Privacy policy

Company name

Palau BV

Registered address

Tabakvest 9, 2000 Antwerp, Belgium

Privacy contact

Simon Hendrickx – simon@palauproject.com

General contact email

info@palauproject.com

Data protection law

We are subject to the EU General Data Protection Regulation (GDPR)

This Privacy Policy applies to:

• Visitors to our public website
• Registered users of our SaaS platform

A. Website visitors

We may collect:

• Form submission data (e.g., name, email address)
• Anonymous identifiers (via cookies and analytics)
• Browser and device information
• Navigation behavior (via service worker)
• User preferences (e.g., sidebar state)
• Template interaction data (e.g., upvotes)

B. SaaS platform users

We collect:

• Authentication data (email, name, profile picture if signing in via Google/LinkedIn)
• Uploaded files (e.g., spreadsheets, PDFs)
• Responses to CSRD, VSME, or similar regulatory datapoints
• Interaction and usage analytics (via PostHog and Heap)
• AI chat data (processed via Cohere)
• Payment details (via Stripe)
• Session data and access tokens (via Auth0)

We do not collect any sensitive personal data (e.g., health, political opinions).

We collect data:

• Directly from users via forms and file uploads
• Automatically via cookies, analytics, and service workers

And through third-party providers:

• Authentication: Auth0
• AI assistant: Cohere
• Payments: Stripe
• Analytics: PostHog, Heap
• Email delivery: EmailJS
• Hosting & backend infrastructure: Vercel, Supabase

We rely on the following legal grounds:

• Performance of a contract – for user accounts and services
• Legitimate interest – for service improvement and security
• Consent – for optional cookies and marketing communications
• Legal obligations – for financial and compliance requirements

We use personal data to:

• Operate and maintain the Palau platform
• Respond to inquiries and support requests
• Deliver ESG/CSRD-related tools and training
• Analyze and improve service functionality
• Manage payments and billing
• Provide AI-assisted interactions
• Send service updates and policy notifications

We share data with:

• Auth0 (authentication) – EU/US
• Stripe (payments) – Ireland/US
• PostHog, Heap (analytics) – EU-based storage
• Cohere (AI) – US (only for AI chat data)
• Vercel (hosting and website deployment) – EU/US
• Supabase (database and authentication support) – EU
• EmailJS (form-based email delivery)

All providers are under contract with us and bound by GDPR-compliant Data Processing Agreements (DPAs).

We use functional and optional cookies on both the website and platform, including:

• Session cookies to keep users logged in
• Analytics cookies to monitor usage patterns
• Preference cookies to store UI settings

Where required, a cookie consent mechanism is displayed.

Some subprocessors (e.g., Cohere, Vercel, Stripe, Auth0) process data in the United States. We rely on:

• Standard Contractual Clauses (SCCs) or
• Adequacy Decisions where applicable

We take steps to ensure your data receives an adequate level of protection.

We retain:

• Account-related data for the life of the account
• Uploaded files and user input data until deleted by the user or upon request
• Aggregate analytics data indefinitely (non-personal)

Upon account deletion, all personal data is removed from our systems.

We apply industry best practices to secure your data:

• End-to-end encryption (at rest and in transit)
• Access restricted to authorized personnel only
• Regular reviews of security protocols

You have the right to:

• Access the data we hold on you
• Correct inaccurate data
• Delete your account and all associated data
• Restrict or object to certain types of processing
• Receive a copy of your data (data portability)

To exercise your rights, email: info@palauproject.com

Our services are not intended for children under 16, and we do not knowingly collect data from them.

We will notify users of significant changes to this Privacy Policy via email. Minor updates will be reflected on our website with the updated date shown at the top.

For questions about this policy or your data, contact: