no contractual right to use that data for our own purposes. Passwords, one-time-code hashes, two-factor secrets and security stamps are never written to the change record.
04 Why we are allowed to process it
Article 6 of the GDPR requires a lawful basis for every processing activity. Ours map onto four of them.
- Contract — Article 6(1)(b)
- Processing necessary to deliver the service you signed up for. Authentication, working out which customer a request belongs to, billing, support and running the platform all sit here.
- Legitimate interests — Article 6(1)(f)
- Running the website, protecting it from abuse, responding to enquiries and improving the product. We balance these interests against your rights and do not use your data for purposes you would not reasonably expect.
- Legal obligation — Article 6(1)(c)
- Dutch tax, accounting and corporate law oblige us to keep certain transactional records, typically for seven years.
- Consent — Article 6(1)(a)
- We ask for consent only where it is required — before counting your visit with analytics cookies, before running the spam check on the contact form, and before sending marketing email. You can withdraw it at any time without affecting the lawfulness of processing that already happened.
06 How we keep customers' data separated
An account created through signup gets its own database, and each installed module keeps its tables in their own schema inside it. In the platform's own identity tables, tenant scope is applied by the data layer as well, rather than left to each query.
The credentials that connect to a customer's database are encrypted through ASP.NET Core Data Protection before they are stored. They are decrypted only in memory when a request needs them, and they are never written to a log, returned by any endpoint, or included in telemetry.
On every request the platform works out which customer it belongs to through a five-step chain that stops at the first match: the signed token's claim, an X-Tenant-Id header, a custom domain, a platform subdomain, and finally a query-string hint. The query-string hint resolves a customer by name in development only. Outside development it is honoured solely on inbound webhook endpoints, where the sender's own signature is what authenticates the request.
07 Your rights under the GDPR
If we process your personal data you can exercise the rights below. We answer within one calendar month and do not charge a fee for reasonable requests.
- Right of access
- Ask for a copy of the personal data we hold about you, and confirmation that we are processing it.
- Right to rectification
- Ask us to correct data that is wrong or incomplete. Usually a single email is enough.
- Right to erasure
- Ask us to delete your personal data where there is no overriding lawful reason for us to keep it.
- Right to restrict processing
- Ask us to pause processing while we look into a dispute about accuracy or lawful basis.
- Right to data portability
- Receive the personal data you gave us in a structured, machine-readable format, and have it sent to another controller.
- Right to object
- Object to processing we base on our legitimate interests, including profiling. We act on marketing opt-outs immediately.
- Right to withdraw consent
- Where we rely on your consent, withdraw it at any time. That does not affect the lawfulness of processing that already happened.
To exercise any of these rights, write to hello@cleverinit.com from the email address the data belongs to. We may need to confirm who you are before we act.
08 How long we keep your data
We keep personal data only as long as we have a clear reason to, then delete it.
| Data | How long we keep it |
|---|---|
| Contact-form messages | 12 months from the date we last spoke, then deleted |
| Customer account data | For the length of the contract plus 90 days, after which the account is closed. Removing the underlying records is a manual step today — we have not automated it |
| Records of changes to the platform's own tables | Kept for as long as the account exists. We have not yet set a shorter period |
| Invoicing and accounting records | 7 years, as Dutch fiscal law requires |
| Marketing consents | Until you withdraw them, plus a record of the withdrawal itself |
Inside installed modules
Modules keep their own data on their own schedules, which a customer can configure within limits we set. Chat messages default to 365 days and payment-provider records to 90 days for call logs. When those periods pass the records are deleted outright rather than hidden, so they cannot be recovered.
09 How we secure your data
The controls below are the ones that protect personal data directly. The security page carries the full inventory, including the things we do not have yet, and states the date it was last checked against our source code.
- An account created through signup gets its own database, and each installed module keeps its tables in their own schema inside it.
- The databases run with SQL Server Transparent Data Encryption, so the data files and backups are encrypted on disk.
- Connection strings and payment-provider credentials are encrypted through ASP.NET Core Data Protection before they are stored.
- Passwords are hashed with BCrypt at work factor 12, fixed in code. Accounts lock after 5 failed attempts by default — this is configurable per customer, and it can be switched off.
- Access tokens expire in 15 minutes. Refresh tokens are 256-bit random values, stored only as a hash, single-use, and rotated on every refresh.
- Optional 6-digit one-time codes by email or SMS, hashed at rest, expiring in 5 minutes with a 3-attempt cap.
- Permission-gated endpoints declare the permission they require, checked at the HTTP boundary against the signed token's claims. Endpoints that serve only the signed-in user's own data are gated by authentication alone.
- Seven enforced rate-limit policies, and eight security headers including HSTS.
- Changes to the platform's own tables are recorded append-only: who, what, which table and row, when, and the values after the change. A deletion records the row's key, not its former contents. Data held by installed modules is not covered by that record.
- Module packages carry an RSA signature over a SHA-256 hash, checked against a public key the operator installs.
10 International data transfers
Our own servers are in the Netherlands. Some of the providers listed above process personal data outside the European Economic Area.
Owner to confirm before publication
The transfer mechanism relied on for each provider outside the European Economic Area is [[BLOCKER — OWNER TO SUPPLY]].
12 Children
Clever Initiative is a B2B platform. Our services are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe we have, write to hello@cleverinit.com and we will delete it.
13 Changes to this policy
When we change this policy in a material way we update the date at the top of this page and tell active customers by email.
14 How to complain
If you think we have mishandled your personal data, please write to hello@cleverinit.com first — we would like the chance to put it right. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live.