01Who we are
NotAPerson.ai is a trade name of Great Ideas Comm.V., a Belgian limited partnership. For the personal data described in this policy, Great Ideas Comm.V. is the controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
Great Ideas Comm.V.Sauvegardestraat 20, 2870 Puurs-Sint-Amands, Belgium
Enterprise number / VAT: BE 0534.888.187
Email: hello@notaperson.ai
We are a small agency and have not appointed a data protection officer. Questions about privacy go to the email address above.
02What we collect
| Source | Data |
|---|---|
| You contact us | Name, email address, company, job title and whatever you choose to write in your message. |
| You become a client | Contact details of your contact people, billing details (company name, address, VAT number), contracts, invoices and project correspondence. |
| You visit this website | Our host, Cloudflare, processes technical data such as your IP address, browser type and requested pages to deliver the site and protect it against abuse. We do not use this to profile you. |
We do not knowingly collect data from children, and we do not ask for special categories of data (such as health data). Please don't send them to us.
03Why, and on what basis
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Answering your questions and preparing quotes | Steps at your request before a contract (6.1.b) or our legitimate interest in responding to business enquiries (6.1.f) |
| Delivering our services and managing the client relationship | Performance of a contract (6.1.b) |
| Invoicing, bookkeeping and tax | Legal obligation (6.1.c) |
| Keeping the website secure and available | Legitimate interest (6.1.f) |
| Occasional updates to existing business contacts about similar services | Legitimate interest (6.1.f). You can opt out at any time with a single reply. |
We do not sell your data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
04Client project data
When we build automations or AI agents for a client, we often handle data that belongs to that client and its customers or staff. For that data the client is the controller and we act as a processor under article 28 GDPR. We:
- process it only on the client's documented instructions and only for the agreed project;
- sign a data processing agreement before any personal data is shared with us;
- keep it confidential and limit access to the people working on the project;
- never use it to train AI models, ours or anyone else's;
- return or delete it at the end of the engagement, unless the law requires us to keep it.
If you are a customer or employee of one of our clients, please contact that client first about your data. We will help them answer you.
05AI providers
Our work relies on third-party AI models (for example language, image and video models). When a project requires sending data to such a model, we:
- agree the choice of provider with the client beforehand;
- use business or API terms under which inputs are not used to train the provider's models, where the provider offers them;
- send only the data the task needs, and remove or pseudonymise personal data where we can.
We do not paste your personal data into consumer AI chat apps.
06Our Facebook & Instagram app
We run a Meta app that uses Facebook Login to publish content to Facebook Pages and Instagram professional accounts that we manage, our own or a client's with their permission. It is a publishing tool for those accounts and is not offered to the public.
What the app accesses
| Permission | Why |
|---|---|
public_profile | To identify the person who logs in, by name and Facebook ID. |
pages_show_list, business_management | To list the Pages and business assets the person who logs in manages, so they can choose where to publish. |
pages_manage_posts, pages_read_engagement | To publish and schedule posts and reels on those Pages, and to read back their status. |
instagram_basic, instagram_content_publish | To find the Instagram professional account linked to a Page and publish photos, carousels and reels to it. |
How we use and store it
- We use this data only to publish and schedule content that the account owner has approved, and to check whether a post went out.
- We store the access tokens and account IDs locally, on our own device, in a file only our account can read. Posts waiting to be published are kept in the same place. Nothing is stored on a public server.
- We do not collect data about followers or other users, do not read private messages, and do not sell, share or use Meta platform data for advertising, profiling or AI training.
- We follow the Meta Platform Terms and Developer Policies.
Deleting your data
You can remove the app at any time under Facebook Settings & privacy → Settings → Business integrations, which revokes its access straight away. To have us delete the tokens and data we stored, follow the steps on our data deletion page.
07Who we share with
We share personal data only with service providers we need to run the business, each bound by confidentiality and, where they act as processors, by a data processing agreement:
- website hosting and security (Cloudflare);
- email, file storage and productivity tools;
- our accountant and accounting software, for invoicing and tax;
- AI and automation providers, as described above, for client projects;
- authorities, where the law requires it.
08Transfers outside the EEA
Some providers are based in, or have access from, countries outside the European Economic Area, such as the United States. We only use them where the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework) or by the European Commission's standard contractual clauses, with extra safeguards where needed.
09How long we keep it
- Enquiries that do not lead to a project: up to 2 years after our last contact.
- Client and contract data: for the duration of the relationship and up to 10 years after it ends, the limitation period for contractual claims under Belgian law.
- Invoices and accounting records: 10 years, as Belgian accounting and tax law requires.
- Client project data: as agreed in the data processing agreement, and deleted or returned at the end of the project.
- Website logs: as kept by Cloudflare for security purposes, usually a few days.
10Security
We protect data with measures that suit a small agency handling business data: encrypted connections, two-factor authentication on our accounts, credentials kept in a secrets manager rather than in code or documents, least-privilege access for automations, and backups. No system is perfectly secure; if a breach affects your data and is likely to put you at risk, we will tell you and, where required, the supervisory authority within 72 hours.
11Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased, where we have no legal reason to keep it;
- restrict processing, or object to processing based on our legitimate interest (including direct marketing, at any time and without giving a reason);
- receive data you provided in a portable format;
- withdraw consent, where processing is based on consent.
Email hello@notaperson.ai. We answer within one month and may ask you to confirm your identity. Exercising your rights is free.
If you think we have handled your data wrongly, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be. We'd appreciate the chance to fix it first.
12Cookies
This website sets no cookies for analytics, advertising or tracking, and loads no third-party scripts or fonts. Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to tell people from bots. Because it is strictly necessary, it does not need your consent, and that is why you have not seen a cookie banner.
13Changes
We may update this policy when our services or the law change. The date at the top shows the latest version. If a change matters for clients, we will let them know directly.