Privacy Policy

Effective date: October 16, 2026. This Privacy Policy explains what personal data WebFyndr collects, how and why we use it, who we share it with, how long we keep it and which rights you have.

1. Who we are

WebFyndr is a trade name of TimeFyndr, based in Heemskerk, the Netherlands. WebFyndr is the controller for the personal data collected through this website and our services.

• WebFyndr (trade name of TimeFyndr)
• Heemskerk, the Netherlands
• Email: info@webfyndr.com

2. Scope and applicable law

This policy applies to our website, our email communication, our forms and the other online services we offer. Because WebFyndr is a Dutch company, we process personal data in accordance with:

• the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679);
• the Dutch GDPR Implementation Act (Uitvoeringswet AVG);
• the ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC);
• the Dutch Telecommunications Act (Telecommunicatiewet).

These rules apply to the data we process regardless of where you are located.

3. What personal data we collect

3.1 Data you provide to us

• Free AI visibility scan form: your name, email address, company name, website, phone number (optional), city and the description you enter.
• Booking a call: the details you enter in Calendly, such as your name, email address, the chosen time and any answers to booking questions. If you start from our homepage form, your name and email address are pre-filled in the Calendly link.
• Correspondence: the content of emails and other messages you send us, and notes from calls and video calls.
• Client and contract data: contact details, company details, proposals, agreements, project information and the access details you share so we can perform our services.
• Billing data: invoicing details and payment records. We do not store full card details; payments are handled by banks or payment service providers.
• Audit data: information collected while preparing a free AI visibility scan or analysis of your business.

3.2 Data collected automatically

When you visit the website, your browser automatically sends technical data to the services that deliver the site: your IP address, browser type and version, language, operating system, the page requested, the referring page and the time of the request. This happens through Cloudflare (hosting and content delivery), Google Fonts (fonts) and jsDelivr (animation scripts). We do not use this data to build profiles of visitors.

We also measure how the website is used with PostHog, as described in section 5: the pages you view, the buttons and links you click, the referring website, your device type and browser. If you accept cookies, PostHog can also record your session (mouse movements, scrolling and clicks) so we can see where the site is unclear. Everything you type into forms is masked in these recordings and the content of forms is never sent to PostHog.

4. Why we use your data and on what legal basis

Data	Purpose	Legal basis (GDPR Art. 6)	Retention
Scan form data	Preparing and sending your free AI visibility scan and following up on it	Consent and legitimate interest (6(1)(a) and (f))	1 year after last contact if you do not become a client
Emails, messages and booking details	Answering questions, scheduling and holding calls	Legitimate interest (6(1)(f))	2 years after last contact for non-clients
Client and contract data	Performing our services (SEO, GEO, AI visibility, automation)	Performance of a contract (6(1)(b))	Duration of the relationship plus 7 years
Invoices and financial records	Billing, payment processing and bookkeeping	Legal obligation (6(1)(c)), Dutch tax and accounting law	7 years from the date of issue
Website analytics (PostHog)	Measuring and improving how the website is used	Consent (6(1)(a)) for cookies and session recordings; legitimate interest (6(1)(f)) for cookieless visit counts	Up to 12 months for analytics events; up to 90 days for session recordings
Technical and log data	Delivering the website securely, preventing fraud, spam and abuse	Legitimate interest (6(1)(f))	30–90 days for server logs
Security incident records	Investigation and compliance	Legitimate interest and legal obligation (6(1)(f) and (c))	3 years

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before it. Where we rely on legitimate interest, we have weighed our interest against your privacy and you have the right to object (see section 10).

5. Cookies and local storage

We use PostHog to understand how visitors use this website. We do not use Google Analytics, advertising pixels or similar advertising tools.

On your first visit we ask for your choice. If you click “Accept”, PostHog places first-party cookies and local storage items (names starting with “ph_”) so it can recognize your visits and record your session; these are kept for up to one year. If you click “Decline”, no analytics cookies or storage are used: PostHog then only counts your visit with a privacy-preserving hash that is calculated on its servers from your IP address, browser and a random value that changes every day, so you cannot be recognized on another day. Your choice itself is stored in your browser so we do not ask again. You can change it at any time via “Cookie settings” in the footer of every page.

The website stores one item in your browser’s sessionStorage, named “wf-boot”. It is used only to decide whether to play the intro animation, so you do not see it on every page. It contains no personal data, is not shared with anyone and is deleted automatically when you close your browser session. Because it is strictly necessary for the way the site is presented to you, no consent is required.

If we introduce other analytics or tracking in the future, we will update this policy first and ask for your consent where the law requires it.

6. Who we share data with

We share personal data only when this is necessary to provide our services, to comply with the law or with your consent. We never sell your personal data. We use the following service providers:

• Cloudflare (Cloudflare Pages): hosting, content delivery and security of the website.
• Zoho Mail: our email service.
• FormSubmit (formsubmit.co): forwards the free scan form to info@webfyndr.com.
• Calendly (calendly.com): booking of calls. The booking page opens in a new tab and Calendly processes your booking data as its own service, under its own privacy policy.
• PostHog (PostHog Inc., data stored in the United States): website analytics and, with your consent, session recordings, as described in section 5.
• Google Fonts (fonts.googleapis.com and fonts.gstatic.com): delivers the fonts used on the site and receives your IP address when your browser loads them.
• jsDelivr: a content delivery network that delivers the animation scripts used on the site and receives your IP address when your browser loads them.
• Financial and administrative providers: banks, payment service providers, accounting software and our tax adviser, for invoicing and legal compliance.

Where a provider processes personal data on our behalf, we use data processing terms that meet the requirements of Article 28 GDPR. Providers that act as independent controllers, such as Calendly for its own service, are responsible for their own processing. We may also disclose data when required by law or by a competent authority.

7. International data transfers

Some of the providers listed above, including Cloudflare, PostHog, Google Fonts, jsDelivr, FormSubmit and Calendly, may process data outside the European Economic Area (EEA), in particular in the United States. When personal data is transferred outside the EEA, these transfers rely on recognized safeguards, such as the EU-US Data Privacy Framework for certified companies or the European Commission’s standard contractual clauses. You may contact us for more information about the safeguards that apply and you may object to such a transfer.

8. How long we keep your data

We keep personal data no longer than necessary for the purposes listed in section 4, using the retention periods shown in the table. At the end of the retention period, data is deleted unless we are legally required to keep it longer. You can ask us to delete your data earlier by emailing info@webfyndr.com; see section 10.

9. Security and data breaches

We take appropriate technical and organizational measures to protect personal data against loss, unauthorized access, alteration and misuse. These include encrypted connections (HTTPS) for all website traffic, access to data limited to people who need it, and multi-factor authentication for administrative access. No method is completely secure, so we cannot guarantee absolute security. You remain responsible for keeping your own passwords and login details safe.

If a data breach occurs, we assess its nature and severity, take immediate steps to limit the damage and investigate the cause. Where required, we report the breach to the Dutch Data Protection Authority within 72 hours of discovery (Article 33 GDPR) and inform the people affected if the breach is likely to result in a high risk to their rights (Article 34 GDPR).

10. Your rights

Under the GDPR you have the following rights:

• Access (Article 15): to know, free of charge, which personal data we process about you.
• Rectification (Article 16): to have incorrect or incomplete data corrected.
• Erasure (Article 17): to have your data deleted, unless we need it to perform a contract, to meet a legal obligation or for a compelling legitimate interest.
• Restriction (Article 18): to have the processing of your data restricted in certain situations.
• Data portability (Article 20): to receive your data in a structured, commonly used and machine-readable format, such as CSV or JSON.
• Objection (Article 21): to object to processing based on legitimate interest, including direct marketing.
• Withdrawal of consent (Article 7): to withdraw consent at any time.

To exercise a right, email info@webfyndr.com with the subject “GDPR request: [your right]”, your full name, your email address and a description of your request. We may ask you to verify your identity. We respond within one month (30 days), in line with Article 12(3) GDPR. For complex requests this period may be extended by two further months; we will tell you if that happens.

11. Right to complain

If you are not satisfied with how we handle your personal data, please contact us first. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, the Netherlands, autoriteitpersoonsgegevens.nl. If you live in another EU country, you may also complain to the data protection authority there.

12. Automated decision-making and profiling

WebFyndr does not make automated individual decisions that have legal effects for you or similarly significantly affect you, and we do not profile website visitors.

13. Children

Our services are not directed at people under the age of 16. We do not knowingly process data of children without explicit consent from a parent or legal guardian. If we learn that we have unintentionally collected data from a minor, we delete it immediately. Please contact info@webfyndr.com if you have concerns.

14. Information for visitors in the United States

Our English website serves businesses worldwide, including in the United States. If you use this website or our services from the United States, your personal data is processed by a company based in the Netherlands and is protected under the GDPR as described in this policy. You may contact us to make any of the requests described in section 10, wherever you are located.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

15. Changes to this policy

We may update this Privacy Policy from time to time. The current version and its effective date are always published on this page. We inform existing clients of material changes by email.

Version history

• 1.0, March 31, 2026: initial publication (Dutch).
• 2.0, April 1, 2026: updated privacy and cookie policy (Dutch).
• 3.0, October 16, 2026: rewritten for the new website; cookie, service provider and transfer sections updated to reflect the current site; section for US visitors added.
• 3.1, October 18, 2026: website analytics with PostHog added, including the cookie choice and session recordings.

16. Contact

For questions about this policy or your personal data, contact WebFyndr (trade name of TimeFyndr), Heemskerk, the Netherlands, at info@webfyndr.com. We respond within 30 days. Our Terms & Conditions also apply to the use of our services.