Privacy Policy

1. Introduction

This Privacy Policy explains how Collabhouse B.V. ("Collabhouse", "we", "us", "our") collects, uses, stores, shares, and protects your personal data when you use the Collabhouse Go platform, including our website, web application, and any related services (together, the "Services").

Collabhouse B.V. is a Dutch company with its registered office at Koninginneweg 9, 1217 KP Hilversum, The Netherlands, registered with the Dutch Chamber of Commerce under number 76143120. We act as the data controller for all personal data processed through the Services.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. We may update this policy from time to time. Any changes will be posted on this page with an updated "Last updated" date.

2. What Data We Collect

We collect the following categories of personal data:

2.1 Data You Provide Directly

• Waitlist registration: First name, last name, and email address when you sign up for the Collabhouse Go waitlist.
• Account information: When creating a user account, we collect your name, email address, and any additional profile information you choose to provide.
• Communications: Any information you provide when contacting us via email or through our support channels.
• Subscription and conversion data: When you start a checkout, start a trial, make your first payment or request cancellation, or when your subscription ends, we record that event together with your plan, the amount and currency, your Stripe customer ID and the contact details linked to your account (email address, phone number if you provided one, first and last name). At checkout we also store the cookie choices you made and, depending on those choices, your browser's cookie and click identifiers and IP address with your subscription at our payment provider Stripe, so that we can report the later events correctly. If you already have a subscription, we do the same when you make or change a cookie choice while signed in; the identifiers and IP address are only added if you accepted marketing cookies.

2.2 Data Collected Automatically

• Usage data: Pages visited, features used, interactions with the platform, and session duration.
• Device information: Browser type (user agent), operating system, screen resolution, and device identifiers.
• Cookie and click identifiers: With your consent, identifiers set by analytics and advertising cookies or passed in ad links, such as the Google Analytics client and session ID, _fbp/_fbc, gclid/gbraid/wbraid, ttclid and _ttp.
• IP address: Used for approximate geolocation, security, and analytics purposes.
• Cookies and tracking technologies: See Section 5 for detailed information about cookies we use.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing the Services: To operate, maintain, and improve the Collabhouse Go platform.
• Waitlist management: To manage your registration, send verification emails, and notify you about platform updates and launch information.
• Communication: To respond to your inquiries, send service-related notices, and provide customer support.
• Analytics: To understand how our Services are used, identify trends, and improve user experience.
• Marketing: With your consent, to send promotional communications, to measure and attribute our advertising campaigns, to optimise our ads, to build audiences that we exclude from our ads (for example, so we don't show ads to existing subscribers or to people who cancelled), and for reporting on cancellations (churn).
• Legal compliance: To comply with applicable laws, regulations, and legal processes.
• Security: To detect, prevent, and address fraud, abuse, and security issues.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR:

• Consent (Art. 6(1)(a) GDPR): For marketing communications, non-essential cookies, and sharing your data with advertising and analytics platforms through server-side tagging (see Section 5.3). You can withdraw consent at any time.
• Contract performance (Art. 6(1)(b) GDPR): To provide the Services you have requested, including waitlist registration and account management.
• Legitimate interest (Art. 6(1)(f) GDPR): For analytics, security, and improving our Services, provided our interests do not override your fundamental rights.
• Legal obligation (Art. 6(1)(c) GDPR): To comply with applicable laws and regulations.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyse usage, and support our marketing efforts. You can manage your cookie preferences at any time using the cookie settings on our website.

5.1 Cookie Categories

5.2 Managing Cookies

When you first visit our website, a cookie consent banner allows you to accept or reject non-essential cookies. Your cookie choice applies to both www.collabhouse.com and go.collabhouse.com, and you can change it at any time via the cookie settings (the Collabhouse app has its own setting under Settings → Privacy). You can also configure your browser to block or delete cookies, though this may affect the functionality of some Services.

5.3 Server-Side Tagging

Our website (www.collabhouse.com) and web app (go.collabhouse.com) load Google Tag Manager through our own subdomain tagging.collabhouse.com. That endpoint and our server-side tagging container are operated on our behalf by AdPage (trytagging), a Dutch company acting as our processor, and are configured for us by our marketing agency TNG. This does not change your cookie choices: tags still only run in line with the consent you gave.

When you start a checkout, start a trial, make your first payment or request cancellation, or when your subscription ends, our servers send that event to our server-side tagging container, which forwards it to Google Analytics 4, Google Ads, Meta (Facebook and Instagram, via the Conversions API) and TikTok. Some of these events are also sent directly from our servers to Google Analytics 4 and the Meta Conversions API. Depending on your consent, an event can contain your email address, phone number, first and last name, Stripe customer ID, IP address, your browser's user agent, cookie and click identifiers (the Google Analytics client and session ID, _fbp and _fbc, gclid, gbraid and wbraid, ttclid and _ttp), and the subscription event, plan, amount and currency. It does not contain your payment card or bank details.

Before your email address, phone number and name are sent to Meta and Google, they are hashed: converted into a code that does not directly reveal the original value. These platforms use that code to match the event to an account they already know (this is called advanced matching or enhanced conversions). Hashed data is still personal data.

This sharing is based on your consent. Your contact details, IP address and advertising identifiers are only included if you accepted marketing cookies. If you only accepted analytics cookies, the event only contains analytics data for Google Analytics 4. You can change or withdraw your consent at any time via the cookie settings.

6. Data Sharing and Third Parties

We may share your personal data with the following categories of recipients:

• Service providers: Third-party companies that help us operate the Services, including hosting providers, email services, analytics platforms, and AdPage (trytagging), which operates our server-side tagging. These providers process data on our behalf and are contractually bound to protect your data.
• Advertising partners: Google (Google Analytics 4 and Google Ads), Meta (Facebook and Instagram, including the Conversions API) and TikTok, for advertising measurement, retargeting and excluding existing customers from ads, subject to your consent. These platforms act as independent controllers for their own use of the data.
• Legal requirements: When required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

We do not sell your personal data to third parties.

7. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions by the European Commission; or
• Other legally recognised transfer mechanisms.

Google, Meta and TikTok may process the data we share with them outside the EEA, including in the United States. For recipients certified under the EU-U.S. Data Privacy Framework, these transfers rely on the European Commission's adequacy decision for that framework. Otherwise, they rely on the Standard Contractual Clauses approved by the European Commission.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Waitlist data: Until you request removal or your account is created upon platform launch.
• Account data: For the duration of your account and for a reasonable period thereafter to comply with legal obligations.
• Analytics data: Aggregated and anonymised analytics data may be retained indefinitely.
• Marketing data: Until you withdraw consent or unsubscribe.
• Data shared with advertising platforms: Data we send to Google, Meta and TikTok is kept by those platforms according to their own retention policies. See their privacy pages for details. AdPage processes these events only on our behalf, to forward them to these platforms.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can request correction of inaccurate or incomplete data.
• Right to erasure: You can request deletion of your personal data ("right to be forgotten").
• Right to restrict processing: You can request that we limit how we use your data.
• Right to data portability: You can request your data in a structured, commonly used, and machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@collabhouse.com.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL);
• Secure hosting infrastructure;
• Access controls and authentication mechanisms;
• Regular security assessments and monitoring.

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

11. Children's Privacy

The Services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Collabhouse B.V.
• Koninginneweg 9
• 1217 KP Hilversum
• The Netherlands
• Email: privacy@collabhouse.com