Last updated: November 3, 2026
1. Introduction
Vaizy B.V. ("Vaizy", "we", "us", or "our") provides a project management platform for teams running multiple projects, including milestone tracking, team and resource planning, financial management, risk management, budget health analytics, and AI-assisted insights via an OpenAI-powered assistant, and connections to AI apps and tools you choose (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit vaizy.com or use the Service, and your rights under applicable laws including the General Data Protection Regulation (EU) 2016/679 ("GDPR"). By using the Service, you agree to this Privacy Policy.
2. Data Controller
Vaizy B.V. is the data controller for personal data processed in connection with account registration, billing, marketing, and website analytics. For personal data that our customers submit into the platform (project data, team records, financial entries, uploaded files, AI conversation inputs, data synced from your organisation's identity provider), Vaizy acts as a data processor on behalf of the customer. A Data Processing Agreement (DPA) governs this relationship and is available at vaizy.com/dpa. Contact: hello@vaizy.com
3. Information We Collect
3.1 Information you provide directly: • Account details (name, email address, company name) • Project data: milestones, timelines, team assignments, roles, cost rates, financial entries, risk records, and any other content submitted to the platform • AI conversation inputs: prompts and context sent to the AI assistant • Status remarks and comments you write, with you recorded as the author • Identity provider data, if your organisation uses single sign-on (SAML) or automatic provisioning (SCIM): name, email address, job title, department, country, group memberships, and other attributes your administrator maps • Connected apps and API keys: the AI apps you connect, the workspace and access level you approve, and the API keys you create. Keys and access tokens are stored only as a one-way hash • Communications and support requests 3.2 Automatically collected data: • Usage data: features accessed, timestamps, session duration • Device and log data: IP address, browser type, operating system • Bot protection data at sign-up and login via hCaptcha (IP address, browser and device signals) • Authentication events and security logs • Sign-in activity and active sessions (time, IP address, browser and device). In Enterprise workspaces, owners and admins can see this for their members in the Security center and sign a session out • Notifications created for you in the app, such as a mention or a raised risk • Analytics data via PostHog (EU region) and Google Analytics • Website analytics and marketing data via Google Analytics, Google Ads, HubSpot, and Microsoft Clarity on vaizy.com, set only with your consent (see our Cookie Policy at vaizy.com/cookies) 3.3 AI interaction data: • Prompts and context submitted to the AI assistant • AI-generated responses and metadata (token counts, request identifiers) • Conversation history stored in our own database, hosted in the EU
4. Legal Basis for Processing (GDPR)
We process personal data under the following legal bases: • Contractual necessity: to provide the Service and fulfil our agreement with you • Legitimate interests: platform security, fraud prevention, product improvement, and operational monitoring • Consent: marketing communications and optional analytics features • Legal obligation: tax, accounting, and regulatory compliance
5. How We Use Your Data
• Provide, operate, and maintain the Service • Enable AI-powered features including the project assistant • Send notifications in the app, by email, and as desktop notifications in your browser if you turn them on • Send monthly project and portfolio reports to the people a manager selects. Reports name no staff members • Connect your organisation's identity provider for single sign-on and automatic provisioning, when your workspace sets this up • Make data available to AI apps and API clients that you or your workspace connect, at your request • Authenticate users and enforce role-based access controls • Monitor platform performance, reliability, and security • Conduct analytics to improve the product • Communicate with you about your account, updates, and support • Comply with legal obligations
6. AI Features and Data Protection
The Vaizy AI assistant is powered by OpenAI models and routed through a server-side gateway. When you interact with the AI assistant: • Your prompts and project context are transmitted to OpenAI via secure server-side calls (not exposed to the browser) • AI conversation data is stored in our own database, hosted in the EU, with Row Level Security ensuring only you can access your conversations • OpenAI is contractually restricted from using your data to train its models under our enterprise agreement • AI outputs are probabilistic and may be inaccurate; you remain responsible for validating outputs before acting on them We do not apply automated processing that produces legal or similarly significant effects solely by AI.
7. AI Transparency (EU AI Act)
We want you to know exactly when you are working with AI. The Vaizy assistant, along with AI insights and AI summaries shown across the platform, is an artificial intelligence system as defined by the EU AI Act (Regulation (EU) 2024/1689). What this means for you: • You are always told when content is generated by AI. AI features are labelled as such inside the product. • The assistant builds on a general-purpose AI model provided by OpenAI. The text it produces is generated, not retrieved from a verified source, and can be wrong. • Vaizy is the provider and deployer of this AI feature. OpenAI is the provider of the underlying model. • A person stays in charge. The assistant surfaces signals and answers questions. It does not make decisions about your projects, your budgets, or your team on its own. You decide what happens next. • The assistant is a general project management aid. It is not designed for, and must not be used for, decisions that produce legal or similarly significant effects on a person. If you have questions about how AI is used in Vaizy, contact hello@vaizy.com.
8. Data Sharing and Subprocessors
We share data only with trusted subprocessors necessary to operate the Service: OpenAI (AI assistant processing): US, with EU SCCs in place Hetzner Online GmbH (hosting and infrastructure, including our self-hosted database and authentication): EU region (Germany), via Coolify Scaleway SAS (encrypted backup storage): EU region (Paris, France) Bunny.net (content delivery network): EU, with global edge nodes Mollie B.V. (payment processing and subscription billing): EU region Lettermint (transactional and product email, sent via SMTP): EU region PostHog (product analytics and error tracking): EU region Featurebase (in-app Help Center, support, and changelog): EU, with EU SCCs where applicable hCaptcha by Intuition Machines, Inc. (bot protection at sign-up and login): US, with EU SCCs We run our database, authentication and real-time services ourselves, on open-source Supabase software on Hetzner servers. Supabase Inc. does not host or receive your data. On the vaizy.com marketing website only, and only with your consent, we also use Google (Analytics and Ads), HubSpot (CRM and website analytics), and Microsoft Clarity (session recordings and heatmaps) in the United States under EU Standard Contractual Clauses. Every cookie these set is listed in our Cookie Policy at vaizy.com/cookies. All subprocessors are bound by Data Processing Agreements and provide GDPR-compliant safeguards. The current subprocessor list is published at vaizy.com/subprocessors. For questions, contact hello@vaizy.com. AI apps and tools you connect yourself: Pro and Enterprise workspaces can connect AI apps such as Claude and ChatGPT through our MCP connector, and other tools through the automation API with a personal API key. AI connectors are off until a workspace owner or admin turns them on. A connected app acts as the person who connected it, sees only what that person can see in one workspace, and cannot delete anything. Team members' email addresses are never shared with a connected AI app. What an app reads leaves Vaizy and is handled by that app's vendor under its own terms, which may include processing outside the EU. These vendors are chosen by you or your organisation and are not our subprocessors. Deleting data in Vaizy does not delete it there. You can disconnect an app at any time in Settings > Connected apps, and revoke an API key in Settings > API keys.
9. International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), we rely on: • Standard Contractual Clauses (SCCs) as approved by the European Commission • Adequacy decisions where applicable • Additional technical safeguards (encryption in transit and at rest) where required This applies in particular to transfers to OpenAI and hCaptcha (Intuition Machines), located in the United States. Transfers to AI apps or tools you connect yourself are made at your direction and fall under that vendor's terms (see section 8).
10. Data Retention
• Account and profile data: retained while your account is active and for up to 90 days after deletion • Project and platform data: retained per your contract or until you request deletion • AI conversation data: retained in your account and deleted when you delete a conversation or your account • Security and authentication logs: retained for 30 to 180 days • Notifications in the app: kept until you delete them or your account is deleted • Connected apps and API keys: kept until you disconnect the app or revoke the key, or until your account or workspace is deleted • Billing records: retained as required by Dutch accounting law (7 years) You may request deletion of your data at any time by contacting hello@vaizy.com.
11. Security Measures
We implement the following technical and organisational measures: • TLS 1.2+ encryption for all data in transit • Encryption at rest for stored data and backups • Row Level Security (RLS) on all database tables. Users can only access their own data • Role-based access controls (RBAC) within the platform • Authentication via our self-hosted Supabase Auth with MFA support (TOTP) • Our own API keys and secrets stored in server-side environment variables only, never exposed to the browser • Your API keys, connector access tokens and provisioning tokens stored only as a one-way hash, and integration tokens encrypted and never sent to the browser • In Enterprise workspaces: required MFA for every member, single sign-on that can be enforced for verified domains, and automatic deprovisioning that signs a removed person out everywhere • Google or Microsoft sign-in is linked to an existing account only when you connect it yourself in Settings • Production safeguards to reduce accidental exposure and common misconfiguration risks • Server-side gateways used for AI and integration calls No system is completely immune to risk. We will notify you in the event of a breach as required by GDPR.
12. Your GDPR Rights
If you are located in the EEA, you have the right to: • Access the personal data we hold about you • Rectify inaccurate or incomplete data • Request erasure of your data ("right to be forgotten") • Restrict processing in certain circumstances • Object to processing based on legitimate interests • Data portability (receive your data in a structured, machine-readable format) • Withdraw consent at any time where processing is based on consent To exercise any of these rights, contact hello@vaizy.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
13. Data Breaches
In the event of a personal data breach, we will notify affected users and the relevant supervisory authority (Autoriteit Persoonsgegevens) without undue delay, and no later than 72 hours after becoming aware, as required by GDPR Article 33.
14. Children's Data
The Service is intended for business use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice on the Service, and update the "Last updated" date at the top of this page.
16. Contact
Vaizy B.V. hello@vaizy.com vaizy.com