Privacy and cookies · updated 20 October 2026
What Vebrix keeps about you.
In short: an e-mail address to log in, the sites your agency adds and the scan results of those public websites. Two functional cookies, no tracking, no advertising, no parties from outside the EU on these pages.
01 / Who
Controller.
Vebrix is a service of [legal form and trade name], Dutch Chamber of Commerce [number], [address]. Privacy questions: privacy@vebrix.nl.
Vebrix scans websites passively, on behalf of web agencies, and looks only at what every visitor sees: connections to third parties, cookies, certificate and forms. The scan never logs in, fills in nothing and probes no hidden paths.
02 / What
Which data, what for and on what basis.
| Data | Purpose | Legal basis (GDPR art. 6(1)) | Retention |
|---|---|---|---|
| E-mail address, login links, sessions | Logging in without a password; the login e-mail | b: performance of the contract | Login link 15 minutes, session 30 days, account until cancellation plus 30 days |
| Agency: name, logo, colour, colleagues' e-mail addresses | Reports in the agency's branding; letting colleagues log in | b: performance of the contract. Whoever invites a colleague makes sure they agree | Until cancellation plus 30 days |
| Hostnames of websites an agency adds | Knowing what we scan for whom and when to rescan | b: performance of the contract | Until the agency removes the site |
| Scan results of public websites: third-party domains, cookie names and domains, certificate details, number of form fields, page language | The report. Results are shared between agencies (one scan per site); they are facts about a public website. No cookie contents, no data about that site's visitors | f: legitimate interest of agency and site owner in insight into their own website | 12 months after the last scan; earlier at the request of the site's owner |
| Technical web server logs (IP address, time, path) | Security and troubleshooting | f: legitimate interest | [14] days |
Vebrix makes no automated decisions about you and does not use your data for marketing. A language model never changes a finding; everything a model writes is labelled, and no US model is used in a report about sovereignty.
03 / Cookies
Two cookies, and why there is no banner.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| vebrix | Session: keeps you logged in after the login link | 30 days | functional, HttpOnly, SameSite=Lax, Secure |
| vebrix-taal | Remembers Dutch or English | 1 year | functional |
| vebrix-thema (localStorage, not a cookie) | Remembers light or dark | until you clear it | functional |
That is all. No analytics, no advertising cookies, no third-party cookies, and the fonts are served from our own server. Because the cookies only serve to keep you logged in and remember your language, no consent is required (article 11.7a(3) of the Dutch Telecommunications Act, implementing the ePrivacy Directive) and therefore no cookie banner. The website www.vebrix.nl sets no cookies at all.
04 / Who else
Processors and recipients.
- Brevo (Sendinblue SAS, Paris, France) sends the login e-mails. They see your e-mail address and the link. Data processing agreement: Brevo's standard DPA.
- Hosting: [provider, city, country]. The database and scan results are stored there.
- No transfers outside the European Economic Area. No selling or renting of data.
05 / Your rights
Access, correct, delete.
You have the right to access, rectification, erasure, restriction, portability and objection. E-mail privacy@vebrix.nl; you will get a reply within a month. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Own a website that was scanned? We scan like an ordinary visitor, with our own user agent carrying a contact address and at most two requests per second. If you no longer want your site scanned, e-mail privacy@vebrix.nl; we exclude the site and delete the results.
06 / Security
How we protect it.
- Login links are single-use and valid for 15 minutes; there are no passwords to leak.
- The session cookie is HttpOnly, SameSite=Lax and https-only.
- Every change in the app checks the origin of the request. Agencies only see their own sites.
- Daily backup of database and scan results, stored encrypted at [provider].
Changes to this statement are posted here with a date. For a material change, logged-in users receive an e-mail.