Who we are
Model Relay is a service of Gijs Rommers, handelend onder de naam GIR-IT (eenmanszaak), registered office at Ooievaarstraat 24, 3920 Lommel, Belgium, enterprise number 1034.062.065. For privacy questions, email gijs@gir-it.be.
This policy follows the General Data Protection Regulation (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Two roles, two kinds of data
Model Relay plays two different roles. Which one applies to you depends on who you are.
| You are | Our role | What that means |
|---|---|---|
| A business or web agency with a Model Relay account | Controller | We decide why and how we process your account and payment data. This policy describes that. |
| A visitor using the chat on a business’s website | Processor, on behalf of that business | The business decides why your question or message is processed and is your first point of contact. We process the data only on its instructions, under a data processing agreement. |
Which data we process and why
If you have an account
- Data: name, email address, a secure hash of your password, and session data such as the IP address and browser you signed in with. If you choose Google sign-in, we receive your Google account ID, name, email address and optional profile picture to sign you in or create an account.
- Why: to give you a workspace, sign you in, keep your account secure and email you when a website nears its monthly limit, your balance runs low or credits were added automatically. You can turn those emails off in your workspace settings.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
If you buy credits
- Data: your billing details (company or full name, invoice email address, address, country and any VAT number), amount, date, payment status and payment reference. We check a VAT number with the European Commission’s VIES register. You give your payment details (such as card or bank details) directly to Mollie. We don’t see or store them.
- Why: to process payments, track your credit and issue invoices.
- Legal basis: performance of the contract and our legal accounting obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
If your website is imported
- Data: the public pages of your website that you have imported, with title, text, links and images.
- Why: so the assistant can answer from the pages you have not excluded.
- Legal basis: performance of the contract. If those pages contain personal data, you decide as controller whether it may remain there.
If you are a visitor asking a question
- Data: your question and the earlier messages in the conversation, sent with each request to understand the context. We do not retain conversation content. We do count, per day, how many questions are asked and answered, on which topic and with which pages, without the question itself, and delete those counts after at most 12 months. If the assistant could not answer your question, we keep that one question for at most 30 days, without email addresses, phone numbers, links, account numbers, street addresses, long numbers and names you introduce yourself with, as far as we recognise them. For abuse prevention and cost management, we record that a question was asked using a key derived from your IP address with a secret value. Your IP address cannot be read directly from that key.
- Why: to answer your question, protect the system from overload and show the business which information its website is missing.
- Legal basis: the business whose website you use has a legitimate interest in answering visitors (Art. 6(1)(f) GDPR).
- Tip: don’t include sensitive or unnecessary personal data, such as health information, in your question.
- Improving Model Relay: we also use the counts and the cleaned unanswered questions to improve Model Relay, including testing and training AI models. We are responsible for that ourselves, based on our legitimate interest in building a reliable assistant (Art. 6(1)(f) GDPR). We do not use full conversations for this, because we do not keep them. Questions containing health or other sensitive data are excluded as soon as we recognise them. You can object to this use through the contact details below.
If you leave a message through the chat
- Data: the name, email address and message you enter. The preceding conversation is not included.
- Why: so the business’s team can reply to you.
- Legal basis: the business has a legitimate interest in answering you, or takes a step you asked for before entering into a contract (Art. 6(1)(f) or 6(1)(b) GDPR).
- Who sees it: we email the message to the business. We do not keep a copy in the Model Relay database or an inbox. The business decides how long it retains the received email.
If you visit our website or email us
- Website: we use no tracking or advertising cookies and no analytics software. Our hosting provider processes technical data such as your IP address in server logs to deliver and secure the site (Art. 6(1)(f) GDPR). The contact form uses Cloudflare Turnstile to limit spam. Cloudflare processes technical browser signals and your IP address for this purpose (Art. 6(1)(f) GDPR).
- Email: if you email us, we use your details to reply (Art. 6(1)(f) or 6(1)(b) GDPR).
An AI assistant, not a person
Visitors can always see they are talking to an AI assistant, as European transparency rules for AI require. The assistant relies on pages from the business’s website and shows its source. It can still be wrong: check important matters such as prices or appointments with the business itself. The assistant makes no decisions with legal effect for you and does not profile anyone automatically.
Who we share data with
We don’t sell personal data and don’t use it for advertising. We work with a small number of service providers who only do what we instruct:
| Party | For what | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, search index storage, running AI models and sending email notifications, contact-form spam protection through Turnstile | Global network; parent company in the United States |
| Mollie B.V. | Payments and invoices. Mollie creates and emails our invoices using your billing details. Mollie is itself the controller of the payment details you give it. | The Netherlands |
In addition, the business whose website you use and, on its behalf, its web agency can see its own visitors’ data. We may disclose data to authorities and courts where the law requires it.
Transfers outside the European Economic Area
Cloudflare is a US company and processes data on a global network. For transfers outside the EEA we rely on the appropriate safeguards provided by the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. On request we can give you a copy or more information.
How long we keep data
- Account and workspace: for as long as your account exists. When the agreement ends we delete or return the data, except what we must keep by law.
- Payment and invoice data: seven years, as Belgian accounting law requires (Art. III.88 of the Code of Economic Law).
- Messages left through the chat: we forward them directly by email without retaining them in our database. The business determines retention in its own mailbox.
- Conversations with the assistant: not retained and not included in contact emails. Topic counts contain no question text and are deleted after at most 12 months. Unanswered questions are deleted after at most 30 days, or earlier by the business.
- Technical logs: as briefly as needed for security and operation of the service.
Security
We protect data with encrypted connections (HTTPS), restricted access, securely stored passwords, checks on where requests come from and limits against abuse. Nothing is ever one hundred percent secure. If we discover a personal data breach, we take the necessary steps and report it where the law requires.
Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, object to processing based on legitimate interest, and receive your data in a usable format. If you gave consent, you can withdraw it at any time.
Email us at gijs@gir-it.be. We reply within one month. Sometimes we first ask you to confirm your identity. If your question concerns a message you left through a business’s chat, please contact that business first: it is the controller. We help it answer your request.
Making a complaint
Not happy with our answer? You can lodge a complaint with the Belgian supervisory authority: Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD), Drukpersstraat 35, 1000 Brussel, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be. You can also go to the competent court.
Children
Model Relay is aimed at professionals. The chat on a business’s website can be used by anyone, but we don’t knowingly collect personal data from children under 13, the age from which young people in Belgium can give consent themselves.
Changes
If we change this policy materially, we’ll announce it in the workspace or by email. The date at the top shows when it was last updated.