Last updated: 18 October 2026
This policy explains how Elevate BV processes personal data when you visit https://actavero.com, create an account or use the Actavero service. We process personal data in line with the EU General Data Protection Regulation (GDPR) and Belgian data protection law.
1. Who we are
The controller of your personal data is Elevate BV, Besloten Vennootschap (BV), Linthout 29, 9300 Aalst, Belgium, enterprise number BE 0746.793.793 ("we", "us"). For any privacy question, write to info@actavero.com.
2. What we process, why and on which basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: e-mail address, name and profile picture (when you sign in with Google), password (stored hashed) | Creating and securing your account, signing you in | Performance of the contract (art. 6.1.b GDPR) |
| Workspace data: your company, the competitor websites you add, your settings | Delivering the benchmarks, signals and e-mails you asked for | Performance of the contract |
| Notification preferences and e-mail delivery data | Sending the weekly digest and alerts you opted into | Performance of the contract |
| Usage of the app: which pages you open after signing in, when and for how long (no cookies or tracking across websites) | Supporting your account and improving the product | Legitimate interest (art. 6.1.f GDPR) |
| Technical data: IP address, browser type, request logs | Operating, securing and debugging the service, preventing abuse | Legitimate interest (art. 6.1.f GDPR) |
| Billing data: company name, VAT number, invoice address, payment status | Invoicing and bookkeeping | Legal obligation (art. 6.1.c GDPR) and the contract |
| Messages you send us | Answering your question and providing support | Legitimate interest, or steps prior to a contract |
We do not sell personal data, do not use it for advertising and do not make automated decisions that produce legal effects for you.
3. Public website data we analyse
Actavero measures publicly accessible websites (your own and those of the competitors you add): page content, metadata, robots.txt and sitemaps. These pages are about companies, not individuals. Should a public page contain personal data (for example a name on a team page), it is processed only incidentally, as part of a technical snapshot of that page, based on our legitimate interest in providing a website benchmark. You can object at any time via info@actavero.com.
4. Who receives your data
We use carefully selected service providers ("processors") who process data only on our instructions and under a data processing agreement:
| Provider | Service | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Ireland) |
| Cloudflare | Hosting, content delivery, security and website measurements | Global network; EU–US Data Privacy Framework and standard contractual clauses |
| Resend | Sending service e-mails (sign-in, digest, alerts) | United States; standard contractual clauses |
| Sign in with Google (only if you choose it); PageSpeed Insights for performance measurements (receives website addresses only) | EU–US Data Privacy Framework | |
| Anthropic | AI analysis of public information: the content of web pages, search keywords, answers to market questions, market profiles and brand perception (no account data) | United States; standard contractual clauses |
| DataForSEO | Search, AI search volume, backlink and online-mention data for the websites and keywords you track (receives website addresses and keywords, no account data) | Outside the EEA; standard contractual clauses |
| ScrapeCreators | Public data of the social media accounts you enter: followers, posts and their engagement (receives the account addresses, no account data) | United States; standard contractual clauses |
When data is transferred outside the European Economic Area, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's standard contractual clauses. We may also disclose data when required by law.
5. How long we keep data
- Account and workspace data: as long as your account is active, and deleted within 30 days after you close it (backups are overwritten in their normal cycle).
- Technical logs: up to 30 days, unless needed to investigate an incident.
- Usage of the app (pages opened and for how long): up to 12 months.
- Billing data: as long as Belgian accounting and tax law requires.
- Support messages: up to two years after the last contact.
6. Security
Data is encrypted in transit (TLS) and at rest. Access is limited to people who need it, workspaces are separated per organisation at database level, and passwords are stored only as hashes.
7. Your rights
You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time. Send your request to info@actavero.com; we answer within one month.
You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.
8. Cookies
We use only what is strictly necessary to keep you signed in. See our cookie policy.
9. Changes
We may update this policy when our service or the law changes. The date at the top shows the latest version; for material changes we notify account holders by e-mail.