Privacy Policy
This privacy policy describes how Aspire Digital processes personal data when you use Archie (app.getarchie.nl). Aspire Digital acts as the data controller for your personal data within the meaning of the EU General Data Protection Regulation (GDPR).
1. Data controller
2. Data we process
When you use Archie, we process the following categories of data:
- Account data: email address, name, account settings, and your password (stored hashed by our authentication provider).
- Company and billing data: company name, Chamber of Commerce number, VAT number, and billing address insofar as you provide these.
- Intake information: industry, goals, and optionally a phone number provided during signup.
- Project data you supply: keywords, site exports, and brand-identity documents.
- Google Search Console connection: via Google OAuth you grant Archie read-only access to your Search Console property. We store the associated OAuth tokens, the linked property URL, and the measurement data retrieved from Search Console.
- Publicly accessible web pages: Archie fetches web pages that you specify or that appear in public search results.
- Output of the tool: the content and recommendations Archie generates for you.
- Device and usage data: IP address, browser type, session cookies, and logs of requests and errors.
3. Legal bases for processing (GDPR)
We process your data on the following legal bases:
- Performance of a contract: to give you access to Archie and provide the functionality you use.
- Legitimate interest: security, fraud prevention, abuse detection, and product improvement.
- Legal obligation: tax and administrative retention requirements.
- Consent: where applicable, for example when you connect your Google Search Console account.
4. How we use your data
We use your data to:
- provide the service and manage your account;
- generate analyses, briefings, and content based on your input;
- synchronise and retain your Search Console data;
- send transactional emails (signup, activation, password reset);
- prevent misuse and monitor usage;
- improve the functionality and quality of the product;
- comply with legal obligations.
We do not sell your personal data. We do not currently send marketing emails. Should we do so in the future, this will only happen after explicit opt-in and with the option to unsubscribe at any time.
5. Subprocessors
To deliver Archie we use the following third parties. Each party is contractually bound by applicable law and processes data solely for the purposes listed below.
- Supabase (EU, Frankfurt) — authentication, database, and file storage.
- Railway (EU, Amsterdam) — application hosting and operational logs.
- Anthropic (US) — AI models for Archie's generative functionality.
- SerpAPI (US) — retrieval of search engine results.
- DataForSEO (EU, Lithuania) — retrieval of search volume and ranking data.
- ScraperAPI (US) — retrieval of publicly accessible web pages.
- Google (US/EU) — Search Console API for reading your Search Console data after explicit OAuth consent.
- Google Analytics (US/EU) — anonymised visitor statistics on our public (logged-out) pages.
- Resend (US/EU) — delivery of transactional emails.
- cron-job.org (EU, Germany) — scheduling of periodic background tasks; receives no customer data, only an authentication secret.
An up-to-date list of subprocessors and, on request, a data processing agreement are available via info@getarchie.nl.
6. International transfers
Some of the subprocessors listed above (including Anthropic, SerpAPI, ScraperAPI, and parts of Google and Resend) process data outside the European Economic Area (EEA), notably in the United States. For these transfers we rely on appropriate safeguards, including the Standard Contractual Clauses of the European Commission and, where applicable, the recipient's certification under the EU-U.S. Data Privacy Framework.
7. Retention periods
- Account and profile data: for as long as your account is active and up to 30 days after deletion.
- Project data and content generated by Archie: for as long as your account is active and up to 30 days after deletion.
- Search Console tokens: until you disconnect the integration or delete your account.
- Invoices and accounting records: 7 years (statutory tax retention).
- Operational logs: typically 30 days, retained by our hosting provider.
- Login and security logs: we record login events (including IP address and browser type) and retain them for as long as needed for security and abuse detection.
- Email metadata: typically 30 days, retained by our email provider.
- Anonymised or aggregated data: may be retained indefinitely for analysis and product improvement.
8. Security
We apply appropriate technical and organisational measures, including:
- encryption in transit (SSL/TLS);
- storage with providers that meet recognised security standards;
- modern authentication with short session lifetimes and secure tokens;
- access controls and logical separation between customer environments.
No method of transmission or storage is fully secure. We do our utmost, but we cannot guarantee absolute security.
9. Your rights
Under the GDPR you have the right to:
- access your data;
- have inaccurate data corrected;
- request deletion of your data;
- receive your data in a portable format;
- withdraw any consent you have given;
- object to processing;
- lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Within Archie you can download your personal data and delete your account via the Account page. For other requests, please email info@getarchie.nl.
10. Cookies
We use two types of cookies:
- Functional cookies (strictly necessary): for authentication, session management, and the security and verification of external integrations. These are set when you log in and are required for Archie to work.
- Analytics cookies: on our public (logged-out) pages we use Google Analytics to measure anonymised visitor statistics. These cookies are set by Google. We do not use advertising cookies, and you can refuse analytics cookies via your browser settings.
11. Automated processing and AI output
Archie uses language models to generate content and recommendations. These models are probabilistic and may produce output that is inaccurate, incomplete, or factually incorrect (including fabricated sources, figures, or statements). The output is intended as a tool to support your decisions, not as an automated decision with legal or similarly significant effects. You remain responsible for reviewing AI-generated output before publishing it or basing decisions on it.
12. Changes
We may update this privacy policy from time to time. For material changes we will notify you at least 30 days in advance by email or via a notice in the application.
13. Contact
For questions about privacy or your rights, please contact us at info@getarchie.nl.
This English version is provided for the convenience of international readers, including reviewers performing service verification. The Dutch version remains the authoritative text in case of inconsistency.