Privacy policy

1. Who we are

VLAK is a service offered from the Netherlands. We are the data controller for the personal data processed through vlak.app and the iOS app “VLAK Scanner”.

• Name:VLAK (sole proprietorship)
• Address:Zomerluststraat 25-0003, 2012 LL Haarlem
• Chamber of Commerce (KvK):42088477
• Email:info@vlak.app

2. Which data we process

We only process the data needed to deliver the service:

Account data

Your name, email address and encrypted password. Supplemented with the company name and optional contact details (phone, address, Chamber of Commerce number, VAT) that appear on your measurement reports.

Project data

Address details of the properties you measure. These are therefore not your data, but those of the property for which you create the report.

Scan and measurement data

USDZ 3D models and JSON metadata from Apple RoomPlan LiDAR scans, or uploaded FML files (Floorplanner export). This data contains the geometry of the property, no personal data of residents.

Camera and LiDAR access (iOS)

The iOS app uses the camera and LiDAR sensor solely to perform an ARKit / RoomPlan scan. Images and sensor data remain local until you start a scan upload.

Payment data

Payments are processed via a certified payment provider (PCI-DSS compliant). We do not store any credit card or bank details ourselves; we only receive the payment status and the amount.

Technical logs

Limited server and error logs needed to keep the service reliable. No behavioural analysis or profiling.

3. For what purpose and on what legal basis

The GDPR (AVG) requires us to have a purpose and a legal basis for every processing activity.

• Performance of the contract: we need account data, project data and scans to deliver the service you pay for or for which you have created a free account.
• Legal obligation: we retain payment and invoice records in accordance with the statutory tax retention period (seven years).
• Legitimate interest: we use technical logs and security to keep the service stable and safe. We have weighed your interests against ours here.
• Consent: for camera and LiDAR access in the iOS app, the operating system explicitly asks for consent. You can withdraw this at any time in the iOS settings.

4. How long we keep data

• Account data and projects: as long as your account is active. After deletion of the account, data is permanently deleted within 90 days, except for what we are legally required to keep.
• Scan and measurement data: as long as the associated project exists. You can delete a project yourself at any time.
• Invoices and payment records: seven years, in accordance with the statutory tax retention period.
• Technical logs: a maximum of 90 days.
• Local data in the iOS app (camera/LiDAR): stays only on the device and is erased as soon as you upload the scan or close the scan session.

5. Who we share data with

We engage a limited number of processors. We have a processor agreement with all of these parties.

Vercel (website hosting)

The vlak.app website runs on Vercel. Vercel processes technical request and error logs (including IP addresses) to serve the site; our environment runs in the EU region Frankfurt. Vercel is a US company; transfers are governed by the EU Standard Contractual Clauses.

Supabase (database, authentication, storage)

Account, project and scan data is stored in Supabase, in an EU region (Frankfurt or Amsterdam, AWS infrastructure).

Moneybird (invoicing & direct debit)

Handles invoices and the automatic SEPA direct debit of subscriptions, via the certified payment service Moneybird Online Payment Methods (technically processed by Adyen). We only receive the payment status and the amount, no full bank account or card details.

Transactional email (Brevo)

Emails for password reset, email verification and account notifications are sent via Supabase Auth and Brevo. We do not send marketing emails without your consent.

Google (Analytics)

Only after your consent via the cookie banner does Google Analytics measure website visits anonymously. Google acts as a processor; data may be transferred to the United States under the EU Standard Contractual Clauses. If you decline, Google Analytics is not loaded.

Apple TestFlight / App Store

Distribution of the iOS app. Apple receives installation and crash statistics in accordance with its own privacy policy.

We do not sell data and do not share data with advertising networks or data brokers.

6. Transfers outside the EU

Our primary storage (Supabase) is located in the EU. A number of processors (Google Analytics, Apple and our payment provider) may also process data outside the EU. Such transfers are governed by the European Commission Standard Contractual Clauses and additional safeguards where necessary.

7. Security

• Connections to vlak.app and the iOS app run exclusively via HTTPS / TLS.
• Passwords are stored encrypted by Supabase Auth (bcrypt/argon2).
• Access to data is shielded with row-level security: a user can only see their own projects and companies.
• We store scan and project data in an EU region with a processor that is ISO 27001 certified.

8. Analytics and tracking

In the iOS app we use no analytics or trackers. On the website we use Google Analytics to measure visits, but only after you give consent via the cookie banner; if you decline, no analytics is loaded. Google acts as a processor and data may be transferred to the United States under appropriate safeguards (EU Standard Contractual Clauses). We do not build behavioural profiles and we do not share camera, LiDAR or location data with third parties for advertising or tracking purposes. You can withdraw your consent at any time by clearing your cookies.

9. iOS app: camera and LiDAR

The iOS app “VLAK Scanner” asks for permission for the following features, solely to make measurements possible:

• Camera and LiDAR: to create a 3D scan of a room with Apple RoomPlan / ARKit. Images and sensor data remain local on the device until you explicitly start an upload. We do not use this data for facial recognition, advertising or analytics.
• Location: not required. We do not ask for location access.

You can withdraw these permissions at any time via iOS > Settings > VLAK Scanner.

10. Your rights

Under the GDPR you have the following data subject rights regarding your personal data:

• Access: request which data we hold about you.
• Rectification: have incorrect data corrected.
• Erasure: have your account and associated data deleted.
• Restriction: have processing restricted in certain cases.
• Objection: object to processing based on legitimate interest.
• Data portability: receive your data in a common format to take with you.
• Withdraw consent: for processing activities for which you have given consent.

Send an email to info@vlak.app to exercise one of these rights. We respond within four weeks.

11. Filing a complaint

Do you disagree with how we handle your data? Then please contact us first via info@vlak.app. You can also always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

12. Cookies

We use functional cookies and local storage needed to keep you logged in and to remember your active company. In addition — only with your consent via the cookie banner — we place Google Analytics cookies to measure visits anonymously (see section 8). We place no advertising cookies and no cookies that track you across other websites. Full details are in our cookie policy.

13. Changes to this policy

We may adjust this privacy policy from time to time. The version and the date at the top of this page indicate when the policy was last updated. For significant changes we will inform you by email.

14. Contact

Questions about privacy or this policy? Send an email to info@vlak.app.