Privacy statement

Version 1.0 of 19 October 2026

This statement is written in English; the English text is binding.

This statement tells you which personal data we process, why, on what legal basis, who we share it with, how long we keep it and what your rights are. It meets article 13 of the General Data Protection Regulation (GDPR, in Dutch: AVG).

1. Who we are

1.1 The controller is Sounds Global B.V., trading as AppIn7Days. From here on we call ourselves "AppIn7Days" or "we".

1.2 Our address is Mariënpoort 12, 8701 XZ Bolsward, Nederland. Our Chamber of Commerce (KvK) number is 88875539.

1.3 For any question about privacy, e-mail privacy@appin7days.com. If you have an Account, you can also send us a message in the platform.

1.4 We have no data protection officer. The law does not require one, because our core activities do not consist of monitoring people on a large scale or processing special categories of personal data on a large scale (article 37 GDPR). Your contact for privacy is privacy@appin7days.com.

2. Our two roles

2.1 For the data in our own platform (my.appin7days.com) and our public site (appin7days.com) we are the controller. This statement is about that data.

2.2 For the personal data in the apps we build and run for clients, in Previews and in uploads, we are a processor. The Client is then the controller, and we work under the Data processing agreement the Client signs with us (article 28 GDPR).

2.3 Do you use an app one of our clients runs? Then that client is your point of contact for privacy. We help the client answer your request.

2.4 A Preview holds only Test data: made-up data that describes no real person or company. Real personal data only enters the production app, and only after the Data processing agreement is signed.

2.5 We keep a record of all our processing activities (article 30 GDPR).

3. What we process, why, and on what basis

3.1 We process only the data our platform needs. For each purpose, the table shows the data and the legal basis under article 6(1) GDPR.

3.2 Many rows in the table rest on the contract. Are you a member of an Organisation, but not yourself the contracting party? Then we process your data for those purposes on the basis of legitimate interest (6(1)(f)). The Client's organisation needs its people in the platform to perform the agreement.

3.3 A Pin never records typed input, cookies, tokens, or the bodies of requests and responses. You see everything a Pin recorded, and you can remove its screenshot.

3.4 When you set up your Organisation, we check its KvK number with the Chamber of Commerce. For a client in another EU country, we check its VAT number in VIES and keep the result.

3.5 Do not upload real personal data with a Build request. The platform warns you, and asks you to confirm or anonymise data that looks like names, e-mail addresses or phone numbers.

4. What we do not do

4.1 We build no marketing profiles and sell no data.

4.2 We never send personal data from the platform or from apps, production data, credentials or Pin screenshots to AI services. Only the name and e-mail address of the author of a change can go along with the source code (6.4).

4.3 We take no decisions based solely on automated processing that have legal effects for you (article 22 GDPR). Deadlines in the platform do run out on their own, as agreed in the Build brief. For example, no decision on the Demo counts as Approved. That is an agreement, not profiling.

5. Where your data comes from

5.1 You give us most data yourself, when you create an Account, set up an Organisation or use the platform.

5.2 If an Organisation admin invites you to an Organisation, we get your e-mail address from that Organisation admin.

5.3 An Account cannot exist without a verified e-mail address. An Organisation cannot exist without its name, registration number and address. Without them we cannot enter into an agreement with you.

6. Recipients and sub-processors

6.1 Within AppIn7Days, only staff assigned to one of your Organisation's Projects, or on duty for your Organisation, see that Organisation's data. We record every time one of our staff views your Organisation's data.

6.2 We use these sub-processors:

Our watch on the platform from outside runs on a Scaleway server in the Netherlands, Amsterdam region. That server receives no personal data.

6.3 Our code host is GitHub, Inc. Until it is paid in full, your app's code lives in a private repository in AppIn7Days' organisation on GitHub. For those repositories GitHub is not our sub-processor: GitHub works there under its own terms and privacy statement, as an independent controller. The same holds for the own GitHub account of everyone who works in those repositories, the Client's people and ours. After that the code lives in the Client's own organisation, if the Client wishes, with the Fundamental mirror. There the Client's own agreement with GitHub applies. Every change to the code carries its author's name and e-mail address. Our GitHub app gets write access only to the repositories the Client selects. The Client can revoke that access at any time. GitHub is certified under the EU–US Data Privacy Framework; see 7.3.

6.4 We only use AI coding services on our approved list. That list holds Claude Code by Anthropic Ireland, Limited, on the seats of our business account with Anthropic. Their contract forbids them to train on the data. They keep it at most 30 days as standard; longer only where they suspect a breach of their usage policy, or where the law requires it. Sharing feedback and conversations is switched off. They receive source code, and with it at most the name and e-mail address of whoever made a change to that code. They never receive other personal data (4.2).

6.5 If a Partner referred your Organisation to us, that Partner sees, per Build request, only your Organisation's name, its status and its own commission. The Partner sees more only if your Organisation adds the Partner's people as members.

6.6 Payments run through Mollie B.V. in the Netherlands. Mollie is a licensed payment institution with its own legal duties. That makes Mollie an independent controller for payment data, not our sub-processor. Mollie receives the organisation's name and address, amounts, payment details and the direct debit mandate.

6.7 We do not sell, rent or give your data to anyone else, unless the law requires us to.

7. Your data stays in the EU

7.1 We store and process personal data, production data, backups, logs, Previews and production apps in the European Union or the European Economic Area. There are four exceptions, in 7.2 to 7.5.

7.2 Approved AI coding services may process source code (6.4). Our contract is with Anthropic Ireland, Limited; Anthropic also processes the data in the United States. That transfer rests on the European Commission's standard contractual clauses, which are part of Anthropic's data processing addendum. You can ask for a copy of those clauses at privacy@appin7days.com.

7.3 The code host, GitHub, may process source code, and the GitHub accounts of the people who work on that code (6.3). GitHub is a US company, certified under the EU–US Data Privacy Framework. The transfer rests on the European Commission's adequacy decision for that framework (article 45 GDPR).

7.4 A Native app's distribution, notarisation and signing, and its push messages, run through Apple, Google and Microsoft, under the Client's own accounts and its own agreement with those providers. They are not our sub-processors. A push message holds no personal data.

7.5 Our own business e-mail runs on Google Workspace, with its data stored in Europe. Google is a US company, certified under the EU–US Data Privacy Framework. The transfer rests on the European Commission's adequacy decision for that framework (article 45 GDPR). It covers only what you and we write to each other by e-mail.

7.6 Personal data in the Client's app, the production data, the backups and the logs always stay in the European Union or the European Economic Area.

8. How long we keep data

8.1 We keep data no longer than its purpose needs:

8.2 When an Organisation admin deletes an Organisation, we delete everything not under a legal retention duty within 90 days. It leaves the backups as those backups expire.

8.3 We never delete data because an invoice is unpaid.

9. How we protect your data

9.1 All traffic is encrypted over HTTPS. Databases, backups and files are encrypted at rest. Pin screenshots, uploads and signers' details get an extra layer of encryption.

9.2 We store no passwords. You sign in with a passkey or a one-time code by e-mail. Our staff always sign in with a passkey.

9.3 Every Organisation is sealed off from every other Organisation. On every change, automated tests try to read another Organisation's data. If one succeeds, the change does not go through.

9.4 Logs hold no secrets, no typed values and no personal data beyond identifiers.

9.5 An Organisation admin can ask us which of our staff opened what, and when. We send that overview within 5 working days of an Organisation admin's request.

9.6 We make backups continuously, in another country than the servers. Every backup is locked: no one, ourselves included, can delete or change it before it expires. If a server fails, we restore the data from those backups onto a new server.

10. When something goes wrong: data breaches

10.1 If a data breach affects your Organisation's data, we report it to your Organisation without undue delay, and at the latest within 24 hours of confirming it. That leaves your Organisation time to meet its own duty to report.

10.2 If a data breach affects our own personal data, we report it to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) within 72 hours where the law requires it (article 33 GDPR). If you face a high risk, we also tell you directly (article 34 GDPR).

11. Your rights

11.1 You have the right of access, rectification, erasure, restriction of processing, objection and data portability (articles 15 to 21 GDPR).

11.2 In the platform you can view, export and correct your own data yourself. You can also ask for erasure there, and delete your Account.

11.3 You ask for restriction or object in the platform or by e-mail to privacy@appin7days.com. If you have no Account, e-mail us for any request.

11.4 We handle every request within one month.

11.5 Where we process data on the basis of your consent, you can withdraw that consent at any time. What we did before remains lawful.

11.6 Where we process data on the basis of our legitimate interest, you can object. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data for a legal claim.

11.7 Some data we cannot delete or change:

• Invoices and payments must be kept for the tax authorities.
• Records are only ever added to, and any change to a Record can be shown: they prove what was agreed and what happened.
• Messages and Pins are not deleted. If you leave an Organisation, your messages and Pins stay there, with your name.
• If you delete your Account, your messages and Pins show "deleted account" instead of your name. Records name your Account by its identifier only. Only a document you signed, and the Record of that signature, keep your name: they prove who signed. We keep those as long as section 8 states for signed documents.

11.8 You cannot delete your Account while you are the last Organisation admin of an Organisation with a running Build, an unpaid invoice or an active subscription. Make someone else Organisation admin first.

11.9 Do you disagree with how we handle your data? You can complain to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority, autoriteitpersoonsgegevens.nl), or to the supervisory authority of the EU or EEA country where you live or work. We would like to hear it first, so we can put it right.

12. Cookies

12.1 We use one cookie per site: a functional session cookie that keeps you signed in. It expires after 14 days without use.

12.2 A Preview lives at its own address, so it sets its own session cookie.

12.3 We use no analytics cookies and no tracking cookies. That is why we do not ask for consent and you see no cookie banner (article 11.7a of the Dutch Telecommunications Act).

12.4 The platform loads no scripts from other parties. Our pages, e-mails and documents load no fonts from other parties.

12.5 Our public site collects no statistics.

12.6 If you start a Build request without signing in, your own browser keeps the draft. That is needed to let you finish your Build request, so we do not ask for consent. We receive the draft only when you send it or save it under your e-mail address.

13. New sub-processors

13.1 Before we add a sub-processor, we tell every Organisation in the platform 30 days in advance.

13.2 Your Organisation may object to a new sub-processor. Your Organisation may then end the service we use that sub-processor for, without cost, before the change takes effect.

14. Changes to this statement

14.1 Every version of this statement has a version number and a date. We announce a new sub-processor in advance, as article 13 says.

14.2 We announce a new version of this statement in the platform 30 days before it applies.

14.3 Does a new version only correct how this statement describes processing already running, without adding a purpose, category of data, recipient or sub-processor? Then it applies from publication. We announce that version in the platform too.