Your data stays in Europe

Controller: Ambulatio Consulting BV, Ceresstraat 13, 4811 CA Breda, The Netherlands  |  Contact: privacy@limitguard.ai  |  Last updated: 7 October 2026

We have not appointed a data protection officer. Privacy questions go to privacy@limitguard.ai.

1. What we collect

2. What we do not collect

• We do not use advertising or cross-site tracking cookies. See section 7.
• We do not collect personal data beyond what is listed above.
• We do not build advertising profiles or track behaviour across sites.
• We do not sell, rent, or share your data with third parties for their own purposes. The one exception is described in section 4: Stripe handles payment data for its own payment, fraud and legal duties.

3. How we use your data

• Provide the service: Process API requests, return trust scores, manage your account.
• Billing: Take payments through Stripe, issue invoices, handle refunds, disputes and failed payments.
• Security: Detect abuse, enforce rate limits, maintain audit trails.
• Legal compliance: Retain payment and invoice records as required by Dutch accounting law (7 years), and screen new customers against sanctions lists.
• Service communication: Send API key notifications, deprecation notices, and security alerts. No marketing emails unless you opt in.
• Report emails: when you run a company check in the dashboard, we email you, the account holder, your own report. You can turn this off in Settings or with the link in any report email.

Signing up and your free checks

When you sign up we ask for your country, your company number and a few answers about how you plan to use Limitguard. For Dutch and Belgian companies we fill in your company's name and address from the official register (KVK or KBO), and we take the register's answer over what you typed. Before we give your 5 free lead checks we look your company up in the register (or in VIES for a VAT-only number), screen its name against sanctions lists, and check that your email address is confirmed and not from a disposable domain. We keep a record that your company received the free checks, so it cannot claim them twice. If the sanctions screening finds a possible match, we hold the free checks and may review the case by hand; we tell you only that the checks are on hold.

• Purpose: to open your account, check that your company is real and not on a sanctions list, give you your free checks and prevent abuse.
• Legal basis: contract or steps before a contract (Art. 6(1)(b)); legal obligation for sanctions screening (Art. 6(1)(c)); legitimate interest for abuse prevention and for understanding what customers need (Art. 6(1)(f)).
• Who sees it: our hosting and database providers, Cloudflare Turnstile and the sanctions data provider (section 4). The registers receive your company number or name when we look it up. We do not sell it.
• If you are a sole trader: your company details can be your personal data. We then handle them as personal data, and your rights in section 6 apply.

People we look up for our customers (Lead Verify)

When a customer checks a company or a business lead, we look up the company in public business registers (the Dutch KVK register, the Belgian KBO register and the EU VAT register) and in public sanctions lists, and we check whether the email domain the customer sent can receive mail. We also read the company's own website (its home page and up to three company-details, contact or about pages) for the business phone numbers and the register or VAT number it publishes there, with the page each was found on. This can include the names of directors or owners as they appear in those registers, and the business email address the customer supplied.

• Purpose: to tell our customer whether a lead is a real, active company before they contact it.
• Legal basis: our customer's and our legitimate interest (GDPR Art. 6(1)(f)): avoiding effort on, and fraud by, companies that do not exist or misrepresent themselves. We only use data that a business published for business purposes.
• Sole traders and partnerships: as for companies, we return the business details the registers publish: for the Netherlands the trade names, the activity, the number of employees, websites, the date the business stopped and whether it asked not to receive marketing mail; for Belgium the registered names, the activity and the number of establishments. We also compare the registered names with public sanctions lists and return only whether there was a possible match, with the dates of the lists. We never return an owner's name, a private address the register shields, a date of birth or a national number. You can object at any time: see "Sole traders and partnerships: public register data" below.
• How long: as long as the check record of the customer who ran it (see Data Retention). Phone numbers found on a website are also kept in a cache for 30 days, then deleted.
• Your right to object: email privacy@limitguard.ai. We stop using your data for these checks unless we have compelling grounds, and we tell you the outcome within one month.

Sole traders and partnerships: public register data

We hold the public records of sole traders and partnerships as the Dutch KVK register and the Belgian KBO register publish them, including the business phone number, email address and website in the KBO register, and we compare names with public sanctions lists. We did not collect this data from you; this section is our notice under GDPR Article 14.

• Source: KVK (Netherlands) and KBO Open Data (Belgium); OFAC, EU and UN sanctions lists.
• Purpose: business-to-business lead verification: telling a customer whether a lead is a real, active business.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)). We honour the register's own protections: an address KVK shields stays city only, and a wish not to receive marketing mail is always shown to our customer. We never sell contact lists.
• What we return: see "Sole traders and partnerships" in the Lead Verify section above.
• How to object: email privacy@limitguard.ai with your KVK or KBO number. We add it to our objection list; from then on we do not screen your names against sanctions lists, stop watching names we screened before for new sanctions listings, read no website and return no contact details. Our answers carry no field or code that says you objected, and reports we built for customers before you objected stop showing your contact details and full register profile. We still return the basic register record we return for every business: the registered name, legal form, founding date and address (city only where the register shields it), whether your business is active, the date it stopped and your mail preference, and for Belgium the main activity, the registered names and the number of establishments.

Lead lists our customers upload

A customer can upload a list of leads as a CSV file and have us check the whole list. A list can contain email addresses, names and partial bank account numbers (IBANs). We never keep a full IBAN: we store only its last four digits.

• Our role: we process an uploaded list on the customer's behalf, as a processor under our Data Processing Agreement. The customer decides what to upload and why.
• How long: until the customer deletes the list. A list the customer has not deleted is removed by our daily purge 30 days after upload.
• No other use: we use a list only to run the checks the customer asked for. We never reuse it for anything else, and we never share it or sell it.

4. Where we store your data

Application data is stored in the EU: API requests, responses and audit logs on servers in the European Union (Contabo data centre); dashboard accounts, workspaces and check records in a database in Ireland. A few providers process limited data in the United States: Cloudflare (request metadata, the sign-up challenge and cookie-free analytics, under the EU-US Data Privacy Framework), Stripe (payments), Coinbase (x402 payments) and Google (optional sign-in). Resend and Supabase are US companies that run their service for us in Ireland, so only remote access can come from the US. dilisense is in Switzerland, which has an EU adequacy decision. Each transfer is under the transfer tool named in the table or in the provider's data processing agreement. Apart from these, data does not leave the EEA in the ordinary course of processing.

To run checks we also query public sources with the identifiers a check needs. Each receives only what the table shows, decides for itself how to handle it, and is not our processor.

The Belgian KBO Open Data and the OFAC, EU and UN sanctions lists are downloaded in bulk and read from our own servers, so nothing about your checks is sent to them. Our status page (status.limitguard.ai) is run by Better Stack. Its uptime monitoring only requests the public health addresses of our API and dashboard. When you open the status page your browser connects to Better Stack, which sees your IP address; the status page has no accounts or subscriptions.

5. Data retention

6. Your rights

Under GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten") (Art. 17)
• Restrict processing (Art. 18)
• Data portability: receive your data in a structured format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the data protection authority of your own EU country (in Belgium: the Gegevensbeschermingsautoriteit / Autorité de protection des données)

To exercise any right, email privacy@limitguard.ai. We will respond within one month; where a request is complex we may extend that period as the GDPR allows, and we will tell you.

7. Cookies

Our website uses Cloudflare Web Analytics, which does not use cookies and does not collect personal data. The website stores your colour-theme choice in your browser; it stays on your device.

The dashboard sets only the cookies that are strictly necessary to keep you signed in. They do not need your consent. We do not set tracking, advertising or campaign cookies: the campaign of a signup link is read from the link itself when you sign up. The sign-up form uses Cloudflare Turnstile to tell people from bots; it is needed for security. We do not use advertising cookies, social media trackers, or any third-party tracking scripts beyond Cloudflare Web Analytics. No cookie consent banner is required.

8. Children

Limitguard is a B2B service. We do not knowingly collect data from anyone under 16. If you believe we have inadvertently collected such data, contact privacy@limitguard.ai and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. For customers who already have an account, we notify material changes by email to workspace owners and registered API key holders, and in the dashboard, at least 30 days before they take effect. A new version applies immediately to anyone who signs up after it is published. The "Last updated" date at the top of this page reflects the most recent revision, and earlier versions stay available in the archive of previous versions.