Privacy and cookies

I am Sinyo Swildens, an AI consultant for Dutch SMEs. I work as a sole trader from Eerste Jan Steenstraat 5 H, 1072 NA Amsterdam. KvK 98170732, VAT ID NL005312797B80.

I am the data controller for everything you leave on this site. Any questions about your data come to me: sinyo@sinyoswildens.nl or +31 6 39 39 18 37. I have no data protection officer. One is only required for large-scale monitoring or special category data, and I do neither.

This statement covers sinyoswildens.nl and any contact that follows from it: the form, email, phone, WhatsApp and the Cal.com calendar.

If I build a system for your company, I process the data in it on your instructions. Your own privacy statement then applies, plus the data processing agreement (DPA) you and I sign beforehand.

Only what I need to answer your question and book a call.

• Form: your name, email address, company name (optional), your question (optional) and the service you were looking at when you filled in the form.
• Calendar: if you pick a time via Cal.com, Cal.com asks for your name and email address. Your answers from the short intake and the calculation are attached as a note, so I come prepared. Cal.com receives those answers as soon as you open the calendar, even if you do not pick a time.
• Email, phone and WhatsApp: whatever you send or tell me, plus your email address or phone number.
• Technical: I use your IP address very briefly to block spam and abuse of the form. It is not stored. The hosting provider keeps short-lived server logs.
• Visitor numbers: page views and load times, aggregated, with no profile and no cookies. Only if you consent.

The GDPR requires a legal basis for each purpose. Here they are.

• Answering your question, booking a call, preparing a quote and carrying out an assignment: necessary for the contract between you and me.
• Blocking spam, securing the site, checking visitor numbers and a notification of your request in my own inbox: my legitimate interest, with as little impact on you as possible.
• Invoices and accounts: a legal obligation.
• A client's name, role and quote in a case on the site: that client's consent.
• What I do not do: send newsletters or adverts you did not ask for, build profiles, or make decisions about you without a human involved.
• Without a name and email address I cannot reply. Everything else is optional.
• For the lawyers: that is Article 6(1)(b), (f), (c) and (a) of the GDPR.

I do not sell data on and I do not use ad networks. The following parties see some of your data. I have a data processing agreement (DPA) with the technical parties; my bookkeeper and the Dutch tax authority (Belastingdienst) operate under their own legal duties:

• Vercel (US): hosts the site. The form is processed on a server in Frankfurt; pages are served from the nearest Vercel node. Vercel also holds the short-lived server logs and the visitor numbers.
• Supabase (US): the database that holds form submissions, in a data centre in Ireland.
• Cal.com (US): the calendar where you pick a time. Your booking is stored on Cal.com's servers, possibly in the US. Cal.com has its own privacy statement.
• My email provider: the notification of your request lands in my business inbox.
• Meta / WhatsApp: if you contact me via WhatsApp yourself. If I have no email notification set up, your name, email address, company and message are sent to my own number as a WhatsApp message, via Meta. The email notification is currently on.
• Invoice details may end up with my bookkeeper and the tax authority.

Vercel, Supabase and Cal.com are American companies. The form and the database run in the EU. Your Cal.com booking is stored in the US; support and some logs at the other parties may be processed there too.

Meta (WhatsApp) may also process data outside the EU. My email provider is based in the Netherlands.

Those American parties are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. If you would like a copy of those arrangements, email me.

The blog automation sends public news texts to DeepSeek in China. There is no adequacy decision covering that. Your data is never involved; only texts that are already public.

• Form submissions: 12 months after receipt. After that, an automated routine deletes them from the database.
• If it turns into an assignment: your data stays in the client file for as long as the assignment runs. I keep invoices for 7 years, the statutory retention period for accounts.
• The notification of your form submission in my inbox I clear out after the same 12 months. Supabase keeps deleted rows in a backup for a short while.
• Other email and WhatsApp: for as long as the contact lasts and it contains something I need. After that I delete it.
• Calendar bookings: I delete them after the call. Cal.com applies its own retention period as well.
• Cases on the site with your name or quote: for as long as you consent.
• Server logs: briefly, as determined by Vercel. Visitor numbers I keep only in aggregated form.

You can always ask what I hold about you. Email sinyo@sinyoswildens.nl. I reply within a month and it costs nothing. If I am not sure it is really you, I first ask for something to verify that.

• Access: a copy of what I process about you.
• Rectification: have errors corrected.
• Erasure: have deleted what I no longer need, except what the law requires me to keep.
• Restriction: have processing paused temporarily.
• Portability: receive your data in a readable file.
• Withdrawal: you can withdraw consent for a name or quote on the site at any time. I then take it down.

Separately from the list above: you can always object to processing based on my legitimate interest, such as the notification in my inbox. I then stop, unless I have a compelling reason that outweighs it.

Disagree with how I handle your data? Tell me first. You and I almost always sort it out between us.

If you and I cannot resolve it, you can lodge a complaint with the Dutch Data Protection Authority (AP): https://www.autoriteitpersoonsgegevens.nl.

• The site and the form run over HTTPS.
• The form asks for as few fields as possible and has a spam throttle and a hidden honeypot for bots.
• The database is locked down: visitors can only add entries. Reading requires my admin access, and Supabase, as processor, has technical access.
• No accounts, no visitor passwords on this site.
• If something does go wrong with your data, I report it to the AP and to you, where the law requires it.

This site sets no cookies of its own to track you. For visitor numbers I still ask your consent, via the bar at the bottom. If you choose nothing, or choose no, I do not load the measuring script at all. Your own browser remembers your choice; it never reaches me.

What else happens in your browser:

• Visitor numbers: only after your consent. Vercel Analytics and Speed Insights then count page views and load times, with no cookies, no profile and no way for me to recognise you.
• Your choice itself: your browser stores it locally, under the name "sinyo-consent-v1". You can revisit it below whenever you like.
• Intake answers: your browser remembers your answers from the short set of questions and the calculation (sessionStorage) until you close the tab. That is how they travel with the calendar booking. No consent is needed for that: you request it yourself, and they never go to my server.
• Calendar: the Cal.com calendar loads only after you click "Open the calendar". From then on, Cal.com can set its own cookies inside the calendar frame. See Cal.com's privacy statement.
• Fonts are served from my own domain, not from Google.
• Links to LinkedIn, WhatsApp and Cal.com take you to their sites, where their terms apply.

• I write blog posts partly with AI (DeepSeek), based on news articles. An automated check vets each post; I read it after publication and withdraw anything that is wrong. Every article states that AI helped write it, as the EU AI Act requires.
• Only the news texts go to the AI model, with title, source and date. They may contain the names of journalists or people quoted; that is public information. Nothing of yours goes there: no name, email or message.
• Some of the atmospheric imagery is AI-generated. Photos of me and of client work are real. AI images do not show real people.
• Nowhere on this site do you talk to a chatbot. The form and the calendar come to me, not to an AI.

If you become a client, I process business contact details for you and your colleagues: name, role, email, phone number. I get those from you or from the colleague in question.

I use them for quotes, carrying out the assignment and invoicing. They live in my email, calendar and accounts, with the parties listed under "Who sees your data".

If I build a system for you that processes data about your customers or staff, article 12 of my terms and conditions applies. In short: a data processing agreement (DPA) before the build, you as controller, me as processor.

If anything changes in what I process or with whom, I update this statement. The version and date are at the top.