Datenschutzerklärung

Version 18 — effective 7 October 2026.

This Privacy Policy explains how 7Lab B.V., Danzigerbocht 39 G, 1013 AM Amsterdam, The Netherlands (Chamber of Commerce 84815515) ("7Lab", "we") processes personal data as controller when you visit sluis.ai, create an account, or otherwise interact with us. Sluis is a product of 7Lab B.V. You can reach us at info@sevenlab.ai.

Important scope note. Content your organisation sends through the Sluis gateway or Sluis Workspace (prompts, documents, model responses, "Customer Content") is processed by 7Lab as processor on behalf of your organisation, under the Data Processing Agreement between 7Lab and that organisation, not under this policy. The same applies to request metadata that attributes usage to individual users in your organisation's audit trail: 7Lab also processes it for your organisation under the Data Processing Agreement, in addition to our own use of it described below as controller (metering, security, the tamper-evident audit trail, and operating and supporting the Service as described in §2). Questions about Customer Content should go to the organisation that operates your account.

1. What we collect

Account and profile data (when you sign up or are invited): email address, password hash (we never store your password itself) or Google, Apple or Microsoft sign-in identity, full name, phone number, job title, organisation name, country, company size, VAT number (for an EU VAT number from outside the Netherlands, with the result of its verification in the EU VIES system), role and organisation memberships, language preference, and, if you enable two-factor authentication, passkey public keys.

Sign-up attribution: when you create an account, we store with it which campaign brought you. This is the utm_* values (source, medium, campaign, content, term) of the sign-up link you followed on our website. Only if you accepted the marketing cookies, it also includes the advertising click identifiers in the URL you first landed on (LinkedIn li_fat_id, Meta fbclid, X twclid) and the utm_* values of that first visit, which the website keeps in your browser's local storage (sluis_ft) until you decline or withdraw consent. We use it only to measure which campaigns produced accounts; it is visible to 7Lab operators and, as the sign-up source and campaign only, in our CRM (see "Customer relationship record" below).

Billing data (when your organisation activates a paid plan): billing and invoice email addresses, payment method type and mandate reference from our payment provider, charge and invoice history, and the VAT details we process for invoicing (country, VAT number and the result of its verification in the EU VIES system). We never receive or store full card numbers or bank credentials; those go directly to Mollie B.V.

Usage and security data: sign-in timestamps, IP addresses on security-relevant events (sign-up, sign-in, legal-document acceptance), operator audit events (who changed what setting, when), request metadata (model, provider, region, token counts, cost) for metering and the tamper-evident audit trail, and technical logs needed to run and secure the Service.

App activity: for each signed-in user and organisation, which Sluis app you opened (web Console, web Workspace, macOS, Windows, Linux, iOS or Android), on which day (UTC), and the app version. The app reports this when you open it and hourly while it is visible; we keep one record per user, organisation, app and day. It is linked to your account, not anonymised. 7Lab operators can see it, and in the operator Users list it appears as your last activity (sign-in, request or app open) and the apps you used in the last 30 days. It is stored only in the Service's own databases (hosted by Scaleway, see §3) and is not shared with anyone else, apart from the usage summary in the customer relationship record below.

Customer relationship record: for each organisation account whose owner has verified their email address, and for its members, we keep a record in our customer relationship management (CRM) system, Attio (see §3). It holds the organisation's name and web domain (taken from the owner's email address); each member's name, email address and role; when the account and each member were created, whether the email address was verified and when each member was last active; the plan (trial, paid or manual) and a status we derive from the plan, payments and activity (trial, active, churned or removed); the amounts paid in total and in the last 30 days (never payment details); a usage summary (date of the first request, last activity, number of requests in the last 7 and 30 days and in total, number of members); and the sign-up source and campaign (see "Sign-up attribution" above; the click identifiers themselves are not copied, but when only a click identifier tells us where you came from, the source names that network: LinkedIn, Meta or X). If the sign-up carried no campaign values, the campaign is the one of our own outreach that we matched your email address or company domain to. We link the record to the person and company record we may already hold from our own outreach, or create one, and may add a note about the new sign-up to an open sales deal. Internal and test accounts are left out. Access is limited to 7Lab staff. Request content is never part of it.

Contact data: what you send us through the contact and DPA-request forms or by email.

Local storage: the marketing site and Console store your language choice (sluis_lang) and session token in your browser's local storage, and the marketing site stores your cookie choice (sluis_consent) and, only if you accepted the marketing cookies, the campaign values of your first visit (sluis_ft, see "Sign-up attribution" in this section). The Console, Sluis Workspace and the API use no advertising trackers and no third-party analytics; fonts are self-hosted, so your visit is not disclosed to a fonts CDN.

Marketing website analytics and advertising measurement (only with your consent): on the marketing website (sluis.ai, including its documentation and legal pages; not the Console, Sluis Workspace or the API), we load the tools below only after you accept them in the cookie banner (the "Accept" button, or the analytics and advertising switch under "Settings" followed by "Save"). The banner is only a short summary; this section is the full list of the tools, the events they receive and what they store. If you choose "Reject" or make no choice, none of them is loaded.

Apollo.io (visitor identification). We load the Apollo.io website tracker. The tracker stores a visitor identifier in your browser's local storage and collects your IP address, the pages you view, the referring page, and browser and device information. It may also load a script from LiveIntent that sets cookies and matches your browser to a hashed (pseudonymised) email address known to LiveIntent, which it passes to Apollo.io. Apollo.io uses this to identify the company you visit from and, where a match exists, you. If you reject or make no choice, the tracker is not loaded; if you withdraw consent, we stop it and remove the identifiers it stored in your browser.

Advertising measurement. To measure our advertising, we load the tags we have switched on, out of the Google tag (Google Ads and, where set up, Google Analytics), the Meta Pixel, the Reddit Pixel, the LinkedIn Insight Tag and the X Pixel. Each one stores identifiers in your browser (cookies on sluis.ai and, for some, on the vendor's own domain) and sends the vendor your IP address, the pages you view, the referring page, browser and device information, the time, and these events: a contact request was sent, a sign-up button was clicked, a download button was clicked, the button to book a call with us was clicked on our landing pages, a call with us was booked (you reach our confirmation page after booking), an account was created (you reach our confirmation page after creating an account). They do not carry what you type in a form or your email address. The Google tag starts with all its consent signals (advertising storage, advertising user data, advertising personalisation and analytics storage) denied and sets them to granted only after you accept. Each vendor processes this data to provide the measurement to us and, under its own terms and privacy policy, for its own purposes, such as delivering and measuring ads, building audiences and security; we do not control that use. Withdrawing consent stops the tags and removes the identifiers they stored on sluis.ai; identifiers a vendor stores on its own domain (for example facebook.com or linkedin.com) you can only clear in your browser settings.

Website analytics (Google Analytics 4). If we have set up Google Analytics, the Google tag also measures how the website is used and how fast it loads, so we can improve it. It receives the page you view (address and title), the referring page, your approximate location, browser and device information, the time, the events above, and for each page view three loading-speed measurements (largest contentful paint, interaction to next paint and layout shift) with the page address. Google Analytics stores a pseudonymous visitor identifier in cookies on sluis.ai (_ga, _ga_*) and does not store your IP address. We do not turn on Google signals, so Google does not link this data to your Google account. Our Google Analytics data is stored in the European Union and deleted after 14 months. Nothing is measured before you accept; withdrawing consent stops the measurement and removes those cookies.

2. Why we process it (purposes and legal bases)

We do not use your personal data for automated decision-making with legal effect, and we do not sell it.

3. Who receives it

• Mollie B.V. (Amsterdam, NL): payment processing for paid plans.
• European Commission (VIES; only for a VAT number from an EU country other than the Netherlands): confirms that the VAT number is valid, which the reverse charge on our invoices requires.
• Scaleway SAS (Paris, FR): EU cloud infrastructure hosting the Service and its databases.
• Scaleway SAS (Paris, FR; fr-par): verification, security and invoice emails through its Transactional Email service.
• Google Ireland Limited (for Google accounts in the EEA or Switzerland; otherwise the entity identified in your Google terms; only if you choose "Sign in with Google"): it processes the sign-in under its own terms; we receive your email address and a subject identifier.
• Apple Distribution International Ltd. (Ireland; only if you choose "Sign in with Apple"): it processes the sign-in under its own terms; we receive an email address (which may be an Apple private-relay address) and a subject identifier.
• Microsoft Ireland Operations Limited (for Microsoft Entra work or school accounts in the EEA; otherwise the Microsoft entity your organisation contracts with; only if you choose "Continue with Microsoft"): it processes the sign-in under its own terms and those of your organisation's Microsoft tenant; we receive your email address, your directory (tenant) identifier and your user object identifier.
• ZenLeads, Inc., trading as Apollo.io (United States; only if you accept the cookie banner on the marketing website): website visitor identification and marketing analytics.
• LiveIntent, Inc. (United States; only if you accept the cookie banner on the marketing website, through the Apollo.io tracker): matching your browser to a hashed email address for Apollo.io's visitor identification, under its own privacy policy.
• Google Ireland Limited (for visitors in the EEA or Switzerland; otherwise Google LLC, United States; only if you accept the cookie banner on the marketing website and we have switched the Google tag on): advertising measurement with Google Ads and, where set up, Google Analytics, under Google's terms and privacy policy.
• Meta Platforms Ireland Limited (Dublin; with Meta Platforms, Inc., United States; only if you accept the cookie banner and we have switched the Meta Pixel on): advertising measurement and ad delivery, under Meta's Business Tools Terms and privacy policy.
• Reddit, Inc. (United States; only if you accept the cookie banner and we have switched the Reddit Pixel on): advertising measurement, under Reddit's business terms and privacy policy.
• LinkedIn Ireland Unlimited Company (Dublin; with LinkedIn Corporation, United States; only if you accept the cookie banner and we have switched the LinkedIn Insight Tag on): advertising measurement, under LinkedIn's terms and privacy policy.
• X Internet Unlimited Company (Dublin; with X Corp., United States; only if you accept the cookie banner and we have switched the X Pixel on): advertising measurement, under X's terms and privacy policy.
• Attio Limited (London, United Kingdom; its affiliate Attio Inc. in the United States may assist): our customer relationship management (CRM) system, as our processor under Attio's Data Processing Addendum. It holds the customer relationship record described in §1. Attio automatically enriches person and company records, using the email address or web domain, through its own data providers (FullContact and Clearbit, United States, under Standard Contractual Clauses and the UK Addendum); this cannot be switched off in our workspace.
• Competent authorities where the law requires disclosure.

We do not transfer account data outside the EEA in the ordinary course. The one exception is the customer relationship record kept with Attio (United Kingdom, covered by the EU adequacy decision for the United Kingdom). Attio engages sub-processors outside the UK and the EEA, including in the United States, under Standard Contractual Clauses and the UK Addendum, as listed in its Data Processing Addendum. Marketing website analytics and advertising measurement data collected with your consent is transferred to Apollo.io, LiveIntent, Google, Meta, Reddit, LinkedIn and X in the United States under the EU-US Data Privacy Framework where the recipient is certified (Google LLC, Meta Platforms, Inc., Reddit, Inc., LinkedIn Corporation and X Corp. are), otherwise Standard Contractual Clauses. If another transfer becomes necessary, we use an adequacy decision or Standard Contractual Clauses. (Model Providers your organisation enables receive Customer Content, not your account data; that is governed by the DPA and, for non-EU providers, the International Transfer Terms your organisation acknowledged.)

4. How long we keep it

• Account and profile data: for the life of the account and up to 12 months after closure, then deleted or anonymised.
• Billing records and invoices: 7 years (Dutch fiscal retention law).
• Legal-document acceptance records: for the life of the account plus the applicable limitation period, as evidence that the contract was concluded (Art. 17(3)(e) GDPR).
• Operator audit events and request metadata: for the life of the account plus the applicable limitation period (append-only records needed for billing integrity and as compliance evidence); other security logs up to 12 months, longer only where needed for an ongoing investigation.
• Which Sluis app each user opened, per day, with its version: 12 months (365 days), then deleted by the daily automatic purge; also erased when your organisation is erased.
• Marketing website analytics (Apollo.io, with your consent): up to 12 months after the last visit, then deleted. Your cookie choice stays in your browser until you change it via "Cookie settings" or clear your browser storage.
• Website analytics (Google Analytics, with your consent): 14 months, then deleted automatically by Google Analytics.
• Advertising measurement (Google, Meta, Reddit, LinkedIn and X, with your consent): the cookies the tags set expire as each vendor defines; the data the vendors hold is kept under their own policies and the settings of our accounts with them, not by 7Lab.
• Sign-up attribution (campaign values and, with consent, ad click identifiers): for the life of the account, as part of the account record.
• Account setup and getting-started emails: the date on which each was sent, for the life of the account, as part of the account record.
• Customer relationship record in our CRM (account contact data, plan and amounts paid, usage summary, sign-up source and campaign): for the life of the account and up to 12 months after closure, then deleted by an automatic daily job. Contact and company records we already held before your sign-up, or that are linked to a sales deal, are not part of that deletion.
• Prompt and response content retained for your organisation (Customer Content, processed under the DPA): 30 days by default, configurable per organisation. In Sluis Workspace, personal values in conversations are replaced by placeholders after 7 days by default, and conversation history is kept according to your organisation's setting. A daily automatic purge enforces these periods.
• Contact correspondence: up to 24 months after resolution.

5. Your rights

You have the right to access, rectify, erase, and receive a copy of your personal data, to restrict or object to processing based on legitimate interest, and to withdraw consent where processing is based on consent. Every account setup and getting-started email carries a link to stop those emails; it does not affect verification, security or invoice emails. Write to info@sevenlab.ai; we respond within one month. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority of your place of residence.

6. Security

We apply the measures described in the DPA's technical-and-organisational annex to all systems, including encryption in transit and at rest for sensitive stores, envelope encryption of credentials, per-tenant isolation, tamper-evident audit chains, and role-based access with mandatory re-verification on every administrative request.

7. Changes

We may update this policy; each version carries a version number and effective date. Material changes are announced in the Console and require acknowledgment before continued use. This document is drafted in English; the English version is the binding one.