Privacy policy

What we collect, and why

Personal data reaches us in five ways. For each one, this is what we collect, what we use it for, and the legal basis we rely on.

• The "Tell us about your company" form. Your name, work email, company, company website, role, headcount band, sector, and whatever you write about your question. We use it to reply and to prepare for a conversation if you want one. Basis: the steps you asked us to take before a possible contract (GDPR article 6(1)(b)), and our legitimate interest in answering enquiries about our work.
• The AI deployment self-check. When you submit the self-check, we collect your name, work email, role, the name and website of the business being assessed, its country, sector, and size band, all your assessment answers, any optional explanation, and your choice about contact. We also record the calculated stage, result, submission time, and assessment versions. We store every completed submission in Attio, our CRM, to keep a record of the assessment and handle questions about it. Our legal basis is our legitimate interest in providing and administering the assessment you requested. We contact you about your result only if you ask us to; that optional choice does not affect your result. Answers you have not submitted remain in the page’s memory and are cleared when you close or refresh it. We do not email a copy of your result.
• The candidate interest form. Your name, email, the links you share (LinkedIn, GitHub, or similar), the role you see yourself in, where you are based, when you are available, and what you tell us about your own work. We use it to consider you for a role and to get back to you. Basis: the steps that come before an employment or contractor agreement, and our legitimate interest in hiring.
• Email, calls, and meetings. If you write to us or we meet, we keep the correspondence and our notes so we can follow up. Online meetings may be recorded and transcribed if you agree to that at the start of the call. Basis: the contract we have with you, or our legitimate interest in following up a conversation you started.
• Technical data. Our hosting provider keeps short-lived logs, including IP addresses, to run and secure the site, and counts visits as described under cookies below. Basis: our legitimate interest in keeping the site working and safe, and in knowing how it is used.

We also keep business records, such as contracts and invoices, because Dutch tax law requires it for seven years.

You do not have to give us any of this. If a required field is empty, the form will not send; in the self-check, you will not reach the results page. The self-check applies fixed rules to answers about a business to calculate its AI maturity stage and suggested next step. It does not make decisions with legal or similarly significant effects about you. Completing it does not subscribe you to marketing emails. We do not sell or rent your data to anyone.

Who handles it for us

A small number of providers run our systems. Each one acts on our instructions and under its own data protection terms.

• Vercel hosts the site, processes its forms and self-check submissions, and counts visits on vantagegroup.ai, and did so on whereaiearns.com while it ran as its own site.
• Slack receives submissions from the company enquiry and candidate forms, in private channels that only the founders can see. Self-check submissions also go to a separate private Slack channel.
• Attio is our customer relationship system. Enquiries from the "Tell us about your company" form and completed self-check submissions, including answers and results, are recorded there. It also keeps a record of who we email. The candidate form does not send anything to it.
• Microsoft 365 is our email and document system. Candidate details are tracked in a recruiting workbook there.
• Anthropic and OpenAI provide the AI assistants we use to read and organise our own inboxes, channels, and notes.
• Fireflies records and transcribes online meetings, when you agree to that at the start of the call.

We may also disclose personal data where the law requires it, for example to a court or a regulator. Nobody else receives it, except that if we put the business into a company or sell it, the data moves with the business and this page still applies.

Outside the EU

Vercel, Slack, Anthropic, OpenAI, and Fireflies are US companies, so some data is processed in the United States. Those transfers rest on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. Attio is a UK company, and the UK has an EU adequacy decision. Our Microsoft 365 tenant processes data in the EU.

Email us if you want a copy of the clauses we rely on.

How long we keep it

We keep personal data no longer than the purpose it was collected for requires.

• Enquiries, email, and meeting notes. For as long as we are in contact, and a reasonable time after, so we can pick the conversation up where it left off.
• Self-check submissions. For as long as needed to administer the assessment and handle any questions or follow-up you request. We review whether the identifying details and assessment record are still needed when that purpose ends, and delete or anonymise them when they are not.
• Candidate details. Until we have closed the conversation with you, unless you tell us we may keep them for future roles.
• Contracts and invoices. The seven years Dutch tax law requires.
• Technical logs. For the hosting provider’s standard short period.

When data is no longer needed we delete it or strip it of anything that identifies you.

How we protect it

The site is served over HTTPS, and form submissions travel encrypted to the providers above. Access to those systems is limited to the people at Vantage who need it. No system is perfectly secure. If a breach affects your data, we will report it to the Autoriteit Persoonsgegevens and, where the risk to you is high, tell you directly, as the GDPR requires.

Cookies, other websites, and children

Neither site sets cookies or stores anything in your browser, which is why neither shows a cookie banner. We count visits with Vercel Web Analytics, which records the page, the site you came from, your country and region, your device and browser, and nothing that identifies you: visitors are told apart by a code derived from the request that is discarded after 24 hours, and your IP address is not stored. If that changes, we will update this page and ask for your consent where the law requires it.

The site links to other websites, such as LinkedIn. Those sites have their own privacy policies, and we are not responsible for how they handle your data.

Our services are for businesses, and the site is not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

Your rights

Under the GDPR you can ask us at any time to see the personal data we hold about you, to correct anything that is wrong, to delete it, to restrict what we do with it, to hand over a copy in a common file format, or to object to processing where we rely on our legitimate interest. Where we rely on your consent, you can withdraw it at any time.

Email contact@vantagegroup.ai and we will reply within one month. If you are not satisfied with our answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

Changes and contact

When we change how we handle personal data, we update this page and the date at the top. If a change affects you directly, we will tell you.

Vantage AI B.V., Keizersgracht 452, 1016 GD Amsterdam, the Netherlands, KvK 42186948. For anything about your data, email contact@vantagegroup.ai.