Privacy Policy
Last updated: 28 August 2026
This policy explains what personal data we collect on igorbeuker.com and vault.igorbeuker.com, why we collect it, and what your rights are. We keep it in plain language on purpose.
1. Who is responsible
The controller for your personal data is:
Speakers for Humanity B.V.
Papaverweg 35, Unit B100 34, 1032 KJ Amsterdam, The Netherlands
Chamber of Commerce (KVK): 78465702
VAT: NL861411493B01
Contact: the contact form on the Site
Privacy questions and requests: use the same contact form and mention privacy in your message.
2. What we collect, and why
Contact and booking forms
Name, email address, and whatever you put in the message fields (for speaking requests also things like company, event, location, budget and date). Optional file attachments you upload. Purpose: answering you and preparing an offer. Legal basis: taking steps at your request before entering into a contract.
Newsletter and Misfits signup
First name and email address; optionally last name, what kind of professional you are, your interests, city, country and birth year, if you choose to share them. Purpose: sending the newsletter and member updates, and tailoring what we send to your interests. Legal basis: your consent, which you can withdraw at any time via the unsubscribe link in every email or by emailing us.
Member accounts
Your email address, sign-in timestamps, and the profile fields you fill in (they are all optional). Purpose: operating your account and showing you your own profile. Legal basis: performing our contract with you.
Ask Igor
The questions you type, tied to a random session identifier stored in a cookie, and to your account if you are signed in. If you ask to be notified when Igor makes a new call, your email address. Purpose: answering the question, enforcing the free-question limit, and understanding which topics people ask about. Legal basis: our legitimate interest in operating and improving the feature; consent for the notification email.
Paid memberships
Name, email, and subscription status. Payment details are collected and processed by Stripe; we receive confirmation of payment, never your card number. Purpose: providing the Secret Vault and billing. Legal basis: performing our contract with you, and legal obligations (tax and bookkeeping).
Technical data
IP address, browser characteristics and pages visited, in server logs and analytics; short-lived request counters keyed by IP for rate limiting. Purpose: security, abuse prevention, and understanding how the Site is used. Legal basis: our legitimate interest in a secure, working website. Analytics cookies are only set as described in section 10 below.
3. Who processes it for us
We use a small set of processors, each bound by a data-processing agreement:
Vercel (hosting and content delivery)
Supabase (database and authentication, hosted in the EU, Ireland)
Resend (transactional and newsletter email)
Stripe (payment processing)
Cloudflare (content delivery, file storage, bot protection)
Google (Tag Manager and analytics, where you consent to analytics cookies)
Upstash (short-lived rate-limit counters)
We do not sell personal data, and we do not share it with anyone else except where the law requires it.
4. International transfers
Some processors are US companies. Where data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, plus additional safeguards where appropriate.
5. How long we keep it
Contact and booking messages: as long as needed to handle them, then up to 2 years for follow-up, unless a contract follows.
Newsletter and Misfits data: until you unsubscribe or ask us to delete you; unsubscribed addresses stay on a suppression list so we do not email them again.
Accounts: until you delete your account or ask us to.
Ask Igor questions: kept in aggregate; session identifiers expire after a year.
Billing records: 7 years, as Dutch tax law requires.
Server logs and rate-limit counters: days to weeks, automatically.
6. Your rights
Under the GDPR you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what happened before. Send your request through the contact form on the Site and we will respond within one month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
7. Security
Traffic is encrypted (TLS), sign-in works with one-time email links instead of passwords, access to data is limited to what each system needs, and payment data never touches our servers. No system is perfectly secure; if a breach ever affects you, we will inform you and the authority as the law requires.
8. Children
The Site is not aimed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
9. Changes
We update this policy when our data practices change. The date at the top tells you when. Meaningful changes are announced on the Site or by email.
10. Cookies
Cookies are small files a website stores in your browser. We use as few as we can get away with. This section lists every one and what it does.
10.1 Strictly necessary
These make the Site work and need no consent.
sb-*-auth-token: keeps you signed in to your member account. Lives up to a year; deleted when you sign out.
ask_sid: a random, signed session identifier for Ask Igor, used to count your free questions. No name, no email, no tracking across sites. Lives 1 year.
ask_member: remembers that this browser unlocked unlimited Ask Igor questions. Lives 1 year.
Cloudflare Turnstile: the "are you human" check on our forms sets its own short-lived cookies to tell people from bots.
10.2 Analytics
We use Google Tag Manager and analytics to understand which pages and predictions people read, in aggregate. These cookies (such as _ga and friends, living up to 2 years) are only set where required consent has been given. We do not use analytics data to identify you, and we do not run advertising or cross-site tracking cookies.
10.3 What we do not do
No advertising cookies.
No selling of data collected by cookies.
No social-media tracking pixels.
10.4 Staying in control
You can delete or block cookies in your browser settings at any time; the Site keeps working, though you will be signed out and the free-question counter resets.
Blocking the strictly necessary cookies means sign-in and the forms cannot function.
Most browsers can block third-party cookies wholesale without breaking this Site.