Privacy policy

Last updated: 11 September 2026

Auttendo B.V. (“Auttendo”, “we”) is based at Nijverheidstraat 11b, 7511 JM Enschede, the Netherlands, and registered with the Dutch Chamber of Commerce under number 89123456. We run www.auttendo.com and provide Auttendo: a workspace where your team, the agent and your company memory do the work together. This policy explains which personal data we process, why, and what you can do about it. We follow the General Data Protection Regulation (GDPR).

1. Two roles, and the difference matters

For some data we decide why and how it is processed. There we are the controller. That covers visitors to this site, people who book a demo, and the administration around a customer.

For everything inside the workspace itself, the customer is the controller and we are the processor. You decide which tools you connect, what the agent may do and what ends up in your company memory. We process that data only to provide the service and only on your instruction. The data processing agreement is part of the contract; ask for it at hi@auttendo.com.

Auttendo B.V., Nijverheidstraat 11b, 7511 JM Enschede, the Netherlands
Chamber of Commerce 89123456
Email: hi@auttendo.com

2. Visitors to this site

When you visit www.auttendo.com we process:

Technical data every web server sees: your IP address, your browser and the address you requested. We use it to serve the site and to spot abuse.
What you fill in when you book a demo: your name, your email address, the time you picked and anything else you add.
What you email us, along with the address you sent it from.

What this site stores in cookies and local storage is set out in our cookie policy.

3. Auttendo customers

Once you become a customer we also process:

Account data: name, work email address, phone number, company name and, where applicable, company registration and VAT numbers.
Billing data: billing address and payment details, handled by our payment provider. We do not store full card numbers ourselves.
Usage data: what work the agent did, what it cost in credits, who approved it and when. That is the work log you see in the app.
Technical logs, for outages and security.

4. What lives in the workspace

Here we are the processor. A workspace can hold:

What your team writes in projects: instructions, notes, agreements and decisions.
Documents and sources you attach to a project.
What the agent fetches from the tools you connect: messages, calendar entries, files, invoices, customer records.
The company memory that grows out of it: what you have recorded as knowledge worth building on.

That can include personal data about your customers, suppliers and staff. You decide which, because you decide what you connect and what you record. We do not look inside, except where it is needed to fix an outage or investigate abuse, and then under confidentiality and as little as possible.

5. Why we process it

Providing the workspace and running the agent’s work: Legal basis under the GDPR: Performance of the contract, article 6(1)(b)
Creating and managing an account: Legal basis under the GDPR: Performance of the contract, article 6(1)(b)
Invoicing and collecting payment: Legal basis under the GDPR: Performance of the contract, article 6(1)(b)
Answering a booking request or a question by email: Legal basis under the GDPR: Steps prior to entering a contract, article 6(1)(b)
Sending service and incident notices: Legal basis under the GDPR: Legitimate interest, article 6(1)(f)
Securing the service and preventing abuse: Legal basis under the GDPR: Legitimate interest, article 6(1)(f)
Sending news and tips by email: Legal basis under the GDPR: Consent, article 6(1)(a)
Keeping invoices for the tax authorities: Legal basis under the GDPR: Legal obligation, article 6(1)(c)

Purpose	Legal basis under the GDPR
Providing the workspace and running the agent’s work	Performance of the contract, article 6(1)(b)
Creating and managing an account	Performance of the contract, article 6(1)(b)
Invoicing and collecting payment	Performance of the contract, article 6(1)(b)
Answering a booking request or a question by email	Steps prior to entering a contract, article 6(1)(b)
Sending service and incident notices	Legitimate interest, article 6(1)(f)
Securing the service and preventing abuse	Legitimate interest, article 6(1)(f)
Sending news and tips by email	Consent, article 6(1)(a)
Keeping invoices for the tax authorities	Legal obligation, article 6(1)(c)

6. Connections: what the agent sees

You connect a tool by signing in to that tool itself. We receive a key, not a password.

That key is stored encrypted and only opens what you approved when you connected.
The agent fetches data at the moment it needs it for a piece of work. A connection is not an export: we do not pull your whole inbox across to keep it here.
What does stay is what belongs to the work: the instruction, what was fetched to carry it out, and what you deliberately record as knowledge.
You can revoke a connection at any time, with us or with the provider. After that the agent cannot reach it.

7. AI and the agent’s work

The agent’s thinking runs on specialist AI providers, acting as processors for us.

Only what the work needs is sent. Not your whole workspace.
Our agreements with those providers rule out training on your data.
Where data leaves the European Economic Area, it does so under the European Commission’s standard contractual clauses.
An agent can get things wrong. For work with consequences you build in approval, so a person makes the call. See the terms of service.

8. Who else can see it

We share personal data only as far as providing the service requires, and we never sell it. These are the processors that may see it:

Vercel Inc.: What for: Hosting this site; Where: US, with EU regions where possible, under standard contractual clauses
Composio: What for: The connections to the tools you switch on; Where: EU and US, under standard contractual clauses
AI providers: What for: The agent’s thinking, with no training on your data; Where: EU and US, under standard contractual clauses
Cal.com: What for: Booking a demo; Where: EU and US, under standard contractual clauses
OpenPanel: What for: Visitor numbers for this site; Where: EU
Parsew: What for: The tool logos on this site; Where: Only the data that comes with an ordinary image request
Our payment provider: What for: Invoicing and collection; Where: EU

Processor	What for	Where
Vercel Inc.	Hosting this site	US, with EU regions where possible, under standard contractual clauses
Composio	The connections to the tools you switch on	EU and US, under standard contractual clauses
AI providers	The agent’s thinking, with no training on your data	EU and US, under standard contractual clauses
Cal.com	Booking a demo	EU and US, under standard contractual clauses
OpenPanel	Visitor numbers for this site	EU
Parsew	The tool logos on this site	Only the data that comes with an ordinary image request
Our payment provider	Invoicing and collection	EU

We have a data processing agreement with every processor; they may only process data on our instruction. If this list changes we say so in advance, so a customer can object.

9. Transfers outside Europe

Processing happens inside the European Economic Area as far as possible. Where data goes beyond it, we put appropriate safeguards in place: the European Commission’s standard contractual clauses, an adequacy decision, or the EU-U.S. Data Privacy Framework where it applies.

10. How long we keep it

Enquiries that did not become a customer: How long: Twelve months after the last contact at most
Account and billing data: How long: For as long as the relationship lasts, and invoices for seven years under Dutch tax law
What lives in the workspace: How long: For as long as the contract runs. After that you have thirty days to export, then we delete it
Work log and technical logs: How long: Twelve months
Newsletter subscriptions: How long: Until you unsubscribe

What	How long
Enquiries that did not become a customer	Twelve months after the last contact at most
Account and billing data	For as long as the relationship lasts, and invoices for seven years under Dutch tax law
What lives in the workspace	For as long as the contract runs. After that you have thirty days to export, then we delete it
Work log and technical logs	Twelve months
Newsletter subscriptions	Until you unsubscribe

11. Your rights

Under the GDPR you have these rights:

Access: ask for a copy of what we hold about you.
Rectification: have incorrect data corrected.
Erasure: have your data deleted.
Restriction: have processing paused while something is being sorted out.
Portability: receive your data in a common file format.
Objection: object to processing based on legitimate interest.
Withdrawing consent: where we asked for consent, you can always take it back.

Email us at hi@auttendo.com and we will respond within thirty days. If your request concerns data held inside a customer’s workspace, contact that customer: they are the controller for it. We will help pass the request on. You can also complain to the Dutch Data Protection Authority.

12. Security

We take appropriate technical and organisational measures, including:

Encryption in transit and at rest.
Two-factor authentication on accounts.
Access control on our internal systems, with as few people able to reach anything as possible.
Infrastructure partners audited by independent third parties.
Regular security reviews and a set procedure for incidents.

No system is completely secure. If you find a weakness, report it at hi@auttendo.com. We will respond and keep you posted.

13. Children

Auttendo is a business service and is not aimed at children under sixteen. We do not knowingly collect their data. If you think we have, tell us and we will delete it.

14. Changes to this policy

We may update this policy. If a change is material we will say so by email or with a notice in the app. The date at the top tells you which version you are reading.

15. Contact

Questions about this policy or about what we hold:

Email: hi@auttendo.com
Auttendo B.V., Nijverheidstraat 11b, 7511 JM Enschede, the Netherlands