IdonisIdonisThis is a translation provided for convenience. In case of any discrepancy, the French version prevails.
Last updated: 6 November 2026
This policy describes how Vanbe SRL processes personal data in connection with the Idonis service, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel).
E-mail address, surname/first name, password (stored in hashed form, never in clear text), language (recorded on the
account and in an application cookie, see the Cookie
Policy) and preferences.
Purpose: creation and management of the account. Legal basis: performance of the contract.
Retention: for as long as the account exists, including during periods of inactivity or without a paid
subscription; on deletion of the account, see § 5.
At onboarding, optionally: the company you represent, your occupation, what you want to do
first, and your telephone number — requested at onboarding and when activating the Pro trial, without being
necessary to activate it. You may indicate
that you prefer to be contacted again by e-mail, and change or withdraw these answers at any time in your space
(Account).
Purposes: adapting the tool to your use (suggestions and proposed cases); for the
telephone number, a getting-started support call, from us, never automated (see f). Legal basis: legitimate
interest (adaptation of the tool and getting-started call), with a right to object. Retention: that of the
account.
Internal activity log (pages/company profiles viewed, searches, actions), timestamps, IP address
(limited to security and rate limiting).
Purpose: security, operation and improvement of the product (internal analytics).
Legal basis: legitimate interest. Retention: 13 months.
Idonis re-uses public data relating to persons connected with businesses
(directorships, shareholdings), taken from the Crossroads Bank for Enterprises, the National
Bank of Belgium and the Belgian Official Gazette.
Purpose: making public legal information accessible and intelligible.
Legal basis: legitimate interest (economic transparency). Measures: the national register number is
never stored in clear text (hashed) and the home address of natural persons is not
kept. No score, no rating and no profile relates to a natural person: only their published directorships
and shareholdings are presented, with their source. Retention: for as long as the directorship or the
shareholding appears in a legal publication, together with the history of published directorships. Information and
rights of data subjects: § 5.
Payments are handled by Stripe; Vanbe does not store any card data. We keep the
invoicing information required for our accounting and tax obligations (invoices, payments, identity
of the invoiced customer). If you provide a VAT number when subscribing, it is checked against the
European Commission's VIES service. In the event of fraud or a disputed payment, the elements of the file
may be kept until the dispute is concluded and disclosed to the competent authorities (Terms of Use, Art. 10).
Legal basis: performance of the contract, legal obligation (accounting, VAT) and legitimate
interest (fraud prevention). Retention: statutory accounting and tax period (10 years), then
destruction; fraud or dispute file: until the dispute and the time limits for appeal have ended.
The messages you send to the assistant are processed to produce an answer. Before processing,
each message undergoes an automated classification (security and topic) by models
hosted in the European Union; the verdict (category, decision) is logged with the
conversation — without systematic human intervention — in order to refuse out-of-scope or
abusive requests and to measure classification errors. Conversations are kept in your space
until you delete them or the account is closed, and may be consulted by Vanbe for
security, support and service improvement purposes.
Legal basis: performance of the contract (answer) and legitimate interest (security of the
service, prevention of abuse). See § 3 on the inference provider and the warning below.
Improvement of answers based on conversations — free plan and trial period. Idonis
improves through use: the conversations of free plan accounts, including during the
Pro plan trial period, may be reviewed by Vanbe in order to correct and improve the answers
(accuracy of figures, choice of sources, detection of errors, building internal test cases).
This is what makes the answers of the free plan more accurate over time. This is a human
review, by the Vanbe team, internal and logged. Conversations are never published, never
passed on to a third party, and are never used to train, fine-tune or validate an artificial
intelligence model. The conversations of paid Pro and Enterprise accounts are never
used for this purpose: they are used solely to produce your answer, for the security of the service and for
support.
Legal basis: legitimate interest (improvement of the service) for the free plan and the
trial period, brought to your attention at sign-up, before the trial is opened and in the Terms of Use
(Art. 7). You may object at any time (§ 5), without any consequence for your access to the service or for
your trial, or subscribe to a paid plan.
Direct marketing to Free accounts. Holders of a Free account — including during the trial period of the Pro plan, which remains a free account — may be contacted by Vanbe, using the contact details provided at sign-up or in their space, including by telephone, to present its offers and to gather their feedback on use (Terms of Use, Art. 7).
Follow-up e-mails. We may send you a few e-mails with tips and follow-up, tailored to your use
of Idonis on the basis of your account's activity log — for example to let you know that an analysis you
requested is ready, or that a Pro plan feature can be tried. They are few in number, no
decision is taken about you on this basis, and each one contains a one-click unsubscribe
link, separate from the alerts on the companies you follow; the same setting can be found on your
Account page (“Tips and follow-up by e-mail”).
Purpose: direct marketing by Vanbe for its own offers. Legal basis:
legitimate interest (Art. 6(1)(f) GDPR). You may object to this at any time, without giving reasons (Art. 21(2)
GDPR; arrangements in § 5). No contact details are passed on to a third party for this purpose.
Call-back requests (“Let's talk”). If you ask to be contacted from the public website, we
record what you enter: your name, where applicable your company, your e-mail address and/or your
telephone number, how you prefer to be contacted, the time that suits you, your message,
the language of the page and the page you came from. Neither the IP address nor any cookie is recorded with the request.
It is sent by e-mail to the Idonis team, which uses it solely to reply to you; we do not
add you to any list and we do not send you any automatic e-mail.
Purpose: responding to your request (pre-contractual measures taken at your request).
Retention: 24 months after the request, then automatic erasure.
The same form is used to dispute a company's score or report an error (“Dispute the score
or report an error” link under the score on each company profile): the data recorded are the same, plus the
enterprise number concerned; we use them to check the report against the source, correct our data
where appropriate and reply to you.
Purpose: handling the report and keeping our data accurate (legitimate interest of Idonis and
of the companies concerned in the accuracy of the published information). Retention: as above.
Website traffic is measured without cookies, by a tool that Vanbe operates on its own
servers in the European Union: your IP address is not kept and the only output is aggregated
and anonymous statistics, never linked to an account. When you create an account, we record on it
the source of the visit that led you there (campaign parameters of the link followed, referring site, landing
page, language) and, in the activity log, the steps of your subscription journey. Details: Cookie Policy, § 4 and 5.
Purpose: measuring, on an overall basis, which channels bring sign-ups, trials and
subscriptions, in order to guide our communication spending; these data are not used to send you
personalised messages and are not passed on to any third party. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Retention: source of the sign-up, 25 months at most from the creation of the account; steps of the subscription
journey: 13 months (activity log). If you object (§ 5), the source recorded on your account
is deleted.
Where your account is attached to an organisation, the administrator of that organisation can see the members, their
role, the shared lists and the credit consumption of each user, per period. A user's
conversations, personal lists and searches are not disclosed to the administrator.
Purpose: management of the subscription and of the organisation's shared pool of credits.
Legal basis: performance of the contract concluded with the organisation. Retention: that of the account and of
the organisation.
A company's profile displays the contact details that the company has made public: declared to the Crossroads Bank
for Enterprises, published in the Belgian Official Gazette or provided on its own website (contact and legal
notice pages, collected by our robot, which complies with the exclusions a site declares in its
robots.txt file). An address bearing the name of a person is presented as a contact detail of the
company, never linked to a person's profile, with a reminder that its commercial use requires the consent
of the recipient. These contact details do not appear in any export.
Purpose: making it possible to reach a company. Legal basis: legitimate interest. Retention:
contact details from the CBE and the Belgian Official Gazette follow their source; those collected from a website are
kept until a removal request is made (§ 5).
We do not sell your data. They may be processed by processors acting on our instructions:
Audience measurement (§ 2 g) involves no processor: the tool is installed and operated by Vanbe on its own servers and no data are transmitted to its publisher. The maps in the application are displayed by third-party providers (CARTO base map in the explorer and on the map of a profile's establishments, OpenStreetMap map of a profile's address): your browser contacts their servers directly, and they receive your IP address. Any VAT number provided when subscribing is transmitted to the European Commission's VIES service for verification (§ 2 d).
Vanbe may also disclose data to the competent authorities (police services, public prosecutor's office, administrations, anti-fraud bodies) where a legal obligation requires it or in the event of fraud, a disputed payment or unlawful use of the service (Terms of Use, Art. 10).
The application and storage are located in the European Union (France); inference for the AI assistant is carried out in the European Union. The content of your messages is not transferred outside the EU. As OpenRouter (§ 3) is a company established in the United States, the technical data of our account with this provider (invoicing, security logs, request metadata, without their content) may be processed in the United States, under the European Commission's standard contractual clauses. Payment is processed by Stripe (§ 3), which may transfer data within its group, in particular to the United States, under the safeguards provided for by the GDPR (EU-US Data Privacy Framework adequacy decision or standard contractual clauses).
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them: dpo@idonis.ai.
We reply within one calendar month of receipt of the request; this may be extended by two months if the request is complex (you will then be informed). Proof of identity is requested only where there is reasonable doubt as to the identity of the requester.
You may lodge a complaint with the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit, APD/GBA, Belgium — autoriteprotectiondonnees.be).
Idonis does not take any solely automated decision producing legal effects or similarly significantly affecting you within the meaning of Article 22 GDPR. The Idonis Score and the AI assistant are aids to analysis; the decision rests with the user.
Idonis only uses cookies and local storage that are necessary for its operation, and no advertising or third-party trackers: see the Cookie Policy.
Hashed passwords (pbkdf2), encryption of communications (TLS), restricted access, hashing of sensitive identifiers. No measure offers absolute security; we endeavour to apply the state of the art.
In the event of a personal data breach, Vanbe notifies the Data Protection Authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk, and informs the data subjects where the risk to their rights is high (Art. 33 and 34 GDPR).
This policy may change; the online version is authoritative as at its date.