Privacy Policy

Version 20 — effective 13 October 2026.

This Privacy Policy explains how 7Lab B.V., Danzigerbocht 39 G, 1013 AM Amsterdam, The Netherlands (Chamber of Commerce 84815515) ("7Lab", "we") processes personal data as controller when you visit sluis.ai, create an account, or otherwise interact with us. Sluis is a product of 7Lab B.V. You can reach us at info@sevenlab.ai.

Important scope note. Content your organisation sends through the Sluis gateway or Sluis Workspace (prompts, documents, model responses, "Customer Content") is processed by 7Lab as processor on behalf of your organisation, under the Data Processing Agreement between 7Lab and that organisation, not under this policy. The same applies to request metadata that attributes usage to individual users in your organisation's audit trail: 7Lab also processes it for your organisation under the Data Processing Agreement, in addition to our own use of it described below as controller (metering, security, the tamper-evident audit trail, and operating and supporting the Service as described in §2). Questions about Customer Content should go to the organisation that operates your account.

1. What we collect

Account and profile data (when you sign up or are invited): email address, password hash (we never store your password itself) or Google, Apple or Microsoft sign-in identity, full name, phone number, job title, organisation name, country, company size, VAT number (for an EU VAT number from outside the Netherlands, with the result of its verification in the EU VIES system), role and organisation memberships, language preference, and, if you enable two-factor authentication, passkey public keys.

Sign-up attribution: when you create an account, we store with it which campaign brought you. This is the utm_* values (source, medium, campaign, content, term) of the sign-up link you followed on our website. Only if you accepted the marketing cookies, it also includes the advertising click identifiers in the URL you first landed on (LinkedIn li_fat_id, Meta fbclid, X twclid) and the utm_* values of that first visit, which the website keeps in your browser's local storage (sluis_ft) until you decline or withdraw consent. We use it only to measure which campaigns produced accounts; it is visible to 7Lab operators and, as the sign-up source and campaign only, in our CRM (see "Customer relationship record" below).

Billing data (when your organisation activates a paid plan): billing and invoice email addresses, payment method type and mandate reference from our payment provider, charge and invoice history, and the VAT details we process for invoicing (country, VAT number and the result of its verification in the EU VIES system). We never receive or store full card numbers or bank credentials; those go directly to Mollie B.V.

Usage and security data: sign-in timestamps, IP addresses on security-relevant events (sign-up, sign-in, legal-document acceptance), operator audit events (who changed what setting, when), request metadata (model, provider, region, token counts, cost) for metering and the tamper-evident audit trail, and technical logs needed to run and secure the Service.

App activity: for each signed-in user and organisation, which Sluis app you opened (web Console, web Workspace, macOS, Windows, Linux, iOS or Android), on which day (UTC), and the app version. The app reports this when you open it and hourly while it is visible; we keep one record per user, organisation, app and day. It is linked to your account, not anonymised. 7Lab operators can see it, and in the operator Users list it appears as your last activity (sign-in, request or app open) and the apps you used in the last 30 days. It is stored only in the Service's own databases (hosted by Scaleway, see §3) and is not shared with anyone else, apart from the usage summary in the customer relationship record below.

Customer relationship record: for each organisation account whose owner has verified their email address, and for its members, we keep a record in our customer relationship management (CRM) system, Attio (see §3). It holds the organisation's name and web domain (taken from the owner's email address); each member's name, email address and role; when the account and each member were created, whether the email address was verified and when each member was last active; the plan (trial, paid or manual) and a status we derive from the plan, payments and activity (trial, active, churned or removed); the amounts paid in total and in the last 30 days (never payment details); a usage summary (date of the first request, last activity, number of requests in the last 7 and 30 days and in total, number of members); and the sign-up source and campaign (see "Sign-up attribution" above; the click identifiers themselves are not copied, but when only a click identifier tells us where you came from, the source names that network: LinkedIn, Meta or X). If the sign-up carried no campaign values, the campaign is the one of our own outreach that we matched your email address or company domain to. We link the record to the person and company record we may already hold from our own outreach, or create one, and may add a note about the new sign-up to an open sales deal. Internal and test accounts are left out. Access is limited to 7Lab staff. Request content is never part of it.

Contact data: what you send us through the contact and DPA-request forms or by email.

Local storage: the marketing site and Console store your language choice (sluis_lang) and session token in your browser's local storage, and the marketing site stores your cookie choice (sluis_consent) and, only if you accepted the marketing cookies, the campaign values of your first visit (sluis_ft, see "Sign-up attribution" in this section). The Console, Sluis Workspace and the API use no advertising trackers and no third-party analytics; fonts are self-hosted, so your visit is not disclosed to a fonts CDN.

Marketing website analytics and advertising measurement (only with your consent): on the marketing website (sluis.ai, including its documentation and legal pages; not the Console, Sluis Workspace or the API), we load the tools below only after you accept them in the cookie banner (the "Accept" button, or the analytics and advertising switch under "Settings" followed by "Save"). The banner is only a short summary; this section is the full list of the tools, the events they receive and what they store. If you choose "Reject" or make no choice, none of them is loaded.

Apollo.io (visitor identification). We load the Apollo.io website tracker. The tracker stores a visitor identifier in your browser's local storage and collects your IP address, the pages you view, the referring page, and browser and device information. It may also load a script from LiveIntent that sets cookies and matches your browser to a hashed (pseudonymised) email address known to LiveIntent, which it passes to Apollo.io. Apollo.io uses this to identify the company you visit from and, where a match exists, you. If you reject or make no choice, the tracker is not loaded; if you withdraw consent, we stop it and remove the identifiers it stored in your browser.

Advertising measurement. To measure our advertising, we load the tags we have switched on, out of the Google tag (Google Ads and, where set up, Google Analytics), the Meta Pixel, the Reddit Pixel, the LinkedIn Insight Tag and the X Pixel. Each one stores identifiers in your browser (cookies on sluis.ai and, for some, on the vendor's own domain) and sends the vendor your IP address, the pages you view, the referring page, browser and device information, the time, and these events: a contact request was sent, a sign-up button was clicked, a download button was clicked, the button to book a call with us was clicked on our landing pages, a call with us was booked (you reach our confirmation page after booking), an account was created (you reach our confirmation page after creating an account). They do not carry what you type in a form or your email address. The Google tag starts with all its consent signals (advertising storage, advertising user data, advertising personalisation and analytics storage) denied and sets them to granted only after you accept. Each vendor processes this data to provide the measurement to us and, under its own terms and privacy policy, for its own purposes, such as delivering and measuring ads, building audiences and security; we do not control that use. Withdrawing consent stops the tags and removes the identifiers they stored on sluis.ai; identifiers a vendor stores on its own domain (for example facebook.com or linkedin.com) you can only clear in your browser settings.

Website analytics (Google Analytics 4). If we have set up Google Analytics, the Google tag also measures how the website is used and how fast it loads, so we can improve it. It receives the page you view (address and title), the referring page, your approximate location, browser and device information, the time, the events above, and for each page view three loading-speed measurements (largest contentful paint, interaction to next paint and layout shift) with the page address. Google Analytics stores a pseudonymous visitor identifier in cookies on sluis.ai (_ga, _ga_*) and does not store your IP address. We do not turn on Google signals, so Google does not link this data to your Google account. Our Google Analytics data is stored in the European Union and deleted after 14 months. Nothing is measured before you accept; withdrawing consent stops the measurement and removes those cookies.

Business contacts we already hold, matched to advertising audiences (data we did not get from you). If you work at a company in the Netherlands, Belgium, Luxembourg, Germany, France, the United Kingdom or Ireland and we already hold your business contact data (from our CRM, from outbound contact lists, from bookings or from your replies), we use your name, work email address, job title, company and country to match you to advertising audiences on LinkedIn and Meta, so that we can show you B2B ads and keep customers, people who asked not to be contacted and people who replied negatively out of those ads. Where a data provider has one, we add a SHA-256 hash of an alternative (private) email address of the same person. We find it through Clay (Clay Labs Inc., United States, our processor) and its data providers Limadata (hashed email addresses) and Icypeas (LinkedIn profile lookup): first by your work email address and, where that gives nothing, by your name and company domain to find your LinkedIn profile URL, and then by that URL. The URL is only a lookup key. We never receive or see the alternative email address itself, only its hash. We send LinkedIn and Meta only SHA-256 hashes of email addresses, not your name, job title, company or country; we use those details ourselves to decide who is included. This data therefore comes from these providers and not from you. We tell you this within one month of obtaining it, by email, in our outbound emails and in this policy (Art. 14 GDPR).

2. Why we process it (purposes and legal bases)

We do not use your personal data for automated decision-making with legal effect, and we do not sell it.

3. Who receives it

• Mollie B.V. (Amsterdam, NL): payment processing for paid plans.
• European Commission (VIES; only for a VAT number from an EU country other than the Netherlands): confirms that the VAT number is valid, which the reverse charge on our invoices requires.
• Scaleway SAS (Paris, FR): EU cloud infrastructure hosting the Service and its databases.
• Scaleway SAS (Paris, FR; fr-par): verification, security and invoice emails through its Transactional Email service.
• Google Ireland Limited (for Google accounts in the EEA or Switzerland; otherwise the entity identified in your Google terms; only if you choose "Sign in with Google"): it processes the sign-in under its own terms; we receive your email address and a subject identifier.
• Apple Distribution International Ltd. (Ireland; only if you choose "Sign in with Apple"): it processes the sign-in under its own terms; we receive an email address (which may be an Apple private-relay address) and a subject identifier.
• Microsoft Ireland Operations Limited (for Microsoft Entra work or school accounts in the EEA; otherwise the Microsoft entity your organisation contracts with; only if you choose "Continue with Microsoft"): it processes the sign-in under its own terms and those of your organisation's Microsoft tenant; we receive your email address, your directory (tenant) identifier and your user object identifier.
• ZenLeads, Inc., trading as Apollo.io (United States; only if you accept the cookie banner on the marketing website): website visitor identification and marketing analytics.
• LiveIntent, Inc. (United States; only if you accept the cookie banner on the marketing website, through the Apollo.io tracker): matching your browser to a hashed email address for Apollo.io's visitor identification, under its own privacy policy.
• Google Ireland Limited (for visitors in the EEA or Switzerland; otherwise Google LLC, United States; only if you accept the cookie banner on the marketing website and we have switched the Google tag on): advertising measurement with Google Ads and, where set up, Google Analytics, under Google's terms and privacy policy.
• Meta Platforms Ireland Limited (Dublin; with Meta Platforms, Inc., United States; only if you accept the cookie banner and we have switched the Meta Pixel on): advertising measurement and ad delivery, under Meta's Business Tools Terms and privacy policy.
• Reddit, Inc. (United States; only if you accept the cookie banner and we have switched the Reddit Pixel on): advertising measurement, under Reddit's business terms and privacy policy.
• LinkedIn Ireland Unlimited Company (Dublin; with LinkedIn Corporation, United States; only if you accept the cookie banner and we have switched the LinkedIn Insight Tag on): advertising measurement, under LinkedIn's terms and privacy policy.
• X Internet Unlimited Company (Dublin; with X Corp., United States; only if you accept the cookie banner and we have switched the X Pixel on): advertising measurement, under X's terms and privacy policy.
• Clay Labs Inc. (United States), with its data providers Limadata (hashed email addresses) and Icypeas (LinkedIn profile lookup): our processor for finding the hash of an alternative email address of business contacts we already hold (§1). Clay receives work email address, name and company domain.
• LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited (Dublin): customer-list matching for advertising audiences. They receive hashes of email addresses only (work and alternative email) and match them to their members, under their customer-list terms.
• Attio Limited (London, United Kingdom; its affiliate Attio Inc. in the United States may assist): our customer relationship management (CRM) system, as our processor under Attio's Data Processing Addendum. It holds the customer relationship record described in §1. Attio automatically enriches person and company records, using the email address or web domain, through its own data providers (FullContact and Clearbit, United States, under Standard Contractual Clauses and the UK Addendum); this cannot be switched off in our workspace.
• Competent authorities where the law requires disclosure.

We do not transfer account data outside the EEA in the ordinary course. The one exception is the customer relationship record kept with Attio (United Kingdom, covered by the EU adequacy decision for the United Kingdom). Attio engages sub-processors outside the UK and the EEA, including in the United States, under Standard Contractual Clauses and the UK Addendum, as listed in its Data Processing Addendum. Marketing website analytics and advertising measurement data collected with your consent is transferred to Apollo.io, LiveIntent, Google, Meta, Reddit, LinkedIn and X in the United States under the EU-US Data Privacy Framework where the recipient is certified (Google LLC, Meta Platforms, Inc., Reddit, Inc., LinkedIn Corporation and X Corp. are), otherwise Standard Contractual Clauses. If another transfer becomes necessary, we use an adequacy decision or Standard Contractual Clauses. (Model Providers your organisation enables receive Customer Content, not your account data; that is governed by the DPA and, for non-EU providers, the International Transfer Terms your organisation acknowledged.)

Business contact data sent to Clay for advertising audience matching is processed in the United States under the Standard Contractual Clauses in Clay's data processing agreement.

4. How long we keep it

• Account and profile data: for the life of the account and up to 12 months after closure, then deleted or anonymised.
• Billing records and invoices: 7 years (Dutch fiscal retention law).
• Legal-document acceptance records: for the life of the account plus the applicable limitation period, as evidence that the contract was concluded (Art. 17(3)(e) GDPR).
• Operator audit events and request metadata: for the life of the account plus the applicable limitation period (append-only records needed for billing integrity and as compliance evidence); other security logs up to 12 months, longer only where needed for an ongoing investigation.
• Which Sluis app each user opened, per day, with its version: 12 months (365 days), then deleted by the daily automatic purge; also erased when your organisation is erased.
• Marketing website analytics (Apollo.io, with your consent): up to 12 months after the last visit, then deleted. Your cookie choice stays in your browser until you change it via "Cookie settings" or clear your browser storage.
• Website analytics (Google Analytics, with your consent): 14 months, then deleted automatically by Google Analytics.
• Advertising measurement (Google, Meta, Reddit, LinkedIn and X, with your consent): the cookies the tags set expire as each vendor defines; the data the vendors hold is kept under their own policies and the settings of our accounts with them, not by 7Lab.
• Sign-up attribution (campaign values and, with consent, ad click identifiers): for the life of the account, as part of the account record.
• Account setup and getting-started emails: the date on which each was sent, for the life of the account, as part of the account record.
• Customer relationship record in our CRM (account contact data, plan and amounts paid, usage summary, sign-up source and campaign): for the life of the account and up to 12 months after closure, then deleted by an automatic daily job. Contact and company records we already held before your sign-up, or that are linked to a sales deal, are not part of that deletion.
• Prompt and response content retained for your organisation (Customer Content, processed under the DPA): 30 days by default, configurable per organisation. In Sluis Workspace, personal values in conversations are replaced by placeholders after 7 days by default, and conversation history is kept according to your organisation's setting. A daily automatic purge enforces these periods.
• Contact correspondence: up to 24 months after resolution.
• Advertising audience matching (§1): we replace the audience lists every week, and we delete the hashes of alternative email addresses within 90 days of obtaining them. One entry on our do-not-contact list removes your work email address and the hash from all audiences at the next weekly run.

5. Your rights

You have the right to access, rectify, erase, and receive a copy of your personal data, to restrict or object to processing based on legitimate interest, and to withdraw consent where processing is based on consent. Every account setup and getting-started email carries a link to stop those emails; it does not affect verification, security or invoice emails. Write to info@sevenlab.ai; we respond within one month. You can object at any time to the use of your data for advertising audience matching (§1); because that is direct marketing, the objection is absolute and we stop. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority of your place of residence.

6. Security

We apply the measures described in the DPA's technical-and-organisational annex to all systems, including encryption in transit and at rest for sensitive stores, envelope encryption of credentials, per-tenant isolation, tamper-evident audit chains, and role-based access with mandatory re-verification on every administrative request.

7. Google Workspace and Microsoft 365 mail and calendar

This section applies if a member of your organisation chooses to connect their Google Workspace (Gmail, Google Calendar) or Microsoft 365 (Outlook, Outlook Calendar) mailbox and calendar to Sluis Workspace. The connection is optional, belongs to one member, and exists only after that member agrees on the consent screen. A member may connect several accounts, each with its own consent. Your organisation decides whether it is available and at which level; Sluis Workspace tells the member what is shared before the Google or Microsoft consent screen opens.

What we access. Depending on the level your organisation set:

• Mail, read: message headers (subject, sender, recipients, dates), snippets and message bodies, and attachment names, types and sizes, of the messages the assistant looks up for the member. Not attachment contents.
• Mail, drafts (and send): in addition, the right to create drafts and, for Google, the Gmail compose permission, which Google defines to include sending. Sluis Workspace never sends a message by itself: a draft is saved only after the member confirms it, and sending is a separate click by the member.
• Calendar, read: events (title, time, location, organiser, attendees and their replies, a short preview of the description, online meeting link) and free/busy times.
• Calendar, write: in addition, creating, changing and answering events, each only after the member confirms.
• Account data: the email address and domain of the connected account, to check that it belongs to your organisation.

Google scopes: gmail.readonly, gmail.compose, calendar.events.readonly, calendar.events and calendar.freebusy; Microsoft scopes: Mail.Read, Mail.ReadWrite, Mail.Send, Calendars.Read and Calendars.ReadWrite. We request only those the chosen level needs.

Why. Only to provide the features the member asks for: searching and reading mail, checking availability, drafting replies and managing events. We do not use this data for advertising, do not sell it, and do not use it for credit decisions or lending. We do not use it to create, train or improve AI models other than for the member's own requests.

Where it goes. Access and refresh tokens are stored encrypted (envelope encryption). When the member asks the assistant something, the data it fetches is returned to that conversation: it is kept in the member's chat history and in any canvas (such as an email document) created from it, encrypted, for as long as your organisation's retention settings keep them (§4). Connecting and disconnecting, and every message sent, are recorded in your organisation's audit trail. In Sluis Workspace we are processor for this content under the Data Processing Agreement (see the scope note at the top).

Who receives it. To produce the answer the member asked for, the fetched content is sent to the AI model provider(s) your organisation has enabled for Sluis Workspace, under the Data Processing Agreement, after your organisation's data protection rules have been applied. Each provider acts as our sub-processor, bound by obligations no less protective than the Data Processing Agreement, and we do not authorise any provider to use this content to train models. We do not transfer it to anyone else, except where needed for security or abuse prevention, to comply with law, or in a merger or acquisition with your prior consent.

Human access. No one at 7Lab reads this data, unless the member gives explicit consent for a specific case, it is needed for security, or the law requires it.

Your control. A member can disconnect any account at any time in Sluis Workspace under Settings, Connections (the member's other accounts stay connected): we delete that account's stored tokens and ask Google to revoke its grant (a Microsoft grant is removed in the member's Microsoft account settings under "My Apps"; Google grants can also be removed at myaccount.google.com/permissions). Mail and calendar content already in chat history or canvases stays until the member deletes the conversation or canvas, or your organisation's retention or erasure removes it. Your organisation can end access for all members by turning the connection off. Write to info@sevenlab.ai for deletion requests.

Limited Use. Sluis's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft data is handled under the same commitments.

8. Changes

We may update this policy; each version carries a version number and effective date. Material changes are announced in the Console and require acknowledgment before continued use. This document is drafted in English; the English version is the binding one.