Last updated: 30 April 2026
Clever Initiative is a Dutch B2B software platform. We host, license, and white-label a multi-tenant SaaS platform for businesses across Europe. Privacy is not a checkbox for us — it is built into the architecture of the product itself.
This page explains exactly what personal data we process, why we process it, who we share it with, and the choices you have. If anything is unclear, write to info@cleverinit.com and we will answer in plain English.
For data we collect about visitors, prospects, and customers of cleverinit.com, the data controller is:
When we host the platform on behalf of a tenant, we act as a data processor for the personal data the tenant uploads about its own users. The tenant remains the controller of that data; this policy describes only the processing for which we are the controller.
We deliberately collect as little personal data as we can while still running a useful business. The categories below cover everything we touch.
Article 6 of the GDPR requires a lawful basis for every processing activity. Ours map cleanly onto these four:
Processing necessary to deliver the service you signed up for. Authentication, tenant resolution, billing, support, and platform operation all sit here.
Running the website, protecting it from abuse, responding to inbound enquiries, and improving the product. We balance these interests against your rights and never use your data for purposes you would not reasonably expect.
Dutch tax, accounting, and corporate law oblige us to retain certain transactional records — typically seven years for invoicing data.
We only ask for consent where it is required, for example before sending marketing email. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.
We never sell personal data. We share it only with sub-processors who are contractually bound to handle it under instructions equivalent to ours. Each one is selected for a specific purpose:
| Sub-processor | Purpose | Region |
|---|---|---|
| Twilio SendGrid | Transactional email delivery (contact form confirmations, account notifications) | EU + US (SCCs) |
| Twilio (SMS) | Two-factor authentication and SMS notifications, where enabled by a tenant | EU + US (SCCs) |
| Google reCAPTCHA v3 | Bot prevention on the contact form | EU + US (SCCs) |
| Hetzner Online GmbH | Production hosting for cleverinit.com and platform services | EU (Germany) |
| Docker Hub | Distribution of signed application container images | EU + US |
| GitHub | Source control, CI/CD pipelines, and module artifact signing | EU + US (SCCs) |
If you are an enterprise tenant with a Data Processing Addendum, your DPA lists the authoritative, version-controlled register of sub-processors for your environment.
Database-per-tenant is the cornerstone of how we keep customer data isolated. Every tenant gets its own dedicated SQL Server database. There are no shared tables and no row-level filters substituting for real isolation. A bug in a single query cannot leak across tenants — there are no cross-tenant rows to leak.
Tenant database connection strings are encrypted with AES-256 using ASP.NET Core Data Protection before they are written to the host database. They are never logged at any log level, never returned in any API response, and never serialised into telemetry.
On every request, the platform identifies the tenant through a strict five-step resolution chain (JWT claim, X-Tenant-Id header, custom domain, platform subdomain, and a development-only query string). If no tenant resolves, the request is rejected before any business logic runs.
If we process your personal data, you can exercise the rights below. We answer requests within one calendar month and never charge a fee for reasonable requests.
Ask for a copy of the personal data we hold about you and confirmation that we are processing it.
Ask us to correct inaccurate or incomplete data — usually a single email is enough.
Ask us to delete your personal data when there is no overriding lawful reason to keep it.
Ask us to pause processing while we investigate a dispute about accuracy or lawful basis.
Receive the personal data you provided to us in a structured, machine-readable format and transmit it to another controller.
Object to processing based on our legitimate interests, including profiling. Marketing opt-outs are honoured immediately.
We keep personal data only as long as we have a clear reason to. After that, we delete or anonymise it.
Security is engineered into the platform at every layer. The list below is a non-exhaustive summary of the controls that apply to all customer data.
We host primary infrastructure in the European Union. Where a sub-processor (for example Twilio SendGrid or GitHub) processes personal data outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses and additional safeguards reviewed annually. We will publish updates to this list whenever we add or change a transfer mechanism.
cleverinit.com uses only the cookies that are strictly necessary to make the site work and to protect it from automated abuse. We do not run cross-site advertising trackers, behavioural profiling pixels, or third-party analytics that share your data outside of our control. The contact form loads Google reCAPTCHA v3 only when needed; reCAPTCHA sets its own cookies and processes traffic signals on Google's infrastructure.
Clever Initiative is a B2B platform. Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, write to info@cleverinit.com and we will delete it immediately.
When we change this policy in a material way, we update the "Last updated" date at the top and notify active customers by email. The version history of the file is kept in our public repository so you can compare any two versions.
If you believe we have mishandled your personal data, please contact info@cleverinit.com first — we want the chance to put it right. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country of residence.
Questions about this policy? Contact our team or write to info@cleverinit.com.