Privacy Policy

This explains what personal data we collect when you use this website and the on-page AI agent, why, how long we keep it, and the rights you have. We keep it plain. No dark patterns, no data selling.

Who we are (the controller)

The data controller is IfToDo IT (Vlad Iftode), a sole proprietorship registered in the Netherlands.

• KvK (Chamber of Commerce): 98919830
• BTW (VAT): NL005361819B35
• Contact for any privacy request: hello@iftodo.ai

What we collect, and why

Your conversation with the agent

When you describe a workflow to the on-page agent, we process the text you send, including anything you choose to share, such as your email or company name. We use it to respond, to scope your problem, and to improve the service. Lawful basis: our legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR); and, where you give us your contact details so we can follow up, to take steps at your request (Art. 6(1)(b)).

A strictly-necessary cookie

We set one functional cookie (iftodo_sid) to rate-limit the agent and prevent abuse. It carries no tracking and is exempt from consent requirements. We use no advertising or third-party analytics cookies, so there's no cookie banner.

Technical data

Our hosting and security layers process standard technical data (such as your IP address and request metadata) transiently, to serve the site and enforce rate limits.

Cookieless analytics and masked session replay

We measure aggregate page views and loading performance with Vercel Analytics and Speed Insights. We also use PostHog EU for product analytics and masked session replay, so we can see where visitors get stuck and improve the page. PostHog runs cookieless on this site, does not autocapture arbitrary clicks, and masks all form inputs plus the chat transcript before replay data is sent. These tools do not track you across sites or build an advertising profile. Lawful basis: our legitimate interest in understanding and improving the site (Art. 6(1)(f) GDPR).

If you book a call

Booking is handled by Cal.com; the details you enter there are processed under Cal.com's own privacy terms.

Who processes your data

• Vercel: website hosting, plus cookieless usage and performance analytics.
• PostHog EU: cookieless product analytics and masked session replay.
• Langfuse: conversation analytics, hosted in the EU.
• Upstash: rate-limit counters.
• OpenRouter / the underlying AI model: generates the agent's replies (see the transfer note below).
• Cal.com: call booking.

International transfers

The agent's replies are generated by a third-party large-language-model provider accessed via OpenRouter, so the messages you send to the agent may be processed on servers outside the EU/EEA. Where that happens, we rely on the providers' contractual safeguards (such as Standard Contractual Clauses). Please don't enter sensitive personal data into the agent. If your matter is sensitive, book a call instead.

How long we keep it

Conversation data is retained for up to 30 days and then deleted, unless you've asked us to follow up, in which case we keep your contact details until your request is resolved or you ask us to erase them. Booking data is retained by Cal.com under their policy.

Your rights

Under the GDPR you have the right to:

• access the data we hold about you;
• have it corrected or erased;
• restrict or object to processing;
• data portability;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these, email hello@iftodo.ai. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

You're talking to an AI

The on-page agent is exactly that, an AI agent, not a human. It can be wrong, and anything it says about scope, approach, timeline, or cost is an informational estimate, not a binding offer. Nothing it outputs creates a contract.

Security & data selling

We store as little as we need, prefer EU-hosted infrastructure, and never sell your data or use it for advertising.

Changes

We may update this policy as the service evolves. The "last updated" date above always reflects the current version.