Skip to main content
Praxikon
Agent check
Back to home

Privacy Policy

Praxikon | a trade name of Embed AI

Last updated: 4 November 2026

1. Identity of the data controller

This website (praxikon.com) and the associated platform are provided by:

Embed AI Operating under the name: Praxikon Chamber of Commerce (KVK): 90283597 Email: info@embedai.nl

Hereinafter referred to as "Praxikon", "we", "us" or "our".

2. What data we collect

2.1. Data you provide to us:

  • Email address (when downloading templates, subscribing to our newsletter or participating in quizzes)
  • Contact details (when using the contact form)
  • Name and organisation (if provided by you)

2.2. Automatically collected data:

  • IP address and browser data
  • Device information (type, operating system)
  • Visit statistics and page views
  • Interaction data (click behaviour, scroll depth)

2.3. Data via tools and interactive features:

  • Scan results (AI Literacy Scan)
  • Results from compliance tools (AI Readiness Score, risk classification, fine calculator)
  • Template download history

2.4. Praxikon Radar:

  • The check itself is anonymous: you pick fixed answer options and see your obligations immediately, without an email address and without an account.
  • If you want alerts, we store your email address, your chosen answer options, an optional label for your system and optionally your organisation and where you are in the process. The last two are not required.
  • From your answers and your email domain we derive an indication of sector, role and relevance, so that we can warn you specifically rather than about everything.
  • Signing up uses double opt-in: without confirmation via the link in the email we send nothing. Every alert carries a link to view your profile and unsubscribe with one click.
  • We do not ask for a free-text description of your system, precisely to keep commercially sensitive information out of our hands.

2.5. AI Act Implementation Map:

  • The map asks for fixed answer codes only, not a name, organisation, email or free-text system description.
  • Answers and the exported record are stored in your own browser by default.
  • The assessment endpoint processes answer codes statelessly and does not store the profile or record in a database.
  • The share button sends only a short summary and a clean tool link. Answer codes are not placed in the URL; use the JSON export to transfer the full record.
  • The implementation map route is excluded from lead attribution, analytics page views, session recordings and marketing tags. Only technical, consent-based product events without answer content may be measured.
  • Regular technical server logs may, as with other website requests, temporarily contain an IP address and request metadata.

2.6. Case check (casus-check):

  • Your case is read and assessed in your own browser, with fixed rules and without an AI model. The text of your case is not sent to us and not stored.
  • If you upload a file (PDF, Word, email or text), it goes only to our server in the EU to extract the text. The file and the text are not stored or logged.
  • To improve the check we keep, per assessment and anonymously: which answers were prefilled, which you changed, which DPIA-list categories you chose, the outcome per test, counts (such as the number of sentences) and your optional rating "correct" or "not correct" with a reason from a fixed list. These are only choices from fixed lists: no text, no file name, no IP address, no cookie and no time of day. This data cannot be traced back to you and is therefore not personal data under the GDPR.
  • Session recordings are off on the case check page.
  • Report by email and alert on change. After the assessment you can ask for the report by email, plus an alert when the law or a guideline changes one of your outcomes. The assessment stays visible without an email address. The only purpose is to send you the report and to alert you when an outcome changes.
  • For this we keep your email address, the language, when you asked, confirmed and unsubscribed, when we last emailed you, the version of the rules and the outcome per test (for example "DPIA: required").
  • Your answers, after you confirm. What we keep: your answers to the fixed questions of the check, as you confirmed them, for example "domain: recruitment" or "automated decision: don't know". These are only choices from fixed lists. We do not keep the text of your case, sentences from it, a file name or any other free text. Why: when the rules change because of a new law, a guideline or a court ruling, we recompute your outcome with the same answers and the same fixed rules, without an AI model. Only if an outcome really changes do we send you a short alert. When: only after you click the button in the confirmation email. Until then your answers sit only in the secured confirmation link in your own email. How long: as long as your address is on the list, and deleted together with it, at the latest two years after the last email we sent you (see 4). Unsubscribing: through the link in every email. We then erase your answers straight away and the rest of your request within the period in 4.
  • The legal basis is your consent (Art. 6(1)(a) GDPR), with double opt-in: unless you click the button behind the link in the confirmation email, we send no report and no alert. Every email has an unsubscribe link; you can withdraw at any time. We do not use the report email for the newsletter or other marketing.
  • DPIA intake and FRIA draft by email. If you ask for the Word files by email, we keep with that request your work email address, the language, your answers to the fixed questions (choices from fixed lists only, never the text of your case), when you asked and confirmed, through which page or campaign the request came in, and whether you separately chose the newsletter. The purpose is to send you the files; they come only after the click in the confirmation email. The legal basis is your consent (Art. 6(1)(a) GDPR). You only join the newsletter if you tick that separately. Retention: see 4.
  • Request for a signed assessment. If you ask for a proposal under the verdict, your fixed answers travel to the request form behind the hash (#) of the link, without reaching our server; if you send the request without removing them in the form, we keep those answers (choices from fixed lists only, never the text of your case) with your request, on the same legal basis and for the same retention period as the contact form.

2.7. Praxikon in AI assistants:

  • You can add Praxikon as a connection to your own AI assistant, for example Claude, ChatGPT or Microsoft Copilot. When you ask a question about the AI Act or the GDPR there, your assistant sends the parts that are needed (such as fixed answer codes about your system or the identifier of an obligation) to Praxikon, and Praxikon sends back the published data with its sources.
  • Your question reaches us through the AI assistant you use yourself. What that assistant keeps of your conversation falls under the responsibility and the privacy terms of its provider, such as Anthropic, OpenAI or Microsoft.
  • What we keep to improve Praxikon. We never see the conversation in your assistant, and we do not ask for it. We keep only part of what your assistant sends to Praxikon for a function: which function, whether it worked, the day (no time), the kind of assistant, the language, the choices from fixed lists (such as the case check answers or the identifier of an obligation) and the outcome (such as "DPIA: required" or "no answer found"). For a short general question we also keep the question itself, if it passes our filter (see below). We keep this without an IP address, account, cookie, session or time of day, and we do not link calls to each other. We do not keep the answers Praxikon sends back.
  • Why and for how long. This shows us what users ask, where Praxikon does not yet have a good answer and which topics and systems we should work out first. We do not use it for marketing or to train an AI model, and we do not share or sell it. We keep it for at most 12 months; after that only the anonymous daily count below remains. The legal basis is our legitimate interest in improving Praxikon (Art. 6(1)(f) GDPR).
  • Not keeping it. Tell your assistant that Praxikon may not keep your question, for example "do not keep my question". The assistant passes that on, and then we keep nothing of that call apart from the anonymous daily count. You can also object or ask for deletion at info@embedai.nl. Because we do not know whose question it is, please give the question and the day.
  • If you have the assistant check a case against the GDPR and the AI Act (the case check), it sends only the answers to the fixed fact questions, as choices from fixed lists (such as "domain: recruitment" or "personal data: yes"). There is no field for free text, names or the name of an organisation. Praxikon uses those answers to compute the outcome and keeps them, with the outcome, to improve Praxikon (see above). They are only choices from fixed lists and cannot be traced to you. Only the type of organisation (such as "public body" or "company") and the domain (such as "recruitment") count in the anonymous daily count below. The answers do not go into the anonymous usage data with which the case check on the site is improved.
  • If you ask the assistant for the DPIA intake (and, where relevant, the FRIA draft) as a Word file, Praxikon returns a summary and a link to the case check on our site. Your fixed answers sit in that link after the # sign, the so-called fragment. A browser never sends that part to our server: when you open the link, your answers do not reach us, a server log or analytics data. The page reads the answers in your browser, removes them from the address bar at once and builds the Word file in your browser. Praxikon does not keep the Word file. We keep the fixed answers the assistant sends for the DPIA intake as described above; when you open the link, the page sends nothing to us, not even anonymous usage data. If you choose delivery by email on that page yourself, your answers and your work email address do go to our server: we build the files from them and keep your answers with that request; you can download them only after the click in the confirmation email. Keep or share the link itself only if you want to: anyone who has it can read the answers.
  • If you ask a short, general question through the assistant (at most 200 characters), the assistant sends only that question to Praxikon to look up the answer. We ask the assistant to make the question general first, without names, contact details or other personal data, and we refuse a question with, for example, an e-mail address, phone number, other number or postcode. If the question passes that filter, we keep it to improve Praxikon (see above). If it still looks like it contains a name, e-mail address, phone number, other number, postcode or web address, we do not keep the text. We do not send the question to an analytics service and do not count it in the daily count. The answer does not contain the question.
  • In addition, we keep an anonymous count per day (for example "case check via Claude, public body, recruitment: 3 times"). It holds which function was used and whether that worked (and if not: whether the input was empty, whether it was wrong or whether it went wrong on our side), through which kind of assistant (such as Claude or ChatGPT), whether it was our own use, the language asked for (Dutch or English), for the supervisor per member state the country asked about, and for the case check and the DPIA intake the type of organisation and the domain from the fixed list of choices. We also count how often an assistant opens the connection and how often someone visits our site through a link in an answer; the latter without a cookie, with only the function, the language of the page and the site the click came from.
  • To tell which kind of assistant it is, we look at each request at the name the assistant gives itself, at the program that sends the request, and at whether the request comes from the published address range of Anthropic. For ChatGPT we also check whether the request carries ChatGPT's own metadata fields; we only check that those fields are there, not what is in them. We do not keep those details themselves, not with the kept questions either. The count holds no IP address, no browser data, no time and nothing of your question, and it cannot be traced to a person.
  • No account and no login are needed, and the connection sets no cookies.
  • If you ask the assistant to talk to a person, you get a link to a public booking page (Cal.com). Apart from a fixed topic label from a short list (for example "fria") as a campaign tag in the link, nothing of your conversation goes with it; you decide whether to book.
  • Links to our website in an answer carry fixed campaign tags (such as "utm_source=mcp" and the name of the function), so that we can see a visit came through the connection. They contain nothing of your question or your data. The one exception is the DPIA intake link above: it carries your fixed answers after the hash sign, in the fragment that the browser does not send to our server.
  • As with any web request, the technical server log may temporarily contain the IP address of the calling service and request metadata (see 4).

3. Why we collect this data

3.1. We use your data for the following purposes:

  • Service delivery: providing templates, tools and quizzes
  • Communication: sending our newsletter and updates about new templates and EU AI Act developments
  • Improvement: analysing and improving our website and services
  • Legal obligations: complying with applicable laws and regulations

3.2. Legal bases (GDPR Art. 6):

  • Consent (Art. 6(1)(a)): newsletter, marketing emails, the case check report by email and the alert on change, and the DPIA intake and FRIA draft by email
  • Legitimate interest (Art. 6(1)(f)): website analytics, security, service improvement, including keeping questions sent through AI assistants (see 2.7)
  • Legal obligation (Art. 6(1)(c)): fiscal and administrative obligations

3.3. Who receives your data (categories of recipients):

  • We do not sell your data and do not share it for advertising. We use a small number of service providers that process data on our behalf, each for one purpose:
  • Hosting and database: our own servers at Hetzner Online in Germany (EU). The website, the connection for AI assistants and our database run there.
  • Analytics: PostHog (EU region) and Google Analytics, both on the website only after you accept analytics cookies. The daily counts and the kept questions of the connection for AI assistants do not go to PostHog or Google Analytics; they are kept only in our own database (see 2.7).
  • Email: Resend, to send the emails you asked for, such as the newsletter, the case check report and alerts.
  • Booking a call: Cal.com, only if you choose to book a call. What you enter on the booking page is processed by Cal.com.
  • Authorities: only where the law requires us to.
  • Through the connection for AI assistants we pass nothing on to anyone. What we keep to improve Praxikon is shared with no one (see 2.7).

4. How long we keep your data

We do not keep your data longer than necessary:

  • Email addresses (newsletter): until unsubscription, then a maximum of 30 days
  • Radar profiles: until unsubscription, then a maximum of 30 days
  • Contact form data: maximum 2 years after last contact
  • Template download registrations: maximum 3 years
  • Quiz and test results: maximum 2 years
  • Analytical data: maximum 26 months
  • Server log files: maximum 90 days
  • Daily counts of Praxikon in AI assistants (see 2.7): maximum 400 days; these counts contain no personal data
  • Questions, choices and outcomes through AI assistants (see 2.7): maximum 12 months
  • Anonymous case check usage data: maximum 3 years, to improve the rules
  • DPIA intake and FRIA draft by email (see 2.6): a maximum of 3 years after the request, like template download records
  • Case check report by email: unconfirmed 30 days; after unsubscribing a maximum of 30 days; otherwise until two years after the last email we sent you (report or alert). Your stored answers follow the same period and are erased straight away when you unsubscribe

5. Your rights

5.1. Under the GDPR, you have the following rights:

  • Right of access: what data we process about you
  • Right to rectification: have incorrect data corrected
  • Right to erasure: have your data deleted
  • Right to restriction: restrict processing (temporarily)
  • Right to data portability: receive your data in a common format
  • Right to object: object to processing based on legitimate interest
  • Right to withdraw consent: withdraw previously given consent

5.2. You can exercise your rights by sending an email to info@embedai.nl. We will respond to your request within 30 days.

5.3. You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl).

6. Security

6.1. We take appropriate technical and organisational measures to protect your data:

  • TLS/SSL encryption on all connections
  • Encrypted storage of sensitive data
  • Access controls and minimal privileges
  • Regular security updates
  • Data minimisation (we only collect what is necessary)
  • Security headers (HSTS, CSP, X-Frame-Options)

7. Children

Our services are not directed at persons under the age of 16. We do not knowingly collect data from children. If you suspect we have collected data from a minor, please contact us.

8. Changes

8.1. We may amend this privacy policy. The most current version is always available on this page.

8.2. In the event of significant changes, we will inform you via the website or by email.

Contact

For questions about this privacy policy or exercising your rights:

Embed AI | Praxikon KVK: 90283597 Email: info@embedai.nl Website: www.praxikon.com