Privacy Policy
Last updated: 1 October 2026
1. Who we are
My Dashboard is an online service that gives businesses dashboards, reports and analyses based on data from their own systems. The service is provided by Bart Otto Solutions, established at Erasmusweg 2b, 2202 CC Noordwijk, Nederland, registered with the Dutch Chamber of Commerce under number 69481539 ("we").
2. Two roles
For your user account, we are the controller. This privacy policy is about that data: what we record about you as a user of My Dashboard.
For an organisation's business data, we are a processor. Organisations connect their own systems, such as point of sale, scheduling and accounting, to My Dashboard. These may contain personal data of their employees and customers. We process that data only on behalf of that organisation, under a data processing agreement. If you are an employee or customer of such an organisation and have a question about your data, please contact that organisation; it decides what happens to your data. We help it do so.
3. What we record
- Account: name, email address, language, time zone, role and the organisation you belong to.
- Security: a one-way hash of your password and, if you use them, the data for two-factor authentication and passkeys.
- Usage: the time of your last login, your IP address and browser during a session, and your dashboard preferences (such as selected locations and filters).
- AI assistant: if you use the assistant, the questions you ask and its answers.
- Technical logs: error messages and system events, which may include your name or email address.
4. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Giving you access to My Dashboard and managing your account | Performance of the contract with your organisation |
| Securing the service, preventing misuse and sending login notifications | Legitimate interest: a secure service |
| Finding and fixing errors | Legitimate interest: a working service |
| Letting the AI assistant answer your questions | Performance of the contract; you choose whether to use the assistant |
We do not use your data for marketing, do not sell it and do not build profiles of you.
5. How long we keep data
- Account data: for as long as you have access. When your organisation deletes your account, it is removed.
- Sessions: expire after two hours of inactivity.
- AI assistant conversations: 30 days, then deleted automatically.
- Received invoice emails: the original email 30 days; the invoice PDFs for as long as the dashboard is used.
- Technical logs: 14 days.
- Backups: 30 days.
6. Who we share data with
We use the following service providers. Each of them is bound by agreements on protecting your data.
| Provider | Used for | Location |
|---|---|---|
| DigitalOcean | Servers, database and backups | Amsterdam (NL) |
| Cloudflare | Security and delivery of traffic to My Dashboard | Global network; US |
| MailerSend | Sending email, such as invitations and password resets | EU |
| Anthropic | The AI assistant; your questions are not used to train models | US |
| Slack | Technical notifications to us, such as error and login notifications | US |
Your data is stored in the Netherlands. Where a provider processes data outside the European Economic Area, this happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Otherwise we only disclose your data to others when the law requires us to.
7. Cookies
My Dashboard only uses cookies the service needs to work: a session cookie to keep you logged in, a cookie that protects against forged requests and, if you choose it, a cookie to remember you. We use no analytics, tracking or advertising cookies.
8. Security
All traffic is encrypted over HTTPS. Every organisation has its own, separate database. Passwords are stored only as a hash, login attempts are rate-limited, and you can use two-factor authentication or a passkey.
9. Your rights
You have the right to:
- access your data;
- have inaccurate data corrected;
- have your data deleted;
- have the processing restricted;
- object to processing based on legitimate interest;
- receive your data in a common format.
You can change your name, email address and password yourself under Settings. For anything else, contact us. We may ask you to confirm your identity and will respond within one month.
10. Contact and complaints
Questions about this privacy policy or your data can be sent to info@bartotto.com. If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.
11. Changes
We may update this privacy policy, for example when we start using a new service provider. The date at the top shows when it was last changed.