Privacy Policy

mijnVast is operated by iVisdom (KVK 80815987), based in Uithoorn, the Netherlands. For any privacy question or request, contact hello@mijnvast.nl.

In short: we never get live access to your bank, statements are deleted after scanning, manual entry sends no document to AI, and we never sell your data. Details below.

Account: your email address, your password (handled by our authentication provider, never stored by us in plain text), and your name if you provide one.

Subscription and contract data: whatever you enter or upload about your insurance policies, utilities, and subscriptions, including provider names, amounts, dates, policy or account numbers, and any contact details or notes you add.

Documents: contracts or policy documents you upload are stored so you can refer back to them, along with the structured data our AI extracts from them (amounts, dates, provider names, and similar fields).

Statements: bank or card statements you upload for bulk import are processed to find recurring charges and then deleted. We do not keep them.

Usage record: we record that an AI import happened and when, to keep within fair usage limits. This record does not include the contents of what you uploaded or what was extracted from it.

We do not ask for or store payment card details ourselves. If paid plans launch, that will go through a payment processor that handles your card details directly, not through our servers.

We do not connect to your bank account. Statement import works from a file you choose to upload yourself. mijnVast never gets live or ongoing access to your bank.

To run the service: storing your subscriptions and contracts, sending reminders before things renew, and using AI to read documents you upload so you do not have to type everything by hand.

We use a small number of service providers to run the app, each only for what they need to do their job.

Supabase for the database, authentication, and file storage. Google (Gemini API, paid tier) to read uploaded documents and statements and extract structured data - under Google's paid-tier terms, this data is not used to train their models. Resend to send reminder emails and to receive emails you choose to forward to your personal forwarding address. Vercel to host the application and to provide cookieless, privacy-friendly analytics (aggregated page-view counts only, no personal profiles).

Some of these providers are based outside the EU (Google, Resend, and Vercel are US companies). Where that applies, the transfer is covered by Standard Contractual Clauses or another safeguard recognized under GDPR, under that provider's own data processing terms.

We do not sell your data, and we do not share it with advertisers. We do not have advertisers.

For as long as your account is active. Uploaded bank or card statements are deleted after processing, as described above. To request deletion of your account and data, see “Your rights” below.

Under GDPR, you can ask us to access, correct, export, restrict, object to, or delete your personal data at any time. Email hello@mijnvast.nl and we will act on it. There is no self-service delete button yet, so for now this is a manual request we handle directly.

You also have the right to lodge a complaint with your national data protection authority. In the Netherlands, that's the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

We use a minimal session cookie to keep you signed in. No advertising or tracking cookies.

If this policy changes in a meaningful way, we will update the date above and, for significant changes, email active accounts.