Privacy Policy

Last updated: February 3, 2026

This Privacy Policy describes how Data Access Europe ("we", "us", or "our") collects, uses, and protects information when you use the DataFlex Documentation website and AI Assistant ("Service").

1. Data Controller

Data Access Europe is the data controller responsible for personal data collected through this Service.

Contact:

Data Access Europe
Lansinkesweg 4
7553 AE Hengelo (OV)
Netherlands
Email: info@dataaccess.eu

2. Information We Collect

2.1 Information You Provide

When you use the AI Assistant chat feature, we may collect:

Data Type	Description	Collected By Default
Chat queries	Questions you ask the AI Assistant	Only with consent
AI responses	Answers generated by the AI	Only with consent
Feedback	Thumbs up/down ratings and optional comments	Only with consent
Session ID	Random UUID to maintain conversation context	Yes (not personally identifying)

2.2 Automatically Collected Information

We automatically collect:

Technical data: Browser type, device type, operating system (for compatibility)
Usage data: Pages visited, search queries, timestamps (anonymized)

2.3 Information We Do NOT Collect

Names, email addresses, or other contact information (unless you choose to contact us)
Cookies for tracking or advertising
Cross-site tracking data
Precise location data

3. How We Protect Your Privacy

3.1 PII Anonymization

Before storing any chat queries (with your consent), we automatically detect and remove personally identifiable information (PII) using Microsoft Presidio, an open-source data protection toolkit.

Information automatically redacted includes:

Email addresses → <EMAIL_ADDRESS>
Phone numbers → <PHONE_NUMBER>
Person names → <PERSON>
Credit card numbers → <CREDIT_CARD>
IP addresses → <IP_ADDRESS>
Social Security Numbers → <US_SSN>
Passport numbers → <PASSPORT>
Driver's license numbers → <DRIVER_LICENSE>

Example: If you type "Hi, I'm John Smith, my email is john@example.com", we store: "Hi, I'm <PERSON>, my email is <EMAIL_ADDRESS>."

Analytics logging is opt-in only. When you first use the AI Assistant:

A consent banner appears asking your preference
Accept: Queries and responses are logged (with PII removed) to help us improve the documentation
Decline: Chat works fully—nothing is logged
Your choice is stored locally in your browser and respected for future visits

You can change your preference at any time by clearing your browser's local storage for this site.

4. How We Use Your Information

We use collected information for the following purposes:

Purpose	Legal Basis (GDPR)
Provide and maintain the AI Assistant	Legitimate interest
Identify popular topics and documentation gaps	Consent
Improve response quality based on feedback	Consent
Detect and prevent abuse of the Service	Legitimate interest
Comply with legal obligations	Legal obligation

We do not use your data for:

Marketing or advertising
Selling to third parties
Building user profiles
Automated decision-making with legal effects

5. Third-Party Services

5.1 AI Processing Provider

The AI Assistant uses a third-party AI processing provider to generate responses. When you send a message:

Your query is sent to the AI provider's servers for processing
The AI provider generates a response based on the DataFlex documentation context
The response is returned to you

The AI provider may process data in the United States or other jurisdictions. By using the AI Assistant, you acknowledge that your queries will be processed by the AI provider in accordance with their privacy policy and terms.

5.2 Typesense Search

Documentation search is powered by a self-hosted Typesense instance. Search queries are processed on our servers and not shared with third parties.

5.3 Hosting Provider

This Service is hosted on cloud infrastructure. Server logs may be retained by the hosting provider for security and operational purposes in accordance with their privacy policy. These logs may include IP addresses. Retention periods depend on the provider and will be updated when infrastructure details are finalized.

6. Data Retention

Data Type	Retention Period
Chat analytics (queries, responses)	90 days, then automatically deleted
Feedback ratings	90 days, then automatically deleted
Search queries	90 days, then automatically deleted
Session data (in-memory)	Cleared on server restart or session timeout
AI provider processing	Per provider policy

7. Your Rights

If you are located in the European Union or European Economic Area, you have the right to:

Access: Request a copy of data we hold about you
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Restriction: Request we limit processing of your data
Portability: Receive your data in a portable format
Object: Object to processing based on legitimate interests
Withdraw consent: Withdraw consent at any time without affecting prior processing

7.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the right to:

Know: Request disclosure of personal information collected, used, and disclosed
Delete: Request deletion of your personal information
Opt-out: Opt out of the sale of personal information (we do not sell personal information)
Non-discrimination: Not receive discriminatory treatment for exercising your rights

7.3 How to Exercise Your Rights

To request access, deletion, or correction of your data, contact us at:

Email: info@dataaccess.eu

Response time: We will respond to valid requests within 30 days (GDPR) or 45 days (CCPA).

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

Encryption: All data transmitted over HTTPS/TLS
Access control: Limited access to stored data
Input validation: Protection against injection attacks
Rate limiting: Protection against abuse
PII stripping: Automatic removal of personal information before storage

9. International Data Transfers

If you are accessing the Service from outside the Netherlands:

Data may be transferred to and processed in other countries
We rely on Standard Contractual Clauses (SCCs) where required for GDPR compliance

10. Children's Privacy

This Service is not directed at children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be indicated by updating the "Last updated" date at the top of this page.

For significant changes, we will provide notice through:

A prominent notice on the Service
Updated "Last updated" date

Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights: