Privacy, in plain language.
This page describes what the site and the contact pipeline actually do. If the code changes what it stores, this page changes with it.
Last updated 14 October 2026
One · Controller
Who is responsible
fyzno, a digital infrastructure studio established in the Netherlands, is the controller for all personal data described on this page. For anything privacy-related, write to info@fyzno.com with the word Privacy in the subject line. The person who runs the infrastructure is the person who answers that mail.
GDPR art. 4(7), 24Two · The brief
What the brief form collects
When you send the written brief on /brief we store what the form shows: your name, email address, organisation (optional), the project and scale you picked, and the brief itself. The server adds the time of receipt, your IP address and your browser's user-agent string. The record is appended to a ledger file on our own server, and a copy goes to our own mailbox so we can reply. There is no profiling, scoring or enrichment of any kind. The withdrawal form on /legal/withdraw works the same way: it stores your name, email address, the contract you name, the optional date and message, the time of receipt, your IP address and user-agent, and emails a confirmation to you. We keep withdrawals with the contract records they belong to (see section Six).
Three · Other ways to reach us
Email, phone and WhatsApp
Email you send us lands on our own mail server and is kept as long as the conversation it belongs to (see section Six). The phone line is described in section Eight. If you choose to message us on WhatsApp, that conversation also passes through WhatsApp, which is run by Meta. Meta processes those messages as a controller in its own right under its own privacy policy; we only see what you send us there. If you would rather keep Meta out of it, use email or the brief form.
Four · Free checks
The mail, web and DNS checks
The free checks on /health take a domain name and test it from our network: we query public DNS, fetch the site's own pages and policies, open a connection to the mail servers it names, and look the sending server up on public block lists. The domain and the report are not stored. As with every request, the web server log records your IP address and the time, under the rules in section Five.
Five · Server logs
What the web server logs
The nginx reverse proxy in front of the site keeps standard access logs: IP address, requested path, timestamp, response code and user-agent. The application writes structured event logs (via systemd's journal) that include an IP address on form events such as a rate-limit trip or a rejected submission. Both exist to keep the service secure and to find faults, and both are rotated and deleted after at most thirty days. The rate limiter keys on IP and email address, holds each key for a sliding sixty-minute window in memory, and never writes it to disk.
GDPR art. 6(1)(f)Six · Legal bases and retention
Why we may hold it, and for how long
The brief and our reply: steps taken at your request before a contract, GDPR art. 6(1)(b), kept no longer than twenty-four months after our last exchange, sooner on request. Server logs and rate limiting: our legitimate interest in keeping a public service safe and diagnosable, art. 6(1)(f), at most thirty days in logs and sixty minutes in memory. Invoices and contract records once you are a client: our legal obligation under Dutch tax law, art. 6(1)(c), seven years as the fiscal retention duty requires (Algemene wet inzake rijksbelastingen, art. 52). We do not rely on consent for any of this; where consent would ever be needed, we ask first.
GDPR art. 5(1)(e)Seven · Location
Where it lives
Everything runs on our own server, on hardware we own and operate in Drenthe, the Netherlands. No hosting company processes your data for us, and we use no sub-processors. Backups are made daily to local disks on the same site and kept for 30 days, so erased data is gone from them within 30 days. An off-site backup is being set up; this section will say where it lives before it holds any data. We sell or trade data to no one, and we transfer no personal data outside the European Economic Area. Domain names we register for clients are registered in our own name through our registrar, so your personal details are not passed on for that. TLS certificates come from Let's Encrypt; a certificate contains domain names, not your personal details.
Eight · The phone line
Calls, recordings and the AI that answers
Calls to our line are answered by a voice agent that we run ourselves: speech-to-text, a language model and text-to-speech, all on our own servers in the EU. The call itself is carried by telecom providers: CheapConnect on our side, and your own provider on yours. You are told at the start of the call that you are speaking with an AI system and that the call may be recorded. We record calls for quality assurance, security and safety, store a transcript only when the call needs one, and delete recordings and transcripts after at most ninety days. Nothing from a call is ever used to train a model, ours or anyone else's. The legal basis is your request to speak with us (GDPR art. 6(1)(b)) and our legitimate interest in a safe, reliable line (art. 6(1)(f)). Ask for a person and we will call you back.
GDPR art. 6(1)(b), (f)Nine · Cookies and storage
No cookies. Actually none.
This site sets no cookies: no analytics, no advertising, no fingerprinting, no third-party embeds. Our Content-Security-Policy blocks requests to other origins outright, and fonts are served from our own domain. Your browser's own storage on your device is used for exactly two things, and nothing in it is ever sent to us. Spot the Phish saves which days you played and whether you got them right, in local storage, so the inbox and your streak survive a reload; it stays until you clear it with the button below or clear the site data for fyzno.com. When you press "Fix this for me" after the domain check on the home page, the findings travel to the brief form in session storage, which your browser empties when you close the tab. Both exist only to give you a feature you asked for, so the Telecommunicatiewet (art. 11.7a) asks for no consent banner, which is why you don't see one.
Ten · Decisions
No automated decisions about you
We make no decisions about you by automated means alone, and we do no profiling. Every brief, request and complaint is read and answered by a person. The AI on the phone line takes your request; it does not decide anything about you.
GDPR art. 22Eleven · Your rights
Access, correction, erasure, the lot
You can ask at any time for access to the data we hold on you, a correction, erasure, restriction of processing or a portable copy, and you can object to processing based on our legitimate interest. Write to info@fyzno.com. We answer within one month (GDPR art. 12(3)) and may ask you to confirm who you are before releasing anything. If you think we handled your data badly, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to fix it first, but that is your call.
GDPR art. 15-21, 77Twelve · Security
How it is protected
Transport is TLS-only, with HSTS set for two years. Replies we write to you are S/MIME-signed so you can check they really come from us; automatic confirmations, such as the one the withdrawal form sends, are not signed. The form endpoint validates and length-caps every field, rejects cross-origin posts and rate-limits per IP and per email. The server is patched weekly, signing keys sit behind restricted file permissions, and only the person who answers briefs can read the ledger. If a breach ever affects your data, we tell you as quickly as we can and aim to do so within 48 hours, and we report it to the Autoriteit Persoonsgegevens within 72 hours where the law requires. No security is absolute; ours is small, documented and described honestly here.
Thirteen · Changes and contact
When this page changes
If we start collecting something new, or keep something longer, this page changes before the practice does, and the date at the top moves. Questions, requests and complaints go to info@fyzno.com with the subject Privacy. We reply as soon as we reasonably can, and in any case within the one month that the GDPR allows.
full termsAnnex · Sub-processors
Everyone who can touch your data
The complete list, not a representative sample. Mail is run by us on the same machine, so there is no mail provider on it; there is no analytics vendor, no CDN, and no font host, because the site loads nothing from another origin. The machine itself is our own hardware, so there is no hosting company either. Any entry added here is engaged under a GDPR art. 28 processing agreement and processes inside the EEA.
None. No third party processes personal data on our behalf.
A signed copy of our data processing agreement, and notice before anything is added to this list, comes with an engagement. Ask for either at info@fyzno.com.
To exercise a right, or just to ask what we hold on you, write to info@fyzno.com. A signed reply comes back the same day as a rule, within 48 hours at most.
Payment, renewal and liability live in the terms. Where the two documents touch data, this one governs.