Privacy Policy

Last updated: 27 April 2026

1. Who we are

Stanzeo is operated by WeSDeC BV, a company incorporated under Belgian law.

2. What data we collect

Account data

When you create an account we collect your name and email address. If you sign in via Google, we receive these from Google OAuth. If you use magic-link login, we collect your email address only.

Content data

The talks, cards, titles, speaker notes, and any other material you create within Stanzeo ("Your Content").

AI interaction data

When you use AI features (card generation, critique, text suggestions), the relevant card text and context is transmitted to our AI provider (see Section 5) to generate responses. The output is stored as part of Your Content.

Usage data

AI Credits consumed, features used, and timestamps of activity. Used for billing, quota enforcement, and service improvement.

Technical data

IP address, browser type, device type, and session identifiers collected automatically when you access the service.

3. Legal basis for processing (GDPR Art. 6)

Purpose	Legal basis
Operating the service (account, storage, AI features, billing)	Contract performance — Art. 6(1)(b)
Security monitoring, fraud prevention, service analytics	Legitimate interests — Art. 6(1)(f)
Retaining billing records	Legal obligation — Art. 6(1)(c)
Marketing communications	Consent — Art. 6(1)(a) — only when explicitly opted in

4. How we use your data

To operate and improve the Stanzeo platform
To authenticate you and manage your account
To provide AI-assisted features (talk generation, critique)
To enforce AI Credits quotas and plan limits
To process payments and manage your subscription
To send transactional emails (account confirmation, magic-link login)
To detect and prevent fraud or misuse

5. Third-party data processors

We share data with the following processors under appropriate data processing agreements:

Processor	Purpose	Data location	Transfer mechanism
Anthropic, Inc.	AI content generation (Claude API)	USA	Standard Contractual Clauses (SCCs)
Vercel, Inc.	Web hosting, CDN, and privacy-friendly pageview analytics	Europe (EU region)	EU-based processing — no transfer
Neon, Inc.	Database hosting	Europe (EU region)	EU-based processing — no transfer
Resend, Inc.	Transactional email delivery	USA	Standard Contractual Clauses (SCCs)
Google LLC	OAuth authentication	USA	Standard Contractual Clauses (SCCs)
Stripe, Inc.	Payment processing	USA	Standard Contractual Clauses (SCCs)

Note on Anthropic: When you use AI features, the text of your cards and relevant context is transmitted to Anthropic's Claude API for processing. Anthropic processes this data under their API Terms of Service and Privacy Policy. We transmit only the content required for AI generation — we do not send your name or email address to Anthropic.

6. Data retention

Data type	Retention period
Account and content data	Until you delete your account; deleted within 30 days of closure, removed from backups within 90 days
Billing records	7 years (Belgian accounting law — Wetboek van economisch recht)
Technical and usage logs	90 days

7. Your rights under GDPR

Access (Art. 15): Request a copy of the personal data we hold about you.
Rectification (Art. 16): Request correction of inaccurate data.
Erasure (Art. 17): Request deletion of your personal data. You can also delete your account directly from User Settings.
Restriction (Art. 18): Request that we limit processing in certain circumstances.
Portability (Art. 20): Receive your data in a structured, machine-readable format.
Objection (Art. 21): Object to processing based on legitimate interests.

To exercise any right, email legal@stanzeo.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Belgian Data Protection Authority:

Gegevensbeschermingsautoriteit / Autorité de protection des données

Drukpersstraat 35, 1000 Brussels

www.gegevensbeschermingsautoriteit.be

contact@apd-gba.be

8. Cookies

Stanzeo uses only strictly necessary cookies:

Session cookie: Maintains your login session. Essential for the service to function; does not require consent under the ePrivacy Directive.
Authentication tokens: Short-lived tokens to verify your identity.

We do not use advertising, tracking, or analytics cookies. If we introduce non-essential cookies in future, we will update this policy and request your consent beforehand.

9. Changes to this policy

We will notify you by email at least 30 days before any material changes to this Privacy Policy take effect. The "Last updated" date at the top of this page reflects the most recent version.

10. Contact

WeSDeC BV

Vincent Bavaisstraat 43, 2540 Hove, Belgium

legal@stanzeo.com

11. Data controller

Data controller:

WeSDeC BV

Vincent Bavaisstraat 43

2540 Hove, Belgium

VAT: BE0684.650.348

Email: legal@stanzeo.com