What personal data we collect, why, who processes it with us, how long we keep it, and what your rights are.
1. Who we are
2 Steps Ahead is a trade name of G-Cas B.V., a private limited company under Dutch law, registered with the Dutch Chamber of Commerce (KvK) under number 42008661, VAT number NL869263511B01. Our office is at Nicolaas Beetsstraat 216-222, 3511 HG Utrecht, the Netherlands.
We are the controller for the personal data described in this policy. For any question about your data, write to info@2stepsahead.ai. One person reads these messages and answers within two working days.
2. What this policy covers
This policy covers 2stepsahead.ai, the free audits and prompt pages we prepare, our client portal at portal.2stepsahead.ai, and the way we handle the details of prospects and clients in our work.
Our directories (such as European Purpose, The Knowledge Engineers and The Interregnum) are separate websites with their own privacy policies.
3. What we collect and why
We only collect what we need for the purpose, and we never sell personal data.
Contact form and email. Your name, email address, company and message. We use them to answer you and to follow up on your question. Legal basis: steps you ask for before a contract, and our legitimate interest in answering business enquiries.
Audit intake. Your name, work email, company, website, markets, competitors and the answers you give about your product. We use them to prepare your free audit and proposal. Legal basis: steps you ask for before a contract.
Audit and prompt pages. If you save a prompt selection, we store that choice with your audit, so it is there on another device and we can see it. Legal basis: steps you ask for before a contract.
Client portal. Your name, work email and sign-in activity, so you can see your brand’s results. Legal basis: performance of our contract with your company.
Clients and invoicing. Contact and billing details of the people we work with. Legal basis: performance of the contract, and our legal duty to keep financial records.
Business prospects. Business contact details we find in public sources, such as company websites, LinkedIn and directory listings, to contact companies about our services. Legal basis: our legitimate interest in business-to-business marketing. You can object at any time and we will stop.
Website statistics. Pages visited, referring site, device and browser type and approximate location, through Google Analytics, only if you accept analytics cookies. We use this to see which pages help visitors. Legal basis: your consent.
4. Who we share it with
We use a small number of service providers who process data on our behalf, under a data processing agreement or their standard data protection terms:
Netlify: hosting of this website, its forms and saved prompt selections.
Proton (Switzerland): our email and calendar.
Google: Google Analytics website statistics.
Trakkr: the software we use to measure visibility in LLM answers, and the platform behind our client portal.
Brevo (France): sending portal invitations and portal emails.
OpenAI: suggesting answers in the audit intake from your company website. Data sent through its API is not used to train its models.
DataForSEO: keyword volumes and looking up competitor websites. We send it search terms and company names, not personal data.
Our accountant and bookkeeping software: invoices and financial records.
We share data with authorities only when the law requires it.
5. Transfers outside the EU
Some of these providers are based in, or use servers in, the United States. Where that happens, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses. Switzerland has an adequacy decision from the European Commission.
6. How long we keep it
Enquiries and audit intakes from companies that do not become clients: up to two years after our last contact.
Client files: for the duration of the work and up to two years after it ends.
Invoices and financial records: seven years, as Dutch tax law requires.
Portal accounts: until access ends, then removed.
Website statistics: up to 14 months in Google Analytics.
7. Cookies and similar storage
We keep cookies to a minimum:
Access cookie for password-protected audit pages, so you do not have to sign in on every visit. Strictly necessary.
Browser storage (localStorage) to remember your prompt selection on an audit page on your own device. Strictly necessary for that feature.
Your cookie choice, stored in your browser, so we do not ask again on every page. Strictly necessary.
Google Analytics cookies (_ga, _ga_*), only after you click Accept. They count visits and are kept for up to two years.
You can change your choice at any time under Cookie settings at the bottom of every page, or delete cookies in your browser. The site works the same without analytics cookies.
8. Security
Our website and portal use HTTPS. Client audit pages are private links behind a password, and they are not indexed by search engines. Access to client data is limited to the people who work on it.
9. Your rights
Under the GDPR you can ask us for access to your data, to correct or delete it, to limit or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
Write to info@2stepsahead.ai. We answer within one month. If you are not satisfied with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
10. Automated decisions
We do not take decisions about people based solely on automated processing.
11. Changes
We update this policy when our services or providers change. The date at the top shows the latest version.
We use analytics cookies to see which pages help visitors. Read more in our Privacy Policy.