Privacy Policy

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Legal entity	InterIP Networks BV
Privacy contact	privacy@interip.nl
Platform	InterAIP.ai — https://interaip.ai

InterAIP.ai is an AI customer service platform. We process the following categories of data:

2.1 Chat widget visitors

Data	Purpose	Storage location
Chat messages (text)	Generate AI response, conversation history	Tenant database (isolated)
Session ID (anonymous)	Link conversation across pages	Tenant database + browser
Language preference	Response in the correct language	Tenant database
IP address	Fraud detection, rate limiting	Server logs (max. 7 days)
Consent timestamp	GDPR proof of consent	Tenant database

2.2 Registered customers

Data	Purpose
Email address, name	Account, authentication, transactional email
Company name, sector	Bot personalization, billing
Invoice data	Legal retention obligation (7 years)
API keys (encrypted)	Connection to cloud AI providers
Chat conversations, ticket data	Customer service history

2.3 What we do NOT process

Processing	Legal basis (GDPR art.)
Processing chat conversations	Consent (Art. 6(1)(a))
Account creation and management	Performance of contract (Art. 6(1)(b))
Billing and tax administration	Legal obligation (Art. 6(1)(c))
System security, fraud prevention	Legitimate interest (Art. 6(1)(f))
Provider switch to cloud (opt-in)	Explicit consent (Art. 6(1)(a) + Art. 49)

4.1 Local processing (default)

The platform is configured to preferably process chat messages using a local AI model (e.g. Ollama/Qwen on our own servers). In this case, your messages are not passed to any third party. Processing takes place exclusively within the EU/EEA.

4.2 Cloud processing (after explicit consent)

When the local AI model is temporarily unavailable, you will be notified and asked whether you wish to continue via an external cloud provider. We never automatically switch to a cloud provider without your consent.

If you consent to cloud processing, the following applies:

• Your messages are sent to the external provider for processing (inference).
• The provider processes your messages according to its own privacy policy and data processing agreement.
• Messages are not used for training models.
• Transfers outside the EU take place on the basis of SCCs (Art. 46 GDPR) or the EU-US Data Privacy Framework.

4.3 Fully local mode (optional)

Tenants can configure their chatbot for fully local mode. Conversations are then never forwarded to an external provider, even if the local model is offline.

4.4 Which cloud providers do we use?

Provider	Country	Transfer basis	Privacy policy
Anthropic (Claude)	US	SCC + Data Privacy Framework	anthropic.com/privacy
OpenAI-compatible providers	Depends on configuration	SCC / DPA per provider	Depends on configuration
Local Ollama models	EU (own servers)	n/a — no transfer	n.v.t.

Category	Retention period	Reason
Chat conversations (standard)	365 days	Customer service history, quality improvement
Chat conversations (no-log mode)	30 days	Minimal retention after visitor request
Account data (active)	While account exists + 30 days	Performance of contract
Invoice data	7 years	Legal retention obligation
Server logs (IP addresses)	7 days	Security and fraud detection
Audit log	2 years	Security, compliance
Password reset links	24 hours	Security

After the retention period expires, data is automatically permanently deleted or anonymized.

When you open the chat widget, you can indicate via the privacy settings that you do not wish any logging. In that case:

• Your messages are not used as a source for Q&A knowledge queries.
• Your conversation will be automatically and permanently deleted after 30 days.
• The conversation is temporarily stored during the session so the AI has context.
• Your choice applies to the current conversation. You can make a new choice for each conversation.

The no-log choice is stored as an anonymous session flag — we do not link it to a personal profile.

We share personal data with third parties only in the following cases:

• AI providers (processors): Only when you consent to cloud processing (§4.2). A data processing agreement is in place.
• Payment service providers: Payment processing; we only receive a payment confirmation, no card data.
• Hosting & infrastructure: Servers are located in the EU/EEA. No transfers outside the EEA without appropriate safeguards.
• Legal obligation: Upon lawful request from competent authorities.

International transfers to countries outside the EEA take place exclusively on the basis of:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (Art. 46(2)(c) GDPR), and/or
• The EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the provider is certified thereunder.

We take appropriate technical and organizational measures to protect personal data:

• Encryption of sensitive fields (API keys, passwords) with AES-256-GCM.
• HTTPS/TLS for all data transfers.
• Tenant isolation: each customer has their own database without access to other tenants.
• Access control with role-based permissions and two-factor authentication (2FA).
• Audit log of all administrator actions involving personal data.
• Regular backups stored encrypted.
• Rate limiting and brute force protection on all API endpoints.

Under the GDPR, you have the following rights:

We respond to requests within 30 days (Art. 12 GDPR). Complex requests may be extended once by 60 days.

You can request deletion of your personal data via:

1. Portal account: Go to Settings → Account → Delete Account. Your account, chat history and customer profile will be permanently deleted within 30 days.
2. By email: Send a request to privacy@interip.nl including your email address and (if known) your tenant ID or company name.
3. Chat conversations without account: Send the session ID or conversation ID (visible in your browser) to our privacy contact.

Note: data required for legal retention obligations (e.g. invoices) cannot be deleted before the legal period expires (Art. 17(3)(b) GDPR).

If you believe we are not processing your personal data in accordance with the GDPR, you can file a complaint with the Dutch Data Protection Authority:

• Website: autoriteitpersoonsgegevens.nl
• By phone: +31 70 888 8500

However, we kindly ask you to contact us first so we can resolve the issue.

For questions about this privacy policy or to exercise your rights, contact:

Email	privacy@interip.nl
Organization	InterIP Networks BV

This privacy policy was last updated on 16 april 2026. We reserve the right to amend this policy; material changes will be communicated at least 14 days in advance.