Security and AI
You entrust us with data about yourself and your customers. Here you can read how we protect it and how we use AI responsibly.
Why this page?
When you work with Viva67, you entrust us with data. Your own, and that of your customers who contact you via the chat or the form. We take that trust seriously. On this page you can read how we protect that data, where it is stored, and how we use artificial intelligence (AI) responsibly.
We write it down in plain language, without technical jargon where possible. If you want to know more about a part, or have a question from one of your own customers, email us at info@viva67.com.
Our principles
In everything we build, we stick to four fixed principles:
- As little data as possible. We only ask for what is needed to answer a question or make an appointment.
- As close to home as possible. Where possible, we choose storage and processing in Europe.
- A person stays in control. AI helps, but a person can always look along and step in.
- Open about what we do. We are honest about which parties we use and what happens to data.
Where data is stored
Where possible, we choose storage in Europe. Not every service is available in Europe, which is why we also list the parties outside Europe below.
- Database: the database of our CRM runs on Google Cloud Firestore in the Netherlands (region europe-west4).
- Email: we send emails via the EU region of Resend (Ireland).
- Follow-up messages: we schedule automatic follow-up messages via the EU region of Upstash (Frankfurt).
- CRM and chat: the CRM itself is hosted by Vercel, in the United States.
- AI model: the AI model is called via OpenRouter, in the United States.
- Website: this website is hosted by GitLab.
If data is processed outside the European Economic Area, this only happens on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. A full overview of all parties, with their role, can be found in our data processing agreement and in the privacy statement.
Our security measures
Encrypted connections
The website, the chat and the CRM only work via HTTPS. Data is therefore encrypted on its way between your browser and our systems. Someone who intercepts the traffic cannot read it.
Encrypted storage
Google Cloud stores the data in the database encrypted by default. Even if someone were to gain physical access to the storage, the data would not simply be readable.
Access only after logging in
The CRM can only be reached with a personal account. Each user only sees what they need for their work. We do not share accounts, so it is always clear who did what.
Carefully selected suppliers
We work with established parties and record arrangements about security and confidentiality. If we add a new party that processes customer data, we inform our clients in advance.
No tracking
No advertising pixels or tracking software run on our website. What does happen technically when you visit the site is explained in the cookie statement.
Not kept longer than necessary
We do not keep data longer than necessary. If a client stops using our services, they receive their data once everything has been settled, and then have 30 days to export it. No later than 90 days after the end of the cooperation we delete the data, unless the law requires us to keep it longer.
How we use AI
The chat on this website and the digital colleagues we build for clients use the language model Claude by Anthropic, via OpenRouter. We stick to a few fixed arrangements.
Clear that it is AI
Under the European AI Act (article 50), people must know they are talking to AI since 2 August 2026. We set up our chat so that this is clear straight away. The same applies to the chats we build for clients.
Only questions that belong there
Our chats are not general chatbots. They are set up for questions about the business they belong to, and only know the information that business has supplied. They do not answer questions outside that scope. This prevents the chat from making things up about subjects it knows nothing about.
A person can always take over
Every conversation is stored in the CRM. An employee can read along, adjust answers and take over the conversation. Questions the chat cannot answer are passed on to a person.
No decisions without a person
The AI answers questions and helps with scheduling, but does not make decisions that significantly affect people, such as rejecting a customer or setting a price.
No training with your data
We use the model via a business API. We do not use conversations to train AI models, and we have chosen the settings at OpenRouter so that data is not used for training.
AI can make mistakes
A language model can make a mistake or explain something incompletely. That is why we let clients check the answers before they go live. Prices and appointments only apply after written confirmation.
What you can do yourself
Security is a shared responsibility. As a client, you can do a lot yourself to protect your data and that of your customers:
- use a strong password for your CRM account that you do not use anywhere else;
- do not share your login details with colleagues, but ask for an account of their own;
- log out on shared computers;
- do not let the chat ask for sensitive data, such as medical information or bank details;
- let us know immediately if you think someone has access to your account.
Reporting a vulnerability
Have you found a weakness in our website, chat or CRM? Report it to us as soon as possible via info@viva67.com, with a description of the problem and how we can verify it. We ask you to:
- not misuse the vulnerability, and not view, change or delete other people's data more than necessary to demonstrate the problem;
- not share the information with others until the problem has been solved;
- not carry out attacks that disrupt the service, and not use social engineering.
We respond within 5 working days, keep you informed about the solution and will not report you to the police if you have followed these rules and acted in good faith.
If something does go wrong
However well you prepare, a data breach can always happen. For example when an email ends up with the wrong person or when a supplier is hacked. In the event of a data breach we act immediately:
- we limit the damage and close the leak;
- we investigate what happened and which data is involved;
- if it concerns data we process for a client, we inform that client within 48 hours, as agreed in our data processing agreement;
- where necessary we report the breach within 72 hours to the Dutch Data Protection Authority, and inform the people whose data was leaked;
- we record every data breach and take measures to prevent it from happening again.
Frequently asked questions about security and AI
Does the AI read all my emails?
No. The AI only works with the conversations and messages that come in via the Service, and with the information you have supplied yourself.
Can I see what the chat says to my customers?
Yes. Every conversation is stored in your CRM. You read along, adjust answers and take over the conversation whenever you want.
Where can I read more about my privacy?
In our privacy statement. Clients of Viva67 find the arrangements about their data in the data processing agreement.