Legal
Privacy Policy
What personal data Stylaform processes, why, on what legal basis, who receives it and how long it is kept.
- Version
- 1.0
- Effective
- 18 August 2026
- Last updated
- 18 August 2026
This Privacy Policy explains how Turtle Works B.V., trading as Stylaform (Hesselereind 1, 5469 AS Erp, The Netherlands, Chamber of Commerce 97568929), processes personal data in connection with the Stylaform service.
Stylaform is a business service. Most personal data we handle relates to the people who use Workspaces, rather than to the general public.
1. Controller and processor roles
Stylaform acts as controller for personal data it needs in order to run its own business: account administration, authentication, Workspace administration, billing, fraud prevention, security, support, service communications, service improvement, operational analytics and legal compliance.
Stylaform acts as processor for Customer Personal Data: personal data contained in Workspace content, uploaded assets, submitted website content, AI Input, AI Output and other data a business customer manages inside its Workspace. For that data the business customer is the controller and decides the purposes. The Data Processing Agreement governs that processing.
Controller contact for the controller role: stylaform@turtleworks.nl. No Data Protection Officer has been appointed; privacy questions are handled at this address.
2. Categories of personal data
- Account information: name, email address, profile details, language and interface preferences.
- Authentication information: password hashes, magic link tokens, sign-in identifiers from Google or Apple, session tokens and sign-in timestamps.
- Workspace data: workspace name, membership, roles, invitations and permissions.
- Brand content: brand names, directions, colours, typography, rules, notes, versions and structured brand data.
- Uploaded files and assets: logos, images, fonts and documents, together with their metadata.
- Submitted URLs and website data: domains and URLs submitted for analysis or monitoring, and the publicly accessible page content retrieved from them.
- Website crawl and sweep results: extracted tokens, findings, scores and history. Crawl results can incidentally contain personal data published on the analysed site.
- AI Input and AI Output: the content sent to and returned from AI Features.
- Usage information: features used, actions taken, credit consumption and metering records.
- Security logs: sign-in attempts, IP address, user agent, rate-limit events and suspicious activity.
- Audit logs: sensitive actions such as locking a version, changing roles, claiming a domain and deleting content.
- Billing information: plan, subscription status, invoices, VAT details, payment status and the payment identifiers held by our payment provider. We do not store full card numbers.
- Support communications: emails and their content.
- Technical metadata: device, browser, approximate location derived from IP, timestamps and error diagnostics.
- Cookies and local storage: as described in the Cookie Policy.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the Service, including brands, sweeps, monitoring, AI Features and exports | Account, workspace, brand, asset, URL, crawl, AI and usage data | Performance of a contract, Art. 6(1)(b); legitimate interests where the user is not the contracting party, Art. 6(1)(f) |
| Account creation, authentication and access control | Account and authentication data | Performance of a contract, Art. 6(1)(b) |
| Billing, credit metering, invoicing and tax records | Billing, plan and usage data | Performance of a contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Security, abuse prevention, rate limiting and fraud prevention | Security logs, audit logs, technical metadata | Legitimate interests in a secure service, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
| Support and service communications | Account data, support communications, diagnostic data | Performance of a contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Service improvement and operational analytics on aggregated or pseudonymised data | Usage and error data | Legitimate interests in improving the Service, Art. 6(1)(f) |
| Legal compliance, defending claims and responding to authorities | Any relevant data | Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f) |
| Optional cookies or storage that are not strictly necessary, if introduced | Device and usage data | Consent, Art. 6(1)(a) |
Where we rely on legitimate interests, we have weighed those interests against the rights and freedoms of the individuals concerned.
4. AI processing
AI Features send the relevant brand context, submitted content and instructions to our AI provider in order to generate or analyse brand information. AI Input and AI Output are stored in the Workspace and logged for a limited period for support, abuse investigation, billing and troubleshooting. Access by our personnel to those logs is limited to what is necessary and is restricted to support and abuse cases.
Customer Content is not used by Stylaform to train general-purpose AI models. We instruct our AI providers on a no-training basis for content submitted through the Service, in line with their enterprise API terms.
AI Features do not carry out automated decision-making that produces legal effects or similarly significant effects on individuals. AI Output is advisory and a human decides whether to accept, lock or publish it.
5. Website analysis and monitoring
When a User submits a domain or URL, we fetch publicly accessible pages of that site, render them and analyse them. We respect robots.txt, apply rate limits and do not store screenshots. We do not crawl authentication-protected pages.
Retrieved page content may incidentally contain personal data published on the site, such as names in team pages or contact details. That content is processed on behalf of the Customer that submitted the site, and the Customer is responsible for having the authority to submit it.
6. Recipients and Subprocessors
We share personal data with service providers that help us run Stylaform: hosting, database and storage, authentication, payment processing, transactional email, content delivery and AI processing. Each provider acts on our instructions under a data processing agreement. The current list, with services, locations and transfer mechanisms, is published on the Subprocessor List page.
We may also disclose data to advisers, auditors or authorities where legally required, and to an acquirer in the context of a reorganisation or transfer of the business. We do not sell personal data.
7. International transfers
Some providers process data outside the European Economic Area, in particular in the United States. Where that happens, we rely on an adequacy decision where one applies, such as the EU-US Data Privacy Framework for certified providers, and otherwise on the European Commission's Standard Contractual Clauses combined with supplementary technical and organisational measures such as encryption in transit and access controls.
The Subprocessor List states the processing location and the transfer mechanism for each provider. A copy of the safeguards can be requested at stylaform@turtleworks.nl.
8. Retention
We keep personal data no longer than necessary for the purposes described above. The following periods apply:
| Data | Retention |
|---|---|
| Account data | for as long as the account exists, and erased within 30 days of account deletion |
| Workspaces and their content after deletion | 30 days in a soft-deleted state after deletion, then erased |
| Security logs | 12 months |
| Audit logs | 12 months |
| Website scan, sweep and monitoring results | 12 months |
| AI request logs | 90 days |
| Support communications | 24 months after the last message in the conversation |
| Invoices and billing records | 7 years, as required by Dutch tax law |
| Backups | 30 days on a rolling basis |
Users can delete their own account, and Workspace Owners can delete a Workspace. Deletion first places the data in a soft-deleted state for the period stated above, after which it is erased from live systems. Copies present in encrypted backups are removed as those backups rotate.
These periods are our published policy. Automated enforcement of some of them is being rolled out; until that is complete we apply them through operational deletion.
9. Your rights
Under the GDPR you can request access to your personal data, correction, erasure, restriction of processing, data portability, and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting prior processing.
Requests can be sent to stylaform@turtleworks.nl. We respond within one month and may ask for information to verify identity. Where the data sits inside a business customer's Workspace, we act as processor: we will refer the request to that customer and assist them in answering it.
You can also lodge a complaint with a supervisory authority, in the Netherlands the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ The Hague, the Netherlands.
10. Security
We apply appropriate technical and organisational measures, including encryption in transit, database-level access control that isolates Workspaces, server-side authorisation on every request, private storage for uploaded assets with time-limited access links, brute-force protection, rate limiting and audit logging of sensitive actions. Access by our personnel is limited to what is necessary for operating and supporting the Service.
No system is completely secure. If a personal data breach occurs, we assess it without undue delay and notify the supervisory authority and affected customers where the GDPR requires it.
11. Children
The Service is intended for business use and is not directed at children. Accounts may only be created by individuals aged 16 or older. We do not knowingly process data of children below that age; if we learn that we have, we delete it.
12. Changes and contact
This Privacy Policy may be updated. Each version carries a version number and an effective date. Material changes are announced by email or in the application.
Questions: stylaform@turtleworks.nl. Postal address: Turtle Works B.V., Hesselereind 1, 5469 AS Erp, The Netherlands.
Version history
- v1.0 - 18 August 2026 - First published version.