Privacy notice
Last updated: 16 August 2026.
Controller
Outlin BV, Pleinstraat 10A, 3190 Boortmeerbeek, Belgium — enterprise and VAT number BE 0687.555.301 (RPR Leuven). Questions and requests: the contact form or ewoutvangossum+nbbmcp@gmail.com.
What we collect
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Your email address | It is your account identity and the only way to sign in. | Performance of the contract | Until you ask for deletion |
| Sign-in tokens (hashed) | To verify a magic link once and only once. | Performance of the contract | Deleted shortly after expiry |
| API keys (hashed) | To authenticate tool calls. We cannot recover a key, only replace it. | Performance of the contract | Until revoked, then as usage history |
| Usage metadata — which tool, when, whether it was billable | Quota enforcement, billing, and diagnosing failures. | Performance of the contract; legitimate interest in preventing abuse | Retained as billing records |
| Billing data (name, address, VAT number, payment method) | Invoicing and tax. Held by Stripe; we see the invoice, not your card. | Legal obligation (accounting) and contract | 7 years, as Belgian bookkeeping law requires |
| Server logs, including IP address | Security, rate limiting and debugging. | Legitimate interest | Short-lived; not used to profile you |
| What you send through the contact form — your address and your message | To answer you. It is delivered to our mailbox and used for nothing else. | Legitimate interest | Until the conversation is handled |
| Your email address on the launch-notification list, if you signed up for it | One mail when the paid plan launches — that is the whole list. | Consent | Until that mail is sent, or sooner if you ask |
We do not use tracking cookies, analytics or advertising. The site sets exactly one cookie, and only when you sign in: the session cookie, which exists to keep you signed in. The language of the site is taken from your browser's own preference and from the switcher in the navigation — nothing about that choice is stored. The cookie is not used to profile you.
The company data the service returns is public register data about legal entities. It is not personal data about you, and we do not record which companies you looked up beyond the tool name needed for metering.
Processors we use
| Processor | What for | What it sees |
|---|---|---|
| Contabo (Deutschland) | Hosting the application and its database | Everything the service stores |
| Brevo (France) | Sending sign-in mails | Your email address and the mail content |
| Stripe (Ireland / USA) | Subscription payments, invoices and tax | Your billing details; only for paid accounts |
| OpenAI (USA) | Reading PDF-only filings into structured data — a feature that is in progress and not active yet | The public filing document only — never your email address, key or usage. Used only once that feature ships, and only for filings the National Bank publishes as PDF. |
| Google (Ireland / USA) | The mailbox that receives contact-form messages | What you typed into the contact form: your address and your message |
Transfers outside the EEA (Stripe, OpenAI, Google) rely on the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
Your rights
Under the GDPR you can ask for access to your data, correction, erasure, restriction, a portable copy, or object to processing based on legitimate interest. Use the contact form with the address on the account and we will act within one month.
Deletion removes your account, your keys and your sign-in tokens. Invoices and the usage rows they are based on are kept for the statutory bookkeeping period — we are not allowed to delete accounting records on request, and we will tell you exactly what remains.
You can also complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be), or to the authority where you live.
How we protect it
- Sign-in tokens and API keys are stored only as SHA-256 hashes; a database dump hands out no working credentials.
- Sign-in links expire after 15 minutes and can be used once.
- The session cookie is
HttpOnly,SameSite=Laxand (on the public site)Secure. - Traffic to the site and to the API is over HTTPS.
If we ever discover a breach affecting your data, we will notify you and the supervisory authority as the GDPR requires.