Privacy Policy

Last updated: August 7, 2026

Introduction

A14A B.V. ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you visit our website.

Analytics

We use self-hosted Umami Analytics and ChiliTrack to understand page usage, website performance, and how visitors interact with our pages. Both run on our own infrastructure in the EU; we do not sell or share this data, and it is never used for advertising.

Our current website configuration records:

  • Page views: the page URL, referrer, device and browser information, and coarse location derived from your IP address

  • Web performance: timing measurements such as how quickly pages load and respond

  • Interaction heatmaps: aggregated click and scroll positions, together with a copy of the page layout so those positions can be shown in context. Text you type into forms is masked before the copy leaves your browser

  • Session recordings: a sample of visits is recorded as a replay of the pages viewed and the mouse movement, scrolling, and clicks within them. Form inputs are masked, but text that is visible on the page is part of the recording

  • Browser errors: when a script on our site fails, we record the error message and the technical stack trace so we can fix it

  • The analytics scripts do not set advertising cookies

  • We do not use the analytics data for cross-site advertising

  • Session recordings are sampled rather than capturing every visit, and are deleted automatically after 90 days

  • Like any web service, our servers and analytics endpoints receive technical request data such as an IP address and user agent

We use this information to operate, secure, and improve the website. Access is restricted to authorized A14A personnel and service operators.

Chat support

We may enable the LemonChat support widget. When enabled, loading the widget sends technical request data to the configured LemonChat service. If you use the chat, we also process the messages and contact details you choose to provide so that we can respond.

Email Collection

When you join our waitlist, we collect your email address. This information is used solely to:

  • Send you updates about our venture programs

  • Notify you when applications open

  • Share relevant news about A14A

We will never sell, rent, or share your email address with third parties for marketing purposes. You can unsubscribe from our communications at any time.

Marble – Exact Online connection (version 2026-07)

Marble (A14A B.V.) offers an invite-only connection that exposes your Exact Online administration read-only through a secured REST/MCP interface. This section applies only to organisations that have explicitly connected an Exact Online administration to Marble.

What we process. Your Exact Online accounting data (relations, invoices, general ledger, cost centres, outstanding items) is read and passed through only — we do not store it. We retain only:

  • Encrypted OAuth tokens to maintain the connection, with division name and account ID

  • Your consent to this policy (timestamp, IP address, browser)

  • Technical audit logs of API requests (path, status, IP address, browser — never the contents of your administration)

  • The email address of a Marble portal account, where one is used to manage the connection

How. Exclusively through the official Exact Online API, after you explicitly authorise the connection via Exact Online's own OAuth login and agree to this policy.

Purpose. Performing the financial checks and month-end reporting you (or your AI assistant via the MCP connection) request. No resale, no profiling, no secondary use.

Retention. Audit logs are deleted automatically after 90 days. Tokens are kept for as long as the connection is active. Consent records are kept for as long as legally required.

Withdrawal and deletion. You can revoke the connection at any time — in Exact Online (App Center → managed apps) or via your Marble contact. On disconnection we delete the stored tokens. Data-deletion requests: privacy@a14a.org or douwe@a14a.org.

Security and location. Processed and stored in the EU on ISO 27001-certified infrastructure (Scaleway). Tokens are encrypted at rest (AES-256) and all traffic runs over TLS. Access to the connection is granted through scoped, revocable API keys that are stored hashed.

Sub-processors. Scaleway SAS (hosting, EU) and Resend (delivery of portal login links by email; processes the email address only).

Data Retention

We retain subscription information while you remain subscribed and for any additional period required for legal or suppression-list purposes. Analytics, operational-log, and chat data are retained only for as long as reasonably needed for the purposes described above, after which they are deleted or aggregated.

Your Rights

Under GDPR, you have the right to:

  • Access your personal data

  • Rectify inaccurate data

  • Request deletion of your data

  • Object to processing of your data

  • Data portability

Contact

If you have any questions about this privacy policy or wish to exercise your rights, please contact us at:

hello@a14a.org

A14A B.V.
Noordeinde 101
1121AJ Landsmeer
The Netherlands

Chamber of Commerce (KVK): 87105004