Skip to content

Privacy statement

This is a translation for your convenience. The Dutch version is the binding one: read it here.

Updated on 21 October 2026.

Who we are

Sirob is a service of Marketing Maatwerk (sole proprietorship of B.J.T. Kusters), Dutch Chamber of Commerce (KvK) number 91114551, established in Enschede, the Netherlands. Contact: support@sirobcrm.nl.

What Sirob does

Sirob is a CRM for businesses that keeps itself up to date: it reads the business email and calendar of our customers, keeps track of contacts, companies and tasks, and prepares draft replies that the user reviews before anything happens.

Two roles

For the data in our customers’ CRM we are the processor. The customer (the company that uses Sirob) is the controller of that data; we enter into a data processing agreement with every customer. Are you in the CRM of one of our customers and do you want access, rectification or erasure? Then contact that company; we assist them technically with this.

For accounts, invoicing and support we are the controller ourselves. The rest of this statement is about that.

Which data we process and why

  • Account: name, business email address, password (stored encrypted), two-factor authentication, optional profile photo. Legal basis: performance of a contract.
  • Usage and security: login times, IP address and actions in an audit log. Legal basis: legitimate interest (security and accountability). Retention period: 12 months.
  • Invoicing: company details, top-ups and usage; invoices via Moneybird, payments (once active) via Mollie. Legal basis: contract and statutory retention obligation (7 years).
  • Support: email to support@sirobcrm.nl. Retention period: 2 years after handling.

Email, calendar and AI (for users of the service)

  • Sirob reads the mailbox(es) and calendar(s) that your company itself connects. We use that content exclusively to provide the service, never for advertising and never to train AI models.
  • For classification, summaries and draft texts we use the API of Mistral AI (France, processing in the EU); Mistral does not retain this data and does not train on it.
  • To make documents in the knowledge base searchable, their text passes in pieces through the same API of Mistral AI; we search attachments from email by keyword only, on our own server.
  • By default, everything the AI proposes first goes through a human review within your company.
  • If your company turns on meeting notes, you can record a conversation or upload a recording. That is only allowed if everyone in the conversation knows about it and agrees; you confirm that beforehand. The audio goes encrypted to Mistral AI in the EU for transcription and is erased immediately afterwards, after 24 hours at the latest. The meeting notes only enter the CRM after you have reviewed them. Contacts who have objected to AI processing are never included. If someone requests erasure of their data, the meeting notes of conversations they are linked to are removed as well.

Google user data

If you connect a Google calendar, Sirob uses the Google Calendar API exclusively to: (1) show your appointments in the app, (2) suggest free time slots in draft replies and (3) create or change appointments that you (or your administrator, after explicit configuration) approve. The use and transfer of information received from Google follows the Google API Services User Data Policy, including the Limited Use requirements: we do not use this data for advertising, do not resell it and humans do not read it, except with your consent, for security or if the law requires it. We store access tokens encrypted (AES-256-GCM); you can remove the connection at any time in Sirob or via your Google account settings.

AI and Google data: Google user data is never used to train or improve AI models, not by us and not by third parties. The only information derived from Google Calendar that our AI processor (Mistral AI, EU) receives is available time slots, derived from free/busy information, in order to suggest a time for an appointment in a draft reply. Raw calendar items (titles, descriptions, invitees) never leave Sirob for an AI service; Mistral is contractually bound not to use supplied data for model training. Affirmative statement: “The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is never used to create, train, or improve AI/ML models.”

This website

Besides the service itself, this website processes a small amount of data. This is separate from the service, and it is deliberately kept to a minimum.

  • The application form. I only use the data you fill in (name, company, email address, phone number and website if given, and your message) to contact you about your application. It is stored on this website and emailed to my own address. Legal basis: your request for contact. Retention period: two years after the last contact, after which I delete it.
  • Visitor statistics without cookies. I measure how many people view the page, how far they scroll and which buttons they click. No cookie is placed and no IP addresses or browser details are kept. Instead, a code is stored that changes every day and cannot be traced back to a person. Nothing goes to Google or any other external party; the figures are on my own server. Legal basis: legitimate interest in seeing whether the site works.
  • No advertising trackers. This site does not load advertising or social media trackers.

If you book an appointment using the calendar button, that goes through Google Calendar. Google’s privacy policy applies to that step.

Who we share data with

Only with parties that are necessary to provide the service: Hetzner (hosting, Germany), Mistral AI (AI, France), our Dutch email provider (system and support email), Mollie (payments) and Moneybird (invoicing). We share the current list of sub-processors with their transfer mechanisms along with the data processing agreement and on request. We never sell data.

Security

A separate database per customer, encrypted connections, encrypted storage of connection data, mandatory two-factor authentication for admins, audit logging and daily encrypted backups (retained for 14 days).

Retention and erasure

Your data is retained for as long as your account exists. On cancellation we erase all data within 30 days; backups are then automatically rotated out within 14 days. On request we provide an export first.

Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability. Email support@sirobcrm.nl; we respond within 30 days. You can also lodge complaints with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

In the event of substantive changes we inform account holders by email and adjust the date at the top.