Your data is stored in Europe

Controller: Ambulatio Consulting BV, Ceresstraat 13, 4811 CA Breda, The Netherlands  |  Contact: privacy@limitguard.ai  |  Last updated: 15 October 2026  |  Version: privacy-2026-10-15c

We have not appointed a data protection officer. Privacy questions go to privacy@limitguard.ai.

What changed in the third update of 15 October 2026

• Section 3, in the part on sole traders and partnerships, says that an objection also stops the sanctions screen of a shareholder entry in a company's filed annual accounts that carries your KVK or KBO number, and that a shareholder named without a number cannot be linked to your objection and is screened like any other name.

What changed in the second update of 15 October 2026

• Section 3 says that a report on a Belgian company lists every shareholder named in its latest annual accounts filed with the National Bank of Belgium, with the percentage the filing states, and that a shareholder can be a person. It also says that we compare the names of these shareholders, and of the parent companies a report names, with the OFAC, EU and UN sanctions lists on our own servers, and that a match holds the verdict at review.

What changed on 15 October 2026

• Section 3 rewrites the Chrome extension part for extension version 1.2. It describes signing in with your Limitguard account, the results in Chrome's side panel, what is read on LinkedIn, Sales Navigator, HubSpot and Pipedrive pages, optional email detection in Gmail and Outlook, the free preview, the name search, optional auto-check, history, lead lists and watching, optional CRM notes, and what is stored on your device.
• It no longer says that nothing from the page is sent before you click Check this company. It lists the cases where something is sent earlier: the free preview, the name search and auto-check if you turn it on, and the price, credit, history, lead list and watch requests.

What changed on 13 October 2026

These corrections make the policy say exactly what our service already does.

• Section 1 adds sign-in with a wallet: we keep the wallet address and its chain with your account. It also says that the sign-up form copies your marketing email tick into your account profile, and that we use this copy only to create your consent record when you first sign in.
• Section 3 says that a chat message is first sent as you typed it to TypeSafe's decision service, to choose how to answer. Bank account numbers and similar identifiers are replaced by placeholders before a message is stored or sent to the AI model that writes the answer.
• Section 3 states how many pages of a company website we read: up to three for phone numbers and up to five for the register or VAT number, besides the home page.
• Section 3 adds the advice in our reports that is written with TypeSafe's decision service.
• Section 4 adds TypeSafe (decision service), Cloudflare R2 (our encrypted database backups) and Mintlify (our documentation site) to the providers, and adds them to the paragraph on transfers outside the EEA. It also says that the payment playground on our website connects your browser to a public Solana node, and it lists all the emails we send through Resend.
• Section 5 corrects the retention table. A stored report keeps the company name and identifiers in full. An IBAN is kept in a different form in check records, reports and lead lists. The free-check record is deleted 24 months after the free checks were given. Until then it keeps the company's registration number, also after the account is deleted. Failed webhook deliveries are kept 28 days. New rows give the retention of database and server backups and of wallet sign-in.
• Sections 4 and 5 say that operational telemetry now replaces identifiers in a request path by {id}.
• Section 7 lists every cookie and browser storage item that our website and dashboard set, with its lifetime and purpose.

What changed on 12 October 2026

• Section 4 says that our operational telemetry also records the user agent your browser or API client sends, for security and abuse prevention, and the internal workspace id for calls with a workspace key. Sections 1 and 5 list it next to the IP address and the other telemetry.

What changed on 11 October 2026

• Section 3 adds the Limitguard Chrome extension: what it reads on the page you open it on (on your own device), what it sends to the Limitguard API only when you click Check, where your API key is kept, and the permissions it asks for.

What changed on 10 October 2026

• Section 4 adds Alchemy (alchemy.com), a blockchain data provider, to the public sources we query. For a wallet check we send it only the wallet address. On Base it tells us when the wallet was first and last active. On Solana it reads the wallet's account, balances and transaction history.
• Blockscout stays in the list: we still use it for Base when Alchemy is not available. Payments with x402 on Solana are still settled through the public Solana node.

What changed on 9 October 2026

• Section 3 describes the emails we send and how we measure them: a tracking pixel shows when an email is opened, and tracked links show which link was clicked. It also says what we store about this, why and for how long, and how marketing email consent works.
• Sections 1 and 5 add the email events, the record of your marketing email consent and our list of addresses we no longer email, with how long we keep each.
• Section 4 says that Resend also measures opens and clicks for us.
• Section 7 points to the email measurement.

What changed on 7 October 2026

• Section 3 describes Ask Limitguard, the AI chat assistant in the dashboard.
• Sections 4 and 5 add Anthropic as a provider and the retention of chat transcripts and traces.
• When a customer checks a company or a business lead, we now also read the company's own website (its home page and up to three company-details, contact or about pages) for the business phone numbers and the register or VAT number it publishes there, with the page each was found on. Phone numbers found on a website are also kept in a cache for 30 days, then deleted (section 3).
• The National Bank of Belgium (Central Balance Sheet Office) added to the public sources we send a Belgian company number to, for the annual accounts in Belgian company checks and reports (section 4).
• The paying wallet address on our x402 payment receipts is kept 7 years under a legal obligation; it is public on the blockchain anyway (sections 1 and 5).

What changed on 6 October 2026

• What we collect at dashboard signup now also includes the term and content of the signup link you followed (utm parameters), the website that referred you to us (its domain name only) and the first page you visited on our website, read from the links you followed; no cookie is set and nothing is stored in your browser for this (section 1).

What changed on 4 October 2026

• What we collect at dashboard signup (company details, your answers, the signup campaign, sanctions screening, free checks) and for billing (sections 1 and 3).
• Payments through Stripe, sign-up protection by Cloudflare Turnstile and OpenSanctions added to the provider list (section 4).
• Provider list checked against our code: Coinbase (x402 payments), dilisense (adverse media screening) and Google (optional sign-in) added, the locations of Resend, Supabase and OpenSanctions stated precisely, our own operational telemetry described, and the public sources we send identifiers to listed with what we send (section 4).
• Sections 2 and 7 corrected: no campaign or tracking cookie is set, the dashboard sets only the cookies needed to keep you signed in, and no cookie banner is needed.
• The statement that data never leaves the EEA is now precise about the providers that process data in the US (section 4).
• New retention periods for signup data, the optional note, signup events, the free-check record and invoices (section 5).
• You can also complain to the authority of your own EU country; we answer within one month (section 6).
• Hosting location stated as the European Union (Contabo data centre) instead of Germany (section 4).
• Operational telemetry (Langfuse) now has a 90-day retention period (section 5).

1. What we collect

2. What we do not collect

• We do not use advertising or cross-site tracking cookies. See section 7.
• We do not collect personal data beyond what is listed above.
• We do not build advertising profiles or track behaviour across sites.
• We do not sell, rent, or share your data with third parties for their own purposes. The one exception is described in section 4: Stripe handles payment data for its own payment, fraud and legal duties.

3. How we use your data

• Provide the service: Process API requests, return trust scores, manage your account.
• Billing: Take payments through Stripe, issue invoices, handle refunds, disputes and failed payments.
• Security: Detect abuse, enforce rate limits, maintain audit trails.
• Legal compliance: Retain payment and invoice records as required by Dutch accounting law (7 years), and screen new customers against sanctions lists.
• Service communication: Send API key notifications, deprecation notices, security alerts, payment emails, and emails about your account and how you use it (for example getting started, free checks used, or credits about to expire). No marketing emails unless you opt in. See Emails and how we measure them.
• Report emails: when you run a company check in the dashboard, we email you, the account holder, your own report. You can turn this off in Settings or with the link in any report email.

Emails and how we measure them

We send our emails from mail.limitguard.ai through Resend: report emails, payment emails, account emails, emails about your account and how you use it, and marketing emails if you opted in. Every email we send through Resend from mail.limitguard.ai is measured. A tiny invisible image (a tracking pixel) tells us when an email is opened. The links in an email go through links.mail.limitguard.ai, an address Resend runs for us, so we see which link was clicked. Emails about your account and how you use it also use our own short links on dashboard.limitguard.ai. If you are signed in when you click one, we link the click to your account. This shows us whether your workspace buys credits or a plan within 30 days after the click.

• What we store: when an email was sent, delivered, opened or clicked, bounced or marked as spam, and when you unsubscribed. With each event we store which email it was, your user and workspace id, a keyed one-way hash of your email address, the clicked link without its query string, and whether the open or click looked automatic (for example Apple Mail privacy protection or a company's link scanner). We do not store your email address, your IP address or your browser details with these events. They are in our own database in Ireland (section 4), which only our backend can read.
• Purpose: to know that our emails arrive and are useful, to stop emailing addresses that bounce or complain, and to learn which emails lead to a purchase.
• Legal basis: for emails about your account and our service, the contract (Art. 6(1)(b)) and our legitimate interest in knowing that they arrive and are useful (Art. 6(1)(f)). For marketing emails, your consent (Art. 6(1)(a)).
• How long: 12 months, then deleted. They are deleted sooner when you delete your account or ask us to erase your data. To keep honouring an unsubscribe, a bounce or a spam complaint, we keep a keyed hash of the address and the reason, also after erasure.
• Marketing emails: only if you opted in. We record when you did, where, which consent text you saw and which version of this policy applied. An older opt-in without this record does not count until you opt in again. You can withdraw at any time in Settings, or with the one-click unsubscribe link in every marketing email.
• Blocking images: if your email app does not load images, we do not see that you opened the email.

Signing up and your free checks

When you sign up we ask for your country, your company number and a few answers about how you plan to use Limitguard. For Dutch and Belgian companies we fill in your company's name and address from the official register (KVK or KBO), and we take the register's answer over what you typed. Before we give your 5 free lead checks we look your company up in the register (or in VIES for a VAT-only number), screen its name against sanctions lists, and check that your email address is confirmed and not from a disposable domain. We keep a record that your company received the free checks, so it cannot claim them twice. If the sanctions screening finds a possible match, we hold the free checks and may review the case by hand; we tell you only that the checks are on hold.

• Purpose: to open your account, check that your company is real and not on a sanctions list, give you your free checks and prevent abuse.
• Legal basis: contract or steps before a contract (Art. 6(1)(b)); legal obligation for sanctions screening (Art. 6(1)(c)); legitimate interest for abuse prevention and for understanding what customers need (Art. 6(1)(f)).
• Who sees it: our hosting and database providers, Cloudflare Turnstile and the sanctions data provider (section 4). The registers receive your company number or name when we look it up. We do not sell it.
• If you are a sole trader: your company details can be your personal data. We then handle them as personal data, and your rights in section 6 apply.

People we look up for our customers (Lead Verify)

When a customer checks a company or a business lead, we look up the company in public business registers (the Dutch KVK register, the Belgian KBO register and the EU VAT register) and in public sanctions lists, and we check whether the email domain the customer sent can receive mail. We also read the company's own website for the business phone numbers and the register or VAT number it publishes there, with the page each was found on. For phone numbers we read the home page and up to three company-details, contact or about pages. To find the register or VAT number we read the home page and up to five of its legal, terms, privacy, contact or about pages. This can include the names of directors or owners as they appear in those registers, and the business email address the customer supplied.

For a Belgian company, a report also lists every shareholder named in the latest annual accounts filed with the National Bank of Belgium, with the percentage the filing states. A shareholder can be a person. We compare the names of these shareholders, and of the parent companies a report names, with the OFAC, EU and UN sanctions lists on our own servers; nothing is sent out for this. A match is shown as a name match, not as proof, and holds the verdict at review.

• Purpose: to tell our customer whether a lead is a real, active company before they contact it.
• Legal basis: our customer's and our legitimate interest (GDPR Art. 6(1)(f)): avoiding effort on, and fraud by, companies that do not exist or misrepresent themselves. We only use data that a business published for business purposes.
• Sole traders and partnerships: as for companies, we return the business details the registers publish: for the Netherlands the trade names, the activity, the number of employees, websites, the date the business stopped and whether it asked not to receive marketing mail; for Belgium the registered names, the activity and the number of establishments. We also compare the registered names with public sanctions lists and return only whether there was a possible match, with the dates of the lists. We never return an owner's name, a private address the register shields, a date of birth or a national number. You can object at any time: see "Sole traders and partnerships: public register data" below.
• How long: as long as the check record of the customer who ran it (see Data Retention). Phone numbers found on a website are also kept in a cache for 30 days, then deleted. Annual accounts we fetch from KVK's open data (the Open Dataset Jaarrekeningen) are kept by KVK number, without a name or address, so a later check does not need to ask KVK again. The 14-day limit on our register cache applies to answers from KVK's paid API, not to this open data. If you object, we delete the stored annual accounts for your KVK number and do not store or show them again.
• Your right to object: email privacy@limitguard.ai. We stop using your data for these checks unless we have compelling grounds, and we tell you the outcome within one month.

Sole traders and partnerships: public register data

We hold the public records of sole traders and partnerships as the Dutch KVK register and the Belgian KBO register publish them, including the business phone number, email address and website in the KBO register, and we compare names with public sanctions lists. We did not collect this data from you; this section is our notice under GDPR Article 14.

• Source: KVK (Netherlands) and KBO Open Data (Belgium); OFAC, EU and UN sanctions lists.
• Purpose: business-to-business lead verification: telling a customer whether a lead is a real, active business.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)). We honour the register's own protections: an address KVK shields stays city only, and a wish not to receive marketing mail is always shown to our customer. We never sell contact lists.
• What we return: see "Sole traders and partnerships" in the Lead Verify section above.
• How to object: email privacy@limitguard.ai with your KVK or KBO number. We add it to our objection list; from then on we do not screen your names against sanctions lists, stop watching names we screened before for new sanctions listings, read no website and return no contact details. Our answers carry no field or code that says you objected, and reports we built for customers before you objected stop showing your contact details and full register profile. We still return the basic register record we return for every business: the registered name, legal form, founding date and address (city only where the register shields it), whether your business is active, the date it stopped and your mail preference, and for Belgium the main activity, the registered names and the number of establishments. When a company's filed annual accounts name you as a shareholder with your KVK or KBO number, we do not screen that entry either. A shareholder named without a number cannot be linked to your objection, so it is screened like any other name.

AI advice in our reports

When a report says that a part of it comes from our AI advice, that advice was written with TypeSafe's decision service (section 4) from the figures and codes in the company's filed annual accounts. We send it no names. The advice is information to help you decide. It is not financial advice.

Lead lists our customers upload

A customer can upload a list of leads as a CSV file and have us check the whole list. A list can contain email addresses, names and partial bank account numbers (IBANs). We never keep a full IBAN: we store only its last four characters, with its country and the name and BIC of its bank.

• Our role: we process an uploaded list on the customer's behalf, as a processor under our Data Processing Agreement. The customer decides what to upload and why.
• How long: until the customer deletes the list. A list the customer has not deleted is removed by our daily purge 30 days after upload.
• No other use: we use a list only to run the checks the customer asked for. We never reuse it for anything else, and we never share it or sell it.

Ask Limitguard (AI chat)

An AI system in the dashboard, announced at the start of every chat. We process your questions, the answers and the check results shown. To choose how to answer, each message is first sent as you typed it to our decision service provider (section 4). Before a message is stored or sent to the AI model that writes the answer, bank account numbers and similar identifiers are replaced by placeholders. Anthropic writes the answers as our processor in the United States (an answer may be generated in another country), does not train on them and deletes them within 30 days, or up to 2 years for a request its safety systems flag. The transfer is covered by the EU Standard Contractual Clauses in Anthropic's data processing addendum. Chats are deleted after 30 days or when you delete them. The chat makes no decisions about people; a person at our customer decides. An objection under Sole traders and partnerships covers the chat.

Chrome extension

The Limitguard Chrome extension, version 1.2, helps you check the company on the web page you are looking at. It shows its results in Chrome's side panel. You can sign in with your Limitguard account or add an API key.

• What it reads on your own device. It reads a page only after you click its icon or press its shortcut on that page, or, with Email detection on, when an email is open in Gmail or Outlook on the web. The side panel then follows you to other tabs, but reads a tab only when Chrome allows it: after you click the icon or press the shortcut on that tab, and then until that tab goes to another website. On the same website it can read each page you open in that tab. It reads the page address, the title, the site name, the company data the site publishes for search engines, which are the name, VAT number and company number, and the text at the bottom of the page, to suggest the company name, website and any KVK, KBO or VAT number shown there. When the page shows no company number, your browser opens up to five pages of the same website, such as its colofon, company data, privacy, terms, contact or about page, without cookies, and the extension keeps only short pieces of text around words such as KVK, KBO and VAT. That website sees these page requests, as it would if you opened the pages yourself.
• LinkedIn and Sales Navigator. On a company page it reads the company name only. On a profile or a Sales Navigator lead page it returns only the company name and the LinkedIn company link of the current employer, nothing about the person: not the name, headline, photo, location or contact details. To tell a current job from a past one it looks at the dates in the experience list on the page, and it does not keep, show or send them. On a search results page it reads only the names and LinkedIn links of the companies shown, at most 25, and on results that list people only the current company of each person. It does not scroll, turn the page or load anything from LinkedIn.
• HubSpot and Pipedrive records. On a company record it reads the heading and only the record's own fields for company number, VAT number and website. It reads no contacts, deals, notes, emails or activity.
• Email detection, off by default. If you turn it on in the extension's settings, Chrome asks you for access to Gmail and Outlook on the web, at mail.google.com, outlook.office.com, outlook.live.com and outlook.cloud.microsoft. The extension then reads only the domain of the sender's email address of the email you have open, for example acme.nl. It does not read the message, the subject, the sender's name, the part of the address before the @ or any other address, and it never visits the sender's website. A free email domain such as gmail.com is skipped. To pass over your own messages, it compares the sender with the domain of your own sign-in address, on your device. The domain fills the form and stays in your browser until you click Check. If you turn email detection off, the extension gives the access back.
• Nothing from the page is sent to Limitguard until you click Check this company, except in the five cases below. The first three need your sign-in or API key.
• Free preview. When the form holds a Dutch or Belgian company number, found on the page or typed by you, the extension sends that number and the country. Limitguard answers with what open data holds for it: for a Belgian company the registered name, legal form, city and status, and for a Dutch BV or NV whether it is active. A preview is not a check and uses no credit.
• Name search. When the page shows a company name but no company number, the extension sends that name and the country, to find the company. When you switch the country in the side panel, it sends the company name in the form and the new country. Limitguard looks the name up in the KVK register for the Netherlands or in its own copy of KBO Open Data for Belgium, and answers with at most five companies. It does not log the name, and keeps the answer for five minutes in its cache under a hash. A name search is not a check and uses no credit.
• Auto-check, off by default. If you turn it on in the extension's settings, the check starts by itself when the page shows the company name and number, once per company in each browser session and at most 20 times an hour. It sends the same fields as a click and uses your credit. It never starts on email pages or on search results pages.
• Price, credit, history and lists. When the side panel opens, it asks Limitguard for the current price, without a key, and for your credit, with your key or sign-in. The History tab asks for your own past checks and sends the words you type to search them. After a check you can add the company to a lead list or watch it, which sends the country, number, name and domain you confirmed. On a LinkedIn or Sales Navigator search results page, adding sends the name of each company you ticked, the country and the lead list you chose, and only when you click Add.
• CRM notes, optional. Nothing happens unless you connect HubSpot or Pipedrive. If you do, you can add a check result to a company record with one click. Connecting opens the CRM's own consent window. When you click, the extension sends Limitguard the address of the record, the time of the check and your language. Limitguard then sends that CRM a note with the company name or number, the verdict, the register status, the check date and a link to the full report. We store the CRM's access tokens encrypted for your workspace and delete them when the CRM is disconnected or the workspace is deleted. Limitguard reads nothing from your CRM, apart from the identifier of the connected CRM account. HubSpot or Pipedrive is your own service provider, which you choose. It is not one of our providers in section 4.
• What is sent when you click Check this company: only the company name, company number, VAT number, website and country that you confirmed, to the Limitguard API at api.limitguard.ai. The check is then processed like any other Limitguard check, as described in this policy.
• What stays on your device. Your API key, or your sign-in tokens and the email address of your account, your language and your settings are stored in the extension's local storage. They are not synced to other devices. The extension registers itself with the sign-in server of our sign-in provider, named in section 4. Your sign-in tokens are sent only to that server and to api.limitguard.ai, and your API key only to the Limitguard API. The check that is running and the answer of the last check are kept in Chrome's session storage until the browser session ends, so a reopened panel does not charge you twice. With auto-check on, the extension also keeps the country and number of each company it checked by itself in session storage, and the start times of its checks in the last hour in local storage, to keep to the limits above. While you sign in, it keeps a temporary sign-in code in session storage. When you sign out, the extension asks Limitguard to end your sign-in session and always removes it from your device.
• No tracking: the extension contains no analytics, advertising or tracking code, sells or shares no data, and loads no code from other servers.
• Permissions: storage, for your key, sign-in, language and settings; activeTab and scripting, for reading the current page after you open the extension; identity, to open the sign-in window and the CRM consent window, without reading any Google account data; sidePanel, to show the results in Chrome's side panel; access to api.limitguard.ai, to send what is described above; and optional access to the four mail sites above, which Chrome asks for only when you turn on email detection.
• You can remove your key, sign out or turn off email detection in the extension's settings, or uninstall the extension, at any time.

4. Where we store your data

Application data is stored in the EU: API requests, responses and audit logs on servers in the European Union (Contabo data centre); dashboard accounts, workspaces and check records in a database in Ireland. A few providers process limited data in the United States: Cloudflare (request metadata, the sign-up challenge and cookie-free analytics, under the EU-US Data Privacy Framework), Stripe (payments), Coinbase (x402 payments), Google (optional sign-in), Anthropic (the AI chat assistant, under the EU Standard Contractual Clauses) and Mintlify (our documentation site). TypeSafe (the decision service) is a US company that hosts its service in the United States, under the EU Standard Contractual Clauses in its data processing addendum. It is reached through Cloudflare's network. Our encrypted database backups are stored in Cloudflare R2, which does not guarantee a location in the EU. Resend and Supabase are US companies that run their service for us in Ireland, so only remote access can come from the US. dilisense is in Switzerland, which has an EU adequacy decision. Each transfer is under the transfer tool named in the table or in the provider's data processing agreement. Apart from these, data does not leave the EEA in the ordinary course of processing.

To run checks we also query public sources with the identifiers a check needs. Each receives only what the table shows, decides for itself how to handle it, and is not our processor.

The Belgian KBO Open Data and the OFAC, EU and UN sanctions lists are downloaded in bulk and read from our own servers, so nothing about your checks is sent to them. Our status page (status.limitguard.ai) is run by Better Stack. Its uptime monitoring only requests the public health addresses of our API and dashboard. When you open the status page your browser connects to Better Stack, which sees your IP address; the status page has no accounts or subscriptions. The payment playground on our website asks a public Solana node (solana-rpc.publicnode.com) directly from your browser when you try a payment with a Solana wallet. That node sees your IP address.

5. Data retention

6. Your rights

Under GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten") (Art. 17)
• Restrict processing (Art. 18)
• Data portability: receive your data in a structured format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the data protection authority of your own EU country (in Belgium: the Gegevensbeschermingsautoriteit / Autorité de protection des données)

To exercise any right, email privacy@limitguard.ai. We will respond within one month; where a request is complex we may extend that period as the GDPR allows, and we will tell you.

7. Cookies

Our website uses Cloudflare Web Analytics, which does not use cookies and does not collect personal data. Our emails contain a tracking pixel and tracked links; see Emails and how we measure them.

Our website and dashboard set these cookies and keep these items in your browser's storage:

These cookies are needed for the service or remember a choice you made. They are not used for tracking or advertising. We do not set tracking, advertising or campaign cookies: the campaign of a signup link is read from the link itself when you sign up. The sign-up form uses Cloudflare Turnstile to tell people from bots; it is needed for security. We do not use advertising cookies, social media trackers, or any third-party tracking scripts beyond Cloudflare Web Analytics. No cookie consent banner is required.

8. Children

Limitguard is a B2B service. We do not knowingly collect data from anyone under 16. If you believe we have inadvertently collected such data, contact privacy@limitguard.ai and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. For customers who already have an account, we notify material changes by email to workspace owners and registered API key holders, and in the dashboard, at least 30 days before they take effect. A new version applies immediately to anyone who signs up after it is published. The "Last updated" date at the top of this page reflects the most recent revision, and earlier versions stay available in the archive of previous versions.