What we keep about you, and why

HG E-Commerce Online BV, Bagven Park 16, 4838 EH Breda, the Netherlands. Chamber of Commerce no. 84623969, VAT NL863285806B01. Questions about your data go to info@egantic.ai.

If you use Egantic as a seller, you are responsible for the data of your own buyers and we are its processor. What we may and may not do with it is in the data processing agreement.

• You and your colleagues. Name, e-mail address, your role in your workspace, and on which days you opened the app. To let you log in, to manage permissions and to see whether the product is used.
• Your buyers. Only if you use the customer questions module: the name the buyer gave, the order number and the text of the question, including whatever else is in it. To be able to draft a reply. Here we are the processor and you are the controller; that is what the data processing agreement is for.
• Sellers you compete with. The company name bol shows with an offer. To be able to say who ranks on a search term. This is public information on bol and concerns companies, not people.

By far most of what we store is not personal data but market data: search positions, prices, numbers of sellers, review counts. That is about products.

For your account and your market data: because it is necessary to perform the agreement with you. Without login details there is no product, and without measurements there is nothing to deliver.

For the customer questions: you pass them on to us yourself, and we process them solely on your instructions. We use them for nothing else.

For recording that you opened the app on a given day: legitimate interest. We want to know whether the product is used. It is one line per user per day, without path, time, device or referrer, and that is deliberately the minimum that answers the question.

We sell nothing on and do not use your data for advertising. These parties process data because the product does not run without them:

For parties outside the European Union, transfers are based on the standard contractual clauses of the European Commission. Your database itself is in Frankfurt and does not leave Europe.

A few parts of the product use language models from Anthropic, such as the weekly analysis and the draft replies to customer questions. Only what that one task needs is sent there. Anthropic does not use data from the API to train models.

The questions you ask in your own Claude or ChatGPT do not run through our account. The next section is about that.

You can connect Egantic to your own Claude or ChatGPT. This only happens at your request, through a login at Egantic in which you choose the workspace. Such a connection reads your market data: search positions, visibility, prices and reviews of you and your competitors, search volumes, advertising pressure and the weekly analysis per product.

A connection can be read-only. If you give it write access, your AI makes small changes within fixed limits itself and prepares everything else for your approval. Every change is recorded with time and source in your log (Logboek).

What the assistant requests goes to the provider of that assistant (Anthropic for Claude, OpenAI for ChatGPT) under their own terms; we send nothing on our own initiative. Of each call we only keep which question was asked, when, and how long it took, not the answer.

You revoke a connection under Instellingen → Je AI (Settings → Your AI). A revoked connection stops working immediately.

Access, correction, deletion, restriction, portability of your data, and objection to processing based on legitimate interest. One e-mail to info@egantic.ai is enough; we respond within a month and usually sooner.

Deleting means really deleting. If you remove a product, the derived data in seven tables goes with it. If you cancel, everything is gone within thirty days; during those thirty days you can still request an export.

If you disagree with something and we cannot resolve it together, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Only what is needed to keep you logged in and to remember your light or dark preference. No tracking cookies, no advertising cookies, no third-party visitor analytics. That is why there is no consent banner: there is nothing to ask consent for.

Data is separated per workspace, enforced in the database itself and not only in the application. Traffic goes over https. Your bol keys are stored encrypted and cannot be read back anywhere after you enter them. Access to the production environment lies with the builders and is logged.

If something goes wrong with your data despite all this, you will hear it from us, with what happened and what we are doing about it. Also if it is our fault.