Privacy policy
Last updated: 2 October 2026
What happens to your data when you use this site, submit a form or run the website check, and when you build your own site with an account on app.verselli.be.
1. Who is responsible
Mohammed Haibout, trading as Verselli — Sint-Rumoldusstraat 25, 2800 Mechelen, België. Enterprise number (KBO/BCE) 1041.718.434. VAT BE 1041.718.434 (VAT-registered since 3 October 2026: 21 % VAT is added to our prices). Email: info@verselli.be.
Verselli is the controller for the personal data collected through this site.
2. What we collect and why
This site only collects data you enter yourself: in one of the two forms — the contact form or the quote form — or in the website check, when you ask there for the full report. This site itself has no accounts, no newsletter, no profiling and no advertising. Your account for building your own site lives on app.verselli.be; § 4 covers it.
If you are a client and we sent you a design link, there is one more place: the page where you choose which example we build your site from. It holds no name and no email address — only your choice, under a random code that we link to your file.
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Name, email address, message | Answering your enquiry | Steps taken at your request prior to a possible contract (art. 6(1)(b) GDPR) | Up to 24 months after last contact, unless a client relationship begins |
| Phone number and company name (optional) | Contacting you about your request | Steps taken at your request prior to a possible contract (art. 6(1)(b) GDPR) — you choose whether to fill these in | Same as above |
| Summary of your configuration | Preparing a quote | Steps taken at your request prior to a contract (art. 6(1)(b) GDPR) | Same as above |
| Design choice (clients only): the example we start from, one style preference and the colours you gave at intake — under a random code, with no name and no email address | Building your site from the starting point you chose yourself | Performance of the contract (art. 6(1)(b) GDPR) | 180 days |
| Website check: the address of the site checked, your email address, the score and rating, the suggested package and the language | Emailing you the report and following up once on your request | Report: steps taken at your request (art. 6(1)(b) GDPR) · Follow-up: legitimate interest (art. 6(1)(f) GDPR), with the right to object | 12 months |
| Technical logs (IP address, browser) at the hosting provider | Security and correct operation of the site | Legitimate interest | Kept briefly by Cloudflare under its own retention policy; we keep no copy ourselves |
| Aggregated, cookieless visit statistics (page visited, referring site, country, device type — no name, no unique identifier) | Understanding how many people visit the site and which pages get read | Legitimate interest (art. 6(1)(f) GDPR) | Kept under Cloudflare’s own retention policy; we keep no copy ourselves |
We ask that you not include special categories of data in your message — health, religious belief, sexual orientation and the like — and we do not knowingly process such data. We do not process data about children. You are never legally or contractually required to give us data. If you leave a form’s required fields empty, the only consequence is that we cannot answer your enquiry.
3. The website check
The free website check works in two steps. You see the score straight away without entering anything — at that point we keep nothing about you. If you then ask for the full report, you enter your email address, and that we do store.
What we keep is a single short line: the address of the site you had checked, your email address, the score and the rating that goes with it, the package the tool suggested, the language you read the check in, and the time. Nothing else. We do not keep the page we fetched, the individual findings, or the report we send you.
Why: so we can email you the report, and so we can follow up on your request afterwards — you asked us to look at your site. We do not add you to a newsletter and we do not pass your address on to anyone.
How long: twelve months. After that the line disappears by itself; that is built into the storage, no manual clean-up is involved. Want it gone sooner? Email info@verselli.be — we erase everything attached to your address and confirm that we have.
4. Your account on the platform (app.verselli.be)
If you create an account on app.verselli.be to build your own website or webshop, Verselli is the controller of your account data and your invoices. What is on your website, and what your customers and visitors fill in there, we process on your behalf: the data processing agreement (app.verselli.be/dpa) covers that. Your shop’s database, its nightly copies and your photos are at Cloudflare in the European Union. Your customers read about it on your own site’s privacy page.
If you use the same email address for the website check, a form on this site and your account on app.verselli.be, we may look at that data side by side when we help you or follow up, so we don't have to ask you the same thing twice. We only make that connection at that moment, based on your email address, and we keep no separate link or profile; each item is kept for as long as stated above. Basis: legitimate interest (Art. 6(1)(f) GDPR). You can object at info@verselli.be. A website check without an email address is never linked.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Your email address; if you give them, your name, your password (stored hashed only) and whether you sign up as a business, with your enterprise number | Your account, signing in, and contact about your site | Performance of the contract (Art. 6(1)(b) GDPR) | As long as your account exists |
| Which version of the terms you accepted and when, and a hashed derivative of your IP address at signup | Evidence of what you accepted | Legitimate interest (Art. 6(1)(f) GDPR) | As long as your account exists |
| Login codes and sessions | Letting you sign in securely | Performance of the contract (Art. 6(1)(b) GDPR) | A code until it is used or expires; a session 30 days or until you sign out |
| Billing details: name or company name, address, VAT number, plan, amounts and payments, your Stripe customer number | Issuing invoices and following up payments | Performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR) | Invoices seven years (Art. 60 § 3 Belgian VAT Code; Art. III.86 Code of Economic Law), also after your account is deleted |
| The link to your Stripe account and, for each fee we receive through Stripe, the amount and the payment references (no data about your customers) | Our accounts | Legal obligation (Art. 6(1)(c) GDPR) | Seven years |
| If you buy a domain name in your studio: the holder’s details (name, address, email address, phone number and, if given, company name and VAT number) | Having the domain name registered and renewed in your name | Performance of the contract (Art. 6.1.b GDPR) | Not kept by us: we pass them once to the registrar Openprovider, which passes them to the registry of the extension; they keep them under their own rules. We keep the domain name, the expiry date and the prices for as long as your account exists, and the invoice for seven years |
| Your questions and messages to us, through Hulp (help) or by email | Helping you | Performance of the contract (Art. 6(1)(b) GDPR) | As long as your account exists |
| What you type into an AI feature of the studio, with the parts of your site it needs, processed by Anthropic | Producing a suggestion or answer | Performance of the contract (Art. 6(1)(b) GDPR) | What you keep stays in your site as long as your account exists; Anthropic does not train its models on this data |
| A log of important actions: what, when, by which account | Security and evidence | Legitimate interest (Art. 6(1)(f) GDPR) | As long as your account exists; if you delete your account, we remove your email address from it |
| Feedback in the Docs ("Was this page helpful?"): the page, yes or no, and the time. No free text. No IP address, no account, no cookie | Improving the guides | Legitimate interest (Art. 6(1)(f) GDPR) | 12 months |
| The security check at signup and sign-in (Cloudflare Turnstile): technical data from your browser and your IP address | Stopping abuse by bots | Legitimate interest (Art. 6(1)(f) GDPR) | Not kept by us |
| Backups: every night an encrypted copy (AES-256) of every shop’s database and of the platform database, in Cloudflare storage in the European Union | Being able to restore data after an outage | Legitimate interest and security (Art. 6(1)(f) and Art. 32 GDPR) | 7 daily, 4 weekly and 6 monthly copies: deleted data is gone from every copy after six months at the latest |
Emails about your account (login codes, invoices, reminders) are sent through Resend. You pay your subscription through Stripe; for that, Stripe is our processor and also a controller in its own right, for example for fraud prevention. If you connect your own Stripe, Mollie or Sendcloud account for your webshop, you contract with them yourself, and they process data under their own terms and privacy policy. To have your account deleted, ask in your studio or at info@verselli.be: we delete everything except the invoices we must keep.
5. Cookies
This site sets no cookies. It does use Cloudflare Web Analytics, a cookieless visit counter that stores or reads nothing on your device. Why that needs no consent, and exactly what it measures, is in the cookie policy.
6. Who we share it with
| Recipient | Role | Location |
|---|---|---|
| Cloudflare | Hosting the site and the form and check endpoints, and the cookieless visit statistics (Cloudflare Web Analytics) | Cloudflare’s global network — transfers covered by the EU–US Data Privacy Framework and the Standard Contractual Clauses in Cloudflare’s data processing addendum |
| Cloudflare (Workers KV) | The store holding the website-check requests, the one short line per form submission and a client’s design choice | Same network and same safeguards as above |
| Resend (Resend, Inc.) | Sending the emails the forms and the check generate | United States — transfer covered by the EU Standard Contractual Clauses |
| Combell | The info@verselli.be mailbox your message arrives in | Belgium |
| Stripe | Payment of your platform subscription (§ 4) | Ireland and United States — transfer covered by the EU-US Data Privacy Framework and the standard contractual clauses |
| Anthropic (Anthropic, PBC) | The AI model behind the studio’s AI features (§ 4) | United States — transfer based on the standard contractual clauses in Anthropic’s data processing addendum |
| Openprovider (Hosting Concepts B.V.) | The registrar through which we register and renew a domain name you buy in your studio (§ 4) | Netherlands |
| The registry of the extension (DNS Belgium for .be, SIDN for .nl) | Keeps the register of that extension’s domain names, as a controller in its own right, under its own terms and privacy policy | Belgium, Netherlands |
We do not sell your data and do not share it with others except where legally required. Each recipient processes the data only on our instructions, except the registry of a domain name you buy: it keeps the register under its own responsibility.
7. Transfers outside the EEA
Email delivery goes through Resend in the United States. That transfer is covered by the European Commission’s Standard Contractual Clauses.
For the platform (§ 4): the platform database and the backups are at Cloudflare in the European Union. What you type into an AI feature goes to Anthropic in the United States, on the basis of the standard contractual clauses. Stripe processes the payment of your subscription under the EU-US Data Privacy Framework and the standard contractual clauses.
The website check requests, the one short line per form submission and a client’s design choice are kept in Cloudflare Workers KV. That storage runs on Cloudflare’s network and is not limited to the European Economic Area. We would rather say so plainly than imply that everything stays in Europe. That storage is likewise covered by the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses. You can request a copy of these safeguards via info@verselli.be.
8. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and the right to withdraw a consent you have given without affecting earlier processing.
To exercise any of these, email info@verselli.be. We respond within one month.
9. Complaints
If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Belgian authority:
Data Protection Authority — Drukpersstraat 35, 1000 Brussels — contact@apd-gba.be — www.dataprotectionauthority.be
10. Security
The site runs entirely over HTTPS. What you type into a form reaches us as email in a single mailbox, accessible only to the owner. In addition we keep one short line per submission in a protected store at Cloudflare, so we know how many enquiries arrive and which still need an answer: your name, your email address, optionally your phone number and company name, the language, the time, the text of your message and, for a quote request, the chosen package, the amount and your configuration code. If your request came from the self-serve platform (via "Let Verselli finish it" while building your site), we also keep: your site’s name and what you had already filled in there, so we do not have to ask you the same thing twice. Your message also still reaches the mailbox, as described above. That store is readable only with a key that only we hold. Fonts are served locally and no external maps or video are embedded.
11. Changes
The current version of this policy is always at this address, with the date of the last update at the top.