Data protection

Privacy notice

Last updated: 10 July 2026

This notice explains what personal data Vexwatch collects, why, who processes it on our behalf, and the rights you have. We keep it short and specific, because Vexwatch collects very little.

The short version: the site sets no cookies at all, so there is no cookie banner. We count visits and completed scope checks in aggregate with Umami, a privacy-friendly analytics tool that uses no cookies and cannot identify you. The Scope Checker runs entirely in your browser and keeps your answers in memory only. Your answers are never sent anywhere, and your email address only when you choose to submit it.

Who we are

Vexwatch is the controller for the personal data described here, meaning we decide why and how it is processed (GDPR, Article 13). Vexwatch is currently operated as a sole proprietorship based in the Netherlands. Formal registration details, including the legal entity name and KVK number, will be added to this notice once available.

For any privacy question or to exercise your rights, email privacy@vexwatch.com. For anything else, email hello@vexwatch.com.

What we collect

When you submit the Scope Checker form, we receive:

the email address you enter, and
which scope-checker result (verdict) you reached, submitted together with that email so we can send you the assessment you asked for.

In addition, our hosting provider keeps standard server and CDN access logs (your IP address, browser user-agent, and timestamps) for the security and operation of the site, and our analytics tool briefly processes the same technical request data to produce aggregate statistics, without storing anything that identifies you.

That is all. There is no account to create, and we do not collect or store payment data.

Cookies and tracking

The site sets no cookies of any kind, so there is no cookie banner. For usage statistics we use Umami, which works without cookies, sets nothing on your device, and does no cross-site tracking. It counts page views and one anonymous event: that a scope check was completed. Which answers you gave and which result you reached are not part of that count. The Scope Checker itself is entirely client-side: your answers stay in your browser and are never transmitted. If we ever introduce non-essential cookies, we will ask for your consent first and update this notice.

Why we use it, and our lawful basis

We use the data above to:

Send you the result you requested: We email you the scope assessment or guide you asked for. Lawful basis: your consent, given by submitting the form (GDPR, Article 6(1)(a)).
Send occasional product updates: We may send you pre-order and launch information about Vexwatch and the CRA Blueprint. Lawful basis: your consent (GDPR, Article 6(1)(a)). Every such email carries an unsubscribe link.
Respond to your enquiries: When you email us, we use your message and address to reply.
Keep the site secure and running: Access logs help us operate the site and prevent abuse. Lawful basis: our legitimate interests in security and reliability (GDPR, Article 6(1)(f)).
Understand how the site is used: Aggregate, cookieless statistics (page views and completed scope checks) tell us whether the site is worth running. Lawful basis: our legitimate interest in measuring our own product (GDPR, Article 6(1)(f)).
Fulfil a purchase, if you make one: If you later buy the Blueprint, we process what is needed to provide it. Lawful basis: performance of a contract (GDPR, Article 6(1)(b)).

Who processes your data

We keep the list of processors short and name them honestly by their current role.

Netlify (Netlify, Inc., United States): Hosts the site, stores scope-checker form submissions through Netlify Forms, and keeps the server access logs described above.
Cloudflare: Provides DNS and email routing for our contact addresses.
Umami (Umami Software, Inc.): Provides cookieless, aggregate-only usage statistics through Umami Cloud, stored in its EU region. It briefly processes your IP address and browser information to derive counts, without storing them: identifiers are anonymised at capture and rotate daily. See the Umami privacy policy.
Email service provider: When we begin sending email, a specialised provider will deliver the messages on our behalf. We will name that provider here before any sending begins.
Merchant of record: If you purchase, a merchant of record (Lemon Squeezy or Paddle) acts as the seller and processes the payment and invoicing. Vexwatch does not receive or store your card details.

International transfers

Netlify and Cloudflare may process data in the United States. Where personal data leaves the European Economic Area, the transfer relies on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework (GDPR, Article 46).

How long we keep it

We keep your email address until you unsubscribe or ask us to delete it, and we prune inactive contacts periodically. Form submissions and access logs are kept only as long as they are needed for the purpose they were collected for, then removed.

Your rights

Under the GDPR you have the right to:

Access: Ask for a copy of the personal data we hold about you (GDPR, Article 15).
Rectification: Have inaccurate data corrected (GDPR, Article 16).
Erasure: Ask us to delete your data (GDPR, Article 17).
Restriction: Ask us to limit how we use your data (GDPR, Article 18).
Portability: Receive your data in a portable format (GDPR, Article 20).
Objection: Object to processing based on our legitimate interests (GDPR, Article 21).
Withdraw consent: Withdraw your consent at any time. This does not affect processing we carried out before you withdrew it (GDPR, Article 7(3)).

To exercise any of these, email privacy@vexwatch.com. We respond within one month (GDPR, Article 12(3)). You can also unsubscribe from any marketing email using the link it carries.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with a supervisory authority (GDPR, Article 77). In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects on you (GDPR, Article 22). The Scope Checker gives informational guidance about the CRA. It is not a decision about you, and its output is not legal advice.

Children

Vexwatch is a service for businesses and is not directed at children.

Changes to this notice

We may update this notice as the product and our processors evolve. The "last updated" date at the top always reflects the current version.