Privacy Policy

Who we are

Recommendable is a product of Think again. B.V., an AI consultancy based in Utrecht (thinkagain.nl), at Dr. P. van Hoeklaan 2, 3571 WG Utrecht, the Netherlands, registered with the Dutch Chamber of Commerce under number 42043713. Recommendable is not a separate company. Think again. B.V. is the controller for the personal data described in this policy. You can reach us at info@recommendable.co.

What we collect

• Account data. Your name, email address and login credentials when you create an account, and your role within an organization.
• Workspace content. The brands, websites, competitors, personas and other details you or your team add to the platform.
• Audit data. Information our modules gather about the websites and brands you analyze. This is largely public web data, such as page content, search results and AI answers.
• Usage data. Basic logs of how the product is used, such as which audits run and when, so we can keep the service reliable and improve it.
• Support messages. Anything you send us by email or through feedback forms.
• Requests and contact. Your name, email address, company, website, the package you chose and your message, when you request a package or contact us. We use them to handle your request and get in touch with you.
• Newsletter. Your email address, when you sign up for AI Search Insights. We send you insights, inspiration and tips on AI Search once a month, only after you have confirmed your sign-up by email. You can unsubscribe in every email.

Why we process it

We process data on three legal bases under the GDPR: to perform our contract with you (running audits, showing results, managing your account), for our legitimate interests (securing the service, preventing abuse, improving the product), and with your consent where we ask for it explicitly. We never sell personal data and we don't use it for advertising.

AI processing

Recommendable uses large language models to analyse content and make recommendations. When you run an audit, we send relevant content (such as pages of the analysed website and the brand profile you provided) through the Vercel AI Gateway to AI providers to produce the analysis. We only share what the analysis you asked for needs, and we use paid business API accounts.

Who we share data with

We use a small set of service providers to run Recommendable:

• Supabase, for our database, file storage and sign-in (in Stockholm, Sweden)
• Vercel, for hosting the application and the background jobs (in Stockholm, Sweden) and for the AI Gateway that all AI calls go through
• AI model providers Anthropic, OpenAI, Google and Perplexity, for running analyses
• Search and web data providers DataForSEO, Bright Data and Apify, for search results and public web pages
• Resend, for sending email (from Ireland)
• Public APIs of YouTube, X, Listen Notes, Crunchbase, the European Patent Office and Google (PageSpeed and Safe Browsing), for data about the brands and websites you analyse

Some providers process data outside the EU. Where that happens, we rely on safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

How long we keep it

We keep your data for as long as your account is active. If you ask us by email to delete your account or organisation, we remove the related personal data within 7 days and confirm it. The daily database backups still hold it for at most 7 days after that. Data we must keep for legal or accounting reasons we keep for as long as the law requires. Requests that do not lead to an assignment are deleted after 12 months. We keep your newsletter sign-up until you unsubscribe; sign-ups not confirmed within 30 days are deleted.

Your rights

Under the GDPR you can ask us to access, correct, delete or export your personal data, and you can object to or restrict certain processing. Email us at info@recommendable.co and we'll respond within a month. You also have the right to lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens).

Security

All traffic is encrypted in transit. Data is stored with row-level security, so organisations can only reach their own workspace. Access to production systems is limited to the two founders, with two-factor authentication. More on our security page.

Cookies

The application only uses cookies it needs, for example to keep you signed in. We use no advertising or cross-site tracking cookies. The full list is in our cookie policy.

Changes to this policy

If we change this policy in a meaningful way, we'll notify you by email or inside the product before the change takes effect. The date at the top tells you when it was last updated.