This statement explains which personal data CleverPrism processes as a controller: when you visit our websites, sign up, pay, contact us, or use your environment, including through the Tirmel app. For personal data that customers put into their own CleverPrism environment, the customer is the controller and we are the processor; see our data processing agreement.
1Who we are
CleverPrism B.V. (trading as CleverPrism), Elzentlaan 27, 5611 LG Eindhoven, the Netherlands, registered with the Dutch Chamber of Commerce under number 42175200, is responsible for the processing described here. CleverPrism is part of the Clever group. You can reach us at service@cleverprism.com.
2Visiting our websites
This applies to our company website cleverprism.com and to tirmel.com, the website of our product Tirmel (formerly Iriva). Our websites use no tracking, no advertising and no analytics cookies. We do not build visitor profiles.
Two things are kept in your browser, both only to make the website work the way you asked:
- Your language. When you choose a language in the language menu, the cookie
cp_langremembers that choice, so the website opens in that language on your next visit. It is only set when you choose a language yourself, holds nothing but the language code and is kept for one year. - Your order form. When you go from the order form to the payment page, your browser keeps what you filled in (session storage), so it is still there if you come back. It stays in that browser tab, is removed when you close the tab and is not sent to us.
Neither is used to recognise or follow you. Because they are strictly functional, we do not ask for consent.
To deliver the websites and protect them against abuse, our hosting provider and Cloudflare, which protects and speeds up the websites, process technical data such as your IP address, browser type and the time of your visit. They keep these server logs for a limited period for security and troubleshooting only. Legal basis: our legitimate interest in secure, working websites (Article 6(1)(f) GDPR).
Counting visits on tirmel.com. To see how our website is used, its server counts page views per day: which page, in which language, and where the visit came from (the website that linked to us, or the campaign or partner name in the link, such as utm_source or ref), and how many order forms were sent. For these counts we store only totals per day. We do not store your IP address, not even shortened or hashed, we use no cookies or other storage in your browser for this, and the totals cannot be linked to a person. We keep them for 25 months. Legal basis: our legitimate interest in improving our website and measuring our marketing (Article 6(1)(f) GDPR).
3Signing up, billing and administration
When your organisation subscribes, we process:
- company name, address and VAT number;
- name and email address of the person who signs up, and of contacts for billing and support;
- subscription details, invoices and payment status;
- where the order came from: the campaign or partner name in the link you followed (such as
utm_sourceorref) and a discount code, stored with the order and in Stripe; - whether you do not want emails about new features and offers (see below);
- payment details. These are handled by our payment provider Stripe (Stripe Payments Europe, Ltd., Ireland). We do not see or store full card numbers; for direct debit we see the account holder and the last digits of the IBAN.
We use these data to conclude and perform the agreement, to invoice and collect payments, and to comply with our legal obligations, such as tax and accounting rules. Legal basis: our legitimate interest in concluding and performing the agreement with your organisation (Article 6(1)(f) GDPR); where you contract with us yourself, for example as a sole trader, performance of the agreement (Article 6(1)(b) GDPR); and legal obligations (Article 6(1)(c) GDPR). Providing contact and billing details is necessary to conclude the agreement; without them we cannot provide the service.
Emails about new features and offers. We may email the person who ordered for a customer about new features and offers of our own similar services, such as Tirmel. Legal basis: our legitimate interest in informing our customers (Article 6(1)(f) GDPR), within the exception for existing customers in Article 11.7(4) of the Dutch Telecommunications Act (Telecommunicatiewet). If you do not want these emails, tick the box on the order form when you order. You can also object at any time later, without giving a reason, free of charge: every such email has a link to unsubscribe, or write to service@cleverprism.com. We send no other newsletters or marketing email without your consent, and we do not share your email address with advertising platforms.
Stripe also processes payment data under its own responsibility, for example to prevent fraud and to comply with financial regulations; see Stripe's privacy policy.
4Using your environment
To give your users access and keep the environment secure, we process the email addresses of users who may log in (they sign in with their Microsoft or Google account, see below), the email address of the password vault administrator, and technical logs of the environment such as IP addresses, timestamps and errors. We do not collect prompts or AI answers in these logs. Legal basis: our legitimate interest in performing the agreement with your organisation and in a secure, reliable service (Article 6(1)(f) GDPR).
To protect our network, our customers and others against abuse (such as attacks, botnets, spam and illegal content), we process network and usage data of the environments: IP addresses, timestamps, destinations, ports and volume of traffic, and the use of resources. We do not use the content of the environment for this. Images that a customer publishes through a public link may be checked by comparing their digital fingerprints (hashes) with lists of known child sexual abuse material. How we handle abuse is described in section 3A of our terms of service. Legal basis: our legitimate interest in a secure network and in preventing abuse, and legal obligations (Article 6(1)(f) and (c) GDPR).
We send service emails, for example about invoices, failed payments, renewals, maintenance and security.
Signing in with Microsoft or Google
Users can sign in to CleverPrism with their existing Microsoft work account (Microsoft Entra ID) or Google account. When a user chooses this and gives permission, Microsoft or Google sends us only basic sign-in data: name, email address, a unique account identifier, and for work accounts the identifier of the organisation's Microsoft tenant or Google Workspace domain. We only ask for the standard sign-in permissions (for Google: openid, email and profile). We never receive the user's password, and we get no access to email, files, calendars, contacts or any other data in the Microsoft or Google account.
We use these data only to sign the user in, to link the user to the right customer organisation, and to apply the roles and access rights that the customer's administrator has assigned. We do not use them for advertising, we do not sell them, we do not share them with third parties, and we do not use them to train AI models. Our sign-in service runs on our own servers in the Netherlands and uses only strictly necessary cookies to keep the user signed in. The customer's administrator can remove a user at any time; access to CleverPrism then ends. Legal basis: performance of the agreement and our legitimate interest in secure access to the environment (Article 6(1)(b) and (f) GDPR).
Microsoft and Google process the sign-in itself under their own responsibility; see the Microsoft Privacy Statement and the Google Privacy Policy. CleverPrism's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5The Tirmel app
The Tirmel app (for iPhone, Android, Windows and Mac, published by CleverPrism B.V.) lets the users of a customer's desks work with those desks from their phone or computer. The app is a way to use the environment, so section 4 also applies. This is what the app processes:
- Signing in. You sign in through your organisation's login on our own sign-in service, login.tirmel.app, which we host in the Netherlands. Your organisation can let you sign in there with your Microsoft or Google work account (see "Signing in with Microsoft or Google" above). We process your email address, name and account ID to sign you in, to find the desks your organisation gives you access to, and to apply your access rights.
- Device ID. For each installation the app creates a random device ID. It is part of the label of the app's session on the desk, so your organisation's administrator can see which devices are connected and can revoke a device. It is not derived from your device's hardware or advertising identifiers.
- Where the app connects to. Only to your organisation's own desk gateways (addresses such as
<name>-xxxx.tirmel.app), to our customer portal account.tirmel.app (to find your desks) and to login.tirmel.app (to sign in). All connections are encrypted (HTTPS and WSS). - Your tasks, messages and attachments. What you send in the app goes to your organisation's own desk, and from there to the AI provider your organisation chose. For this content the customer is the controller and CleverPrism is the processor, as described in our data processing agreement.
- Dictation. When you dictate, the app sends the audio recording through your organisation's desk gateway to a speech recognition service (Whisper) provided by Scaleway SAS in Paris, France, which acts as our sub-processor. The recording is processed only to turn it into text, under our agreement with Scaleway, and the text is returned to the app. CleverPrism does not store the recording. The app does not use the speech recognition of Apple or Google. The app uses the microphone only for dictation.
- Camera. The app uses the camera only to scan a QR code for connecting (pairing) a desk. The image is processed on your device; nothing is sent to us.
- Stored on your device. Your sign-in session is kept in the secure storage of your device (such as the Keychain on Apple devices and the Android Keystore), together with the settings of the app. Signing out in the app removes the sign-in session from the device.
- No advertising, no tracking. The app contains no advertising, does not track you, does not use an advertising ID, and contains no analytics or crash-reporting software from third parties.
- Deleting your account. Your account is managed by your organisation's administrator in the portal (account.tirmel.app), who can remove it at any time. You can also email service@cleverprism.com to have your account and data removed; for data in your organisation's environment we arrange this with your organisation (see section 11). More help: tirmel.com/app.
Legal basis: our legitimate interest in performing the agreement with your organisation and in secure access to the environment (Article 6(1)(f) GDPR).
6When you contact us
If you email us, report abuse or fill in a form on our websites (such as an order request or a partner application), we use your name, contact details and message to answer you and to follow up on your question. Legal basis: our legitimate interest in handling your question, or taking steps at your request before entering into an agreement (Article 6(1)(f) and (b) GDPR).
7How long we keep your data
| Data | Retention |
|---|---|
| Invoices, payment and other administrative records | 7 years, as required by Dutch tax law |
| Customer and contact details | For the duration of the agreement and 60 days after it ends, unless they are part of the administrative records above |
| Your choice not to receive emails about new features and offers | As long as we keep your contact details, so that we keep respecting it |
| User accounts of the environment, including sign-in data received from Microsoft or Google | For the duration of the agreement and 60 days after it ends; deleted earlier when the customer removes the user |
| Technical logs of the environment | At most 90 days |
| Copies in our encrypted backups | Deleted automatically as the backup cycle rotates, at the latest 12 months after the original was deleted |
| Dictation recordings from the Tirmel app | Not stored by CleverPrism; processed only to return the text |
| Sign-in session and settings of the Tirmel app | On your device; the sign-in session is removed when you sign out |
| Network and usage data for security and abuse prevention | At most 90 days, longer only as long as needed for a specific incident, report or legal obligation |
| Abuse reports and how we handled them | As long as needed to handle the report and any objection, at most two years |
| Contact requests that do not lead to an agreement | As long as needed to handle the request, at most one year |
8Who receives your data
We do not sell personal data. We share it only with parties that help us provide our service, under an agreement that protects your data, or when the law requires us to:
- CleverIT B.V. (Clever group, Eindhoven): data centre, network, email and hosting of our websites;
- Cloudflare: protection of our websites, secure access to customer environments and storage of encrypted backups in the European Union;
- Stripe: payments, invoices and the customer portal;
- Scaleway SAS (Paris, France): speech recognition for dictation in the Tirmel app;
- our accountant, and authorities if we are legally obliged to provide data.
9Transfers outside the EEA
Our own systems and customer environments are in the Netherlands. Cloudflare and Stripe may process data outside the European Economic Area, including in the United States. They do so on the basis of the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses (Chapter V GDPR).
10Security
We protect personal data with appropriate technical and organisational measures, such as encrypted connections, a separate server per customer, strict access control and monitoring. If you believe your data is not secure or has been misused, please contact us right away.
11Your rights
You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to receive your data in a portable format (Articles 15 to 21 GDPR). Send your request to service@cleverprism.com. We respond within one month. We may ask you to confirm your identity; we never ask for a copy of your passport or identity card.
Right to object. Where we rely on our legitimate interest, you may object at any time on grounds relating to your particular situation. Where we asked for your consent, you may withdraw it at any time, without affecting earlier processing. We do not take decisions based solely on automated processing that have legal or similarly significant effects on you: automated network measures are reviewed by a person, as described in section 3A of our terms of service. You can get a copy of the Standard Contractual Clauses mentioned in section 9 from service@cleverprism.com.
If your request concerns data in a customer's environment, we forward it to that customer, because the customer is the controller for that data.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
12Changes
We may update this privacy statement. The version and date at the top show when it was last changed. We inform customers by email of important changes.
Version 1.11 (26 October 2026): section 3 says that we may email customers about new features and offers of our own similar services, how to refuse this on the order form or object later, and that the campaign or partner name of the link and the choice are stored with the order; section 2 says that the daily totals are only for counting visits; section 7 adds how long we keep the choice.
Version 1.10 (26 October 2026): sections 3, 4 and 5 now rely on our legitimate interest instead of performance of the agreement, because the agreement is with your organisation; 3 says which data are necessary; 7 adds the retention of backup copies; 11 adds the right to object, withdrawal of consent, automated decisions and how to get the Standard Contractual Clauses.
Version 1.9 (26 October 2026): section 4 now only mentions signing in with a Microsoft or Google account; section 8 adds that Cloudflare stores our encrypted backups in the European Union.
Version 1.8 (25 October 2026): section 2 now describes how the server of tirmel.com counts page views per day, without cookies and without storing IP addresses.
Version 1.7 (15 October 2026): new section 5 about the Tirmel app for phone and computer (sign-in, device ID, dictation, camera, data on the device, no advertising or tracking, deleting your account); Scaleway SAS added to the recipients in section 8 for dictation; the sections after section 4 were renumbered.
Version 1.6 (13 October 2026): the product name Iriva was changed to Tirmel, and the web addresses were changed to the Tirmel domain names (such as tirmel.com and tirmel.app). Nothing else changed.