legal

Privacy Policy

Last updated: 20 September 2026. This policy explains how Devleaps B.V. collects, uses and protects personal data on scan.devleaps.nl, in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch law. The devleaps.nl website has its own policy; this one covers the Scan application only.

Data Controller

The data controller responsible for this application is:

Devleaps B.V.
Bijlmermeerstraat 18A
2131 HG Hoofddorp
The Netherlands
KvK: 92729889
privacy@devleaps.nl

Where Your Data Is Hosted

This application and its database run on Scaleway, a European cloud provider, in the Amsterdam region (nl-ams). Data at rest stays in the European Union. Scaleway may keep infrastructure logs containing IP addresses for security and abuse prevention; we do not process those logs ourselves.

What Data We Collect

We collect the minimum data needed to run an assessment and return its report. We do not sell personal data.

3.1 Assessment answers

When you fill in a scan we store your answers to the statements, any notes you add, your name and role if you give them, and, for invited respondents, the email address the invitation was sent to. Answers are attributed to you so the report can show who answered what; the tech assessment's team survey is the exception, and is reported only in aggregate.

3.2 Public scans

The free public scan asks nothing personal until you choose to unlock the full report. At that point we store the name, work email, company and role you enter, and use the email to send you a verification link. That link opens your report only; it cannot sign you in to anything.

3.3 Accounts and sign-in

Devleaps staff and customer-portal users sign in with a link sent to their email address. We store the address and, for portal users, the customer organisation they belong to. Sign-in links are sent from our Microsoft 365 mailbox, so Microsoft processes the address for delivery.

3.4 Contact form

Enquiries from the landing page reach us by email through the same mailbox. We use them to respond and do not add you to a marketing list without your consent.

3.5 Automatically collected data

If you accept analytics cookies we collect behavioural data through Microsoft Clarity (section 5). Nothing is collected if you decline. Public forms may use Cloudflare Turnstile to tell people from bots; Turnstile processes a browser signal for that purpose only.

Cookies and Local Storage

Name	Type	Purpose	Duration
aiscan_session	Strictly necessary	Keeps you signed in after you use a sign-in link	12 hours
dl-cookie-consent	Strictly necessary	Stores your cookie preference so the banner is not shown on every visit	Persistent (localStorage, no expiry)
_clck, _clsk, CLID, ANONCHK, MR, MUID, SM	Analytics (optional)	Microsoft Clarity session recording and heatmap analytics	1 day to 1 year (see Clarity documentation)

Strictly necessary cookies do not require consent under Article 6(1)(f) GDPR and the Dutch Telecommunications Act (Telecommunicatiewet). Analytics cookies are only set after you actively accept them.

Microsoft Clarity

We use Microsoft Clarity, a behavioural analytics tool provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA). Clarity records mouse movements, clicks, scrolls and page navigation to generate heatmaps and session replays that help us improve the application.

Data transfers outside the EU: Microsoft may process data in the United States. Microsoft participates in the EU-US Data Privacy Framework and provides appropriate safeguards under Article 46 GDPR (standard contractual clauses). Clarity does not collect names or email addresses, and IP addresses are anonymised before storage.

Legal basis: Article 6(1)(a) GDPR, your consent.

AI-Generated Summaries

A Devleaps consultant can ask the application to write an executive summary or a plan of next steps for a report. When they do, the scores, answers and notes from that scan are sent to our AI provider, Orq.ai, to generate the text. This never happens automatically, and it is not available on the free public scan.

Legal Bases for Processing

Processing activity	Legal basis
Running an assessment for a customer	Art. 6(1)(b): performance of a contract
Public scan and emailed report	Art. 6(1)(b): steps at your request before a contract
Sign-in and session cookie	Art. 6(1)(f): legitimate interest in securing the application
Responding to enquiries	Art. 6(1)(b) or Art. 6(1)(f): legitimate interests
Analytics via Microsoft Clarity	Art. 6(1)(a): consent
Storing your cookie preference	Art. 6(1)(f): legitimate interests (to avoid repeated consent prompts)

Data Retention

Assessment data is kept for as long as the engagement with the customer runs, and removed when the customer asks us to. Public scans that were never unlocked, and the details left to unlock one, are removed on request at any time. Email correspondence is retained for as long as needed to resolve the enquiry and for up to two years thereafter, unless the law requires longer.

Microsoft Clarity session data is retained for 13 months from collection, in line with Microsoft's standard policy. Your cookie preference stays in your browser until you clear it or change it.

Your Rights Under GDPR

Right of access (Art. 15): request a copy of the personal data we hold about you.
Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
Right to restriction of processing (Art. 18): ask us to limit how we process your data in certain circumstances.
Right to data portability (Art. 20): where processing is based on consent or contract and automated, request your data in a structured, machine-readable format.
Right to object (Art. 21): object to processing based on legitimate interests.
Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@devleaps.nl. We respond within one month. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Manage Your Cookie Consent

You can change your analytics cookie preference at any time:

Third-Party Links

This application may link to external websites. We are not responsible for their privacy practices and encourage you to review their policies.

Changes to This Policy

We may update this policy from time to time. The date at the top always reflects the most recent revision. Material changes are announced with a notice in the application.