Privacy Policy

Last updated: 5 October 2026

1. Who is responsible for your data

TwinScale AI, a sole proprietorship (eenmanszaak) owned by Dominik Imre Gábor
Spoorstraat 8, 8933 CA Leeuwarden, the Netherlands
KVK 42158191
Email: dominik@dominikgabor.com

TwinScale AI is the controller for the personal data described on this page. "I" and "me" below means TwinScale AI. I have not appointed a data protection officer; at this size one is not required. Questions go to the email address above.

2. What I collect, why, and on what basis

2.1 The contact form

• What: name, email, company, role, team size, the service you ask about, budget range, preferred contact method and your message.
• Why: to answer you and prepare a call if you want one.
• Basis: steps you ask for before a possible contract (GDPR Art. 6(1)(b)).

2.2 The download form

• What: name, email, company, role, and whether you tick the newsletter box.
• Why: to send you the resource you asked for.
• Basis: your request (Art. 6(1)(b)). Newsletter emails only if you tick the box (consent, Art. 6(1)(a)). I do not send a newsletter yet; if I start, only people who ticked the box receive it, and every issue has an unsubscribe link.

Both forms are received by my own server and arrive as an email in my mailbox. You get an automatic confirmation by email.

2.3 Booking a call

• What: name, email and your answers to the booking questions, through Calendly. A calendar invite follows from my Google Workspace calendar.
• Basis: your request (Art. 6(1)(b)).
• Recording: I sometimes record calls with Fathom to take notes. I tell you at the start of the call, and I do not record if you say no (legitimate interest, Art. 6(1)(f)).

2.4 Email

If you email me, I keep the email and my reply in my Google Workspace mailbox to handle your question (Art. 6(1)(b) or 6(1)(f)).

2.5 If I contacted you first

I contact business owners and managers in the Netherlands about my services by email or LinkedIn. For that I use business details that are publicly available: your name, role, company, business email address, LinkedIn profile, and what your company's own website says about its work. I sometimes use an AI model to read a company's public website and summarise it.

• Basis: legitimate interest (Art. 6(1)(f)): offering a relevant service to a business, in your professional capacity.
• Your choice: reply "no thanks" or email me and I stop at once. I then keep only your email address and the date on a do-not-contact list, so I never contact you again.

2.6 Clients

If you become a client, I keep contact, billing and project details to deliver the work and to send invoices (Art. 6(1)(b)), and I keep invoices and the records behind them for 7 years because Dutch tax law requires it (Art. 6(1)(c)).

2.7 Visiting this website

• Hosting: the site is served by Vercel. Like any web server, it processes your IP address and request details to deliver pages and protect the site (legitimate interest, Art. 6(1)(f)).
• Fonts: fonts are served from this website itself. No request goes to Google Fonts.
• Analytics, only with your consent: Google Analytics 4 and Microsoft Clarity show which pages help and where people get stuck. Neither loads until you click "Accept analytics" (consent, Art. 6(1)(a)). See section 6.

3. Who receives your data

Each service below receives only what it needs for the job named next to it.

3.1 Services that work on my instructions

These process data for me, as my processors. They may not use it for their own purposes.

• Hetzner (Germany): my server, which receives the website forms (through n8n, an automation tool I run myself), and its encrypted backups.
• Google Workspace (Google): email, calendar and documents.
• Vercel (US): website hosting.
• Calendly (US): call booking.
• Fathom (US): call recording and notes, only when you agree at the start of a call.
• Notion (US): my list of business contacts and enquiries.
• Moneybird (the Netherlands): invoicing and bookkeeping, for clients.
• GitHub (US): my working files, which can include business contact details.
• Firecrawl (US): fetches public company web pages for me.
• OpenRouter (US): passes public company website text to an AI model that summarises it. These requests go only to Amazon Bedrock or Google Vertex model hosts that keep no copy.
• Google Analytics (Google): visit statistics, only after you accept analytics.

3.2 Services that handle data under their own terms

These decide for themselves how they handle data, as independent controllers, under their own privacy policies.

• Anthropic (Anthropic Ireland Ltd): Claude, the AI assistant I use every day on a personal Pro subscription to prepare calls, draft replies and keep my notes. It can see the business contact details and enquiries I work on. Anthropic handles this under its consumer terms, not on my instructions. I have switched off the use of my chats for training its models. Anthropic's privacy policy.
• Microsoft Clarity (Microsoft): how visitors use pages, only after you accept analytics. Microsoft's privacy statement.
• LinkedIn (LinkedIn Ireland): invitations and messages I send you there stay on LinkedIn's platform, under LinkedIn's privacy policy.

Beyond these, I share data only when the law requires it (for example with the Dutch tax authority) or with an accountant who works for me. I never sell personal data.

4. Transfers outside the EU

Hetzner and Moneybird keep the data in the EU. For the services based in the United States, the transfer relies on:

• The EU-US Data Privacy Framework, which the European Commission recognises as adequate: Google, Microsoft, Vercel, Calendly, Fathom and GitHub are certified under it.
• Standard Contractual Clauses approved by the European Commission: Notion and OpenRouter, in their data processing terms, and Anthropic, which transfers data from Ireland to the United States.
• Firecrawl: its data processing agreement with Standard Contractual Clauses is being arranged. It receives only the addresses of public company web pages and returns their text.

5. How long I keep it

• Enquiries and business contacts: while we are in touch. I review my contact list once a year and delete anyone I have had no contact with for 24 months, unless you are a client.
• Do-not-contact list: your email address and the date only, for as long as I do outreach, so your opt-out keeps working.
• Clients: invoices and the records behind them for 7 years (Dutch tax law); other project contact details for 24 months after the work ends.
• Newsletter opt-in: until you withdraw it or unsubscribe.
• Website forms on my server: the automation tool does not keep a copy of form submissions that go through successfully. The copy you get is the email in my mailbox, covered by the first point.
• Analytics: under the retention settings of Google Analytics (at most 14 months) and Microsoft Clarity.
• Call recordings: as long as the conversation matters for your enquiry or project, and at the latest at the yearly review.

6. Cookies and your consent

This site sets no analytics cookies until you choose. When you first visit, a banner asks whether you allow analytics. Rejecting takes one click, the same as accepting.

• Your choice is saved in your browser's local storage (not a cookie), so the banner does not come back on every page.
• If you accept: Google Analytics sets cookies such as _ga, and Microsoft Clarity sets cookies such as _clck and _clsk.
• Changing your mind: click "Cookie settings" in the footer of any page. Withdrawing consent removes the analytics cookies.

7. How I protect it

• The website and the forms use HTTPS.
• My laptop's disk is encrypted.
• The forms are handled on my own server in Germany, which does not keep a copy of successful submissions.
• The phone notifications I get about new form submissions contain no personal details.
• I collect only what the task needs.

No system is free of risk. If a breach ever puts your data at risk, I report it to the Dutch Data Protection Authority within 72 hours and inform you where the law requires it.

8. Your rights

You can ask me to:

• show you the personal data I hold about you and give you a copy;
• correct it;
• delete it, unless the law makes me keep it (for example invoices);
• limit how I use it;
• send it to you or another party in a common, machine-readable format;
• stop using it on the basis of legitimate interest. For direct marketing I always stop;
• withdraw a consent you gave, at any time, without affecting what happened before.

Email dominik@dominikgabor.com. I reply within one month. I may ask you to confirm who you are before I hand over or delete anything.

9. Complaints

If you think I handle your data wrongly, please tell me first so I can fix it. You also have the right to complain to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) or to the data protection authority in the EU country where you live or work.

10. Client projects

When I build a system for a client, the client decides what happens with its own customers' data, and I process that data for the client under a written data processing agreement. That data is covered by the client's privacy policy, not this one.

11. Children

This website and my services are for businesses. They are not aimed at anyone under 16, and I do not knowingly collect their data.

12. Changes

When my tools or my use of data change, I update this page and the date at the top.