Digitaal KantoorPrivacy policy
Digitaal Kantoor is a service of Webstack B.V., Flemingweg 18b, 2408 AV Alphen aan den Rijn, KvK 71323708 ("Webstack", "we"). Each business that uses Digitaal Kantoor (our customer) gets its own installation, with its own storage and keys. For the personal data the customer processes with Digitaal Kantoor, the customer is the controller and Webstack is the processor, under a data processing agreement. For the operation of the platform connections themselves, Webstack is responsible as described here.
What we process through the platform connections
| Platform | Data |
|---|---|
| Meta (Facebook, Instagram) | The Facebook Pages and Instagram business accounts the customer selects: page id and name, a page access token, the posts we publish for the customer and, when the customer uses it, comments on them. |
| WhatsApp Business (Meta) | The customer's WhatsApp Business account and phone number id, and the messages its customers send and the replies the team sends: sender name and number, message text, media. |
| The LinkedIn organization pages the customer manages: organization id and name, an access and refresh token, the posts we publish for the customer. | |
| TikTok | The customer's TikTok account: open id, display name, an access and refresh token, the videos and photos we publish for the customer. |
We do not use this data for advertising, profiling or any purpose other than the customer's own, and we never sell it.
Purposes and legal basis
- Publishing posts the customer approved, on the accounts the customer connected (performance of the contract with the customer).
- Showing messages and comments so the customer's team can answer them, and preparing draft replies that a person reviews (performance of the contract; for the people who write to the customer: the customer's legitimate interest in answering them).
- Security, abuse prevention and keeping logs without message content (legitimate interest).
Storage and security
- Access tokens are stored encrypted (AES-256-GCM) in the customer's own installation, with a key only that installation holds.
- The secrets of the platform apps are kept only by Webstack, in a separate service (digitaalkantoor.webstack.nl). It exchanges the login code for tokens and hands them to the right installation once; it does not keep tokens, messages or webhook content.
- Logs contain no tokens and no message content.
Retention
- Tokens: until the customer disconnects the account, or the platform revokes it.
- WhatsApp messages, media and support mail: 90 days, then deleted automatically.
- Published posts stay on the platform; their record in the app stays as long as the customer's account exists.
Sub-processors
- Cloudflare, Inc. — hosting, storage and AI models that read incoming messages to sort them (Workers AI, logging off).
- Hetzner Online GmbH (Germany) — the server that runs the content assistant.
- Anthropic PBC — Claude, which drafts social posts from the customer's brand information. It does not receive WhatsApp messages or support mail.
- Microsoft — the customer's own Microsoft 365 mailbox, when the customer connects support mail.
- Meta, LinkedIn and TikTok themselves, for the accounts the customer connects.
Your rights and deleting data
Disconnect an account in Digitaal Kantoor (Social › Instellingen › Accounts, "Ontkoppelen"): we revoke the token at the platform and delete it. You can also remove the app in your Facebook, LinkedIn or TikTok settings. To have data deleted, or to use your rights of access, correction or objection, mail support@webstack.nl. See Data deletion. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Contact
Webstack B.V., Flemingweg 18b, 2408 AV Alphen aan den Rijn, KvK 71323708. support@webstack.nl