Privacy statement
What you enter in the calculators stays on your own device. Below you can read exactly which data we do process, why and for how long.
Translation. This is an English translation of our privacyverklaring. If the two differ, the Dutch version is binding.
Translation of the Dutch version of 29 september 2026.
In short
- What you enter in the calculators stays on your own device. We do not receive it.
- Client data of offices does not reach our server. ToeslagBuddy Pro checks the list in the browser. We only receive aggregated counts per organisation.
- We do process data of Pro accounts and of messages you send us. That data is stored in the EU.
- No tracking cookies. No third-party scripts run on the Pro and admin pages.
Who are we?
ToeslagBuddy is responsible for processing personal data on this website, as described in this privacy statement.
- Name: ToeslagBuddy
- Place of business: to follow
- Chamber of Commerce (KvK) number: to follow
- VAT identification number: to follow
- Email: info@toeslagbuddy.nl
- Privacy questions: privacy@toeslagbuddy.nl
- Report a security problem: security@toeslagbuddy.nl
Which data, why and for how long?
| Part | Which data | Why (purpose and legal basis) | Who helps us (where) | How long |
|---|---|---|---|---|
| Calculators and allowances check | What you enter: income, rent, assets, children and age | Making the calculation | Nobody. The calculation happens on your own device. We do not receive this data | Not with us |
| Allowance guard for the self-employed | Your saved checks (profit, income, date) | Your own overview, only if you click ‘Bewaar’ (save) | Nobody. It is only stored in your own browser | Until you delete it |
| Client list in ToeslagBuddy Pro | The client data an office loads | The check for the office | Nobody. The check runs in the office’s browser. The office itself is responsible for this data | Not with us |
| Counts per Pro check | Per organisation: a band for the number of clients (1–9, 10–49, 50–199 or 200+), the number of signals per type (numbers below 5 as ‘fewer than 5’), amounts only with 10 or more clients and rounded to € 500, the version of the calculation rules and the date. Also which account did the check | Reports and trends for your organisation. Legal basis: contract (Art. 6(1)(b) GDPR) | Supabase (database in Frankfurt, Germany) | As long as the organisation exists. After cancellation 12 more months, then deleted |
| Pro account | Name, business email address, organisation, KvK number (optional), number of clients (optional), role, trial or subscription status, log-in times | Providing your account and subscription. Legal basis: contract (b) | Supabase (Frankfurt) | As long as your account exists. An expired trial without a subscription: 90 days. An account without an organisation: 30 days after the trial ends. Invoices: 7 years (legal retention obligation) |
| Log-in code by email | Email address and time | Logging in safely without a password. Legal basis: contract (b) | Supabase and Brevo (Sendinblue SAS, France) for sending | Sending log up to 90 days |
| Audit log | Which account did what (invite, change role, extend, delete) and when | Security and accountability to your organisation. Legal basis: legitimate interest (f) | Supabase (Frankfurt) | 365 days |
| Messages through our forms (contact, pilot, subscription, waiting list) | Name, email address, organisation, phone number (optional) and your message | Answering your question or arranging a pilot or subscription. Legal basis: contract or steps before a contract (b), otherwise legitimate interest (f) | Supabase (Frankfurt) and Brevo (France), which forwards the message to our mailbox | In the database 90 days. In our mailbox as long as needed to handle your question, up to 12 months, unless it leads to a customer relationship |
| Email to info@, privacy@ or security@ | Your email address and your message | Answering your question. Legal basis: legitimate interest (f) | Our email provider (forwarding to our mailbox) | Up to 12 months, unless it leads to a customer relationship |
| Visiting the website (hosting) | IP address, requested page, browser and time in the server log | Keeping the website running safely. Legal basis: legitimate interest (f) | GitHub Pages (GitHub Inc., United States). GitHub is covered by the EU-US Data Privacy Framework. | Decided by the hosting provider; we do not use these logs |
| Visitor statistics | – | We currently do not use statistics | – | – |
| Advertising | – | We currently do not show third-party adverts | – | – |
Storage on your own device
We do not use tracking cookies. Some parts do store something in your browser’s storage (localStorage). This is needed to make those parts work, so we do not ask for permission. It stays on your device.
- Allowance guard: your saved checks, only if you click ‘Bewaar’ (save). Delete them with ‘Alles wissen’ (delete all).
- Pro log-in: your session, so you stay logged in. Removed when you log out.
- Pro checks: the exact trend of your own checks and counts that still need to be sent. Per user, removed when you log out.
- Pro demo: a trial account that only exists in this browser.
Reading aloud and videos
The read-aloud button and the explanation by a persona only use a voice that runs on your own device. If there is none, you only see the subtitles. That way no text with your amounts goes to a speech service. The AI videos (Dutch only) were made in advance with HeyGen. Your data does not go to HeyGen: your personal amounts are only in the subtitles on your own device.
Partner links
Some links to comparison websites are partner links. If you click one and sign up for something, we may receive a fee. You do not pay anything extra. After you click, the privacy rules of that website apply.
Data outside the EU
Our database is in the EU (Frankfurt). Supabase is an American company, so the standard contractual clauses of the European Commission apply. GitHub (hosting of the website) is covered by the EU-US Data Privacy Framework. We never sell your data and we do not use it for profiling or automated decisions.
Client data of offices
Do you use ToeslagBuddy Pro as a financial administrator, budget coach or debt counsellor? Then you remain responsible for your clients’ data. The check runs in your own browser. Columns with a name, BSN, date of birth, address, IBAN, email address or phone number are removed automatically. Because client data does not reach our server, we are not a processor for it. More detail is in the beveiligingsfactsheet (in Dutch).
Your rights
You may ask us:
- which data we hold about you (access), and for a copy;
- to correct or complete your data;
- to delete your data;
- to do less with your data (restriction);
- to give you your data in a file, so you can use it elsewhere (portability).
Do we use your data on the basis of legitimate interest? Then you may object. Did you give consent? Then you can always withdraw it.
Do you have a Pro account? Then you can download your data and delete your account yourself in your environment. You can also email us: privacy@toeslagbuddy.nl, in English or Dutch. We reply within one month. Sometimes we ask you to show that the data is yours.
Complaint? Please tell us first, so we can look for a solution together. You may also always complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Security and data breaches
We protect data with appropriate measures, such as encrypted connections, strict access rules in the database and two-factor authentication for administrators. If something does go wrong, we report a data breach to the Autoriteit Persoonsgegevens within 72 hours where required, and we inform you if the risk to you is high.
Changes
If anything changes in how we handle data, we update this statement. The date of the latest version is at the top. For major changes affecting Pro customers, we send a message in advance.