Who is responsible for what

The workshop owns the customer data. Ceptio only processes it on your instructions. In GDPR terms: your workshop is the controller and Ceptio is the processor. That is not a formality — it determines who may do what. We do not decide ourselves what happens to your customers' data; we do what Nova needs in order to do her job, and nothing beyond that.

In practice: we do not use your customers' conversations for our own marketing, we do not sell them on, and we do not use them to train AI models. If you stop using Ceptio, you take your data with you and we delete our copy. A data processing agreement covering all of this is signed when we start working together. You get to read it beforehand, not afterwards.

Which data Nova processes

Only what is needed to make an appointment. Nothing more.

• The customer's phone number — that is where the WhatsApp conversation comes from.
• The name, if the customer gives it or if it is already in the workshop system.
• Registration and vehicle details — make, model and what the Dutch vehicle register publishes about the car.
• The content of the conversation — the customer's messages and Nova's replies.
• Appointment details — date, time and the description of the fault for the mechanic.

Nova does not ask for a date of birth, a national ID number, payment details or anything else that is not needed to book a car in. If a customer sends something like that unprompted, Nova does not use it.

The legal basis

The processing takes place in order to perform a contract: the customer wants an appointment, and this data is needed for it. The customer always starts the conversation — Nova never messages anyone unprompted.

Where the data is stored

Ceptio does not build everything itself. We use a small number of suppliers, and all of them are listed below, together with what we use them for. These are our sub-processors.

If we bring in a new supplier that touches customer data, we will tell you at least 30 days in advance. If you disagree, you can end the contract within that period at no cost.

Nova's answer comes from a language model. The conversation text therefore goes to Anthropic so the reply can be phrased. Anthropic does not use data submitted through the API to train its models. That is why we use them. Separately, Nova never sends more data than that one reply requires.

Two suppliers sit outside the EU. Processing at Anthropic takes place in the United States, as does processing at Netlify, which touches only this website's form and no customer conversations. Those transfers are covered by the European Commission's standard contractual clauses. The conversations and appointments themselves are all stored within the EU.

How long we keep it

• Conversations: 12 months, after which they are deleted.
• Appointment data: that lives in your workshop system and falls under your own retention policy.
• On termination: within 30 days of the end of the contract, we delete everything held here, or hand it over to you if you prefer.

If a customer asks for their data to be deleted, we do that at your request, even mid-contract.

How we secure it

• All traffic between the customer, Nova and the systems behind them runs over encrypted connections.
• The database is not publicly reachable. Access runs solely through the server, never straight from a browser.
• Keys and passwords live in protected environment variables, not in the website or in code a visitor can read.
• The dashboard is protected by an access key; without that key the server releases no data at all.
• Only the two founders of Ceptio have access to the production environment.
• Incoming messages are checked for authenticity, so nobody can impersonate WhatsApp.
• You can take over any conversation at any time. Nova then stays silent until you hand it back — the workshop stays in charge.

If something does go wrong

If we discover a data breach, we report it to you, the workshop, without undue delay, with what we know: what happened, which data is involved and what we are doing about it. You are the one who reports it to the supervisory authority if that is required; we give you everything you need for that.

Found a vulnerability?

If you spot a weakness in Nova, in the dashboard or on this website, report it to security@ceptio.nl. We reply within 48 hours. If you report in good faith and go no further than needed to demonstrate the issue, we will take no legal action against you and publish nothing about you without your consent. Please give us reasonable time to fix it before you make it public.

The car owner's rights

Anyone whose data we process has the right to see it, to have it corrected or deleted, or to receive it in a readable file. They can also object to the processing. Because the workshop is the controller, such a request goes to the workshop in the first instance. If it reaches us, we pass it on and help the workshop handle it. If the matter cannot be resolved, they can complain to the Dutch Data Protection Authority.