Privacy Policy

Last updated: June 2, 2026

1. Introduction

Brookhuis Applied Technologies ("we", "us", "our"), located at Twentepoort West 17, 7609 RD Almelo, The Netherlands, operates the Brookhuis CleanroomIQ (the "Service") at cleanroomiq.com.

This Privacy Policy explains how we collect, use, and protect your personal data when you use the Service. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data controller

Brookhuis Applied Technologies is the data controller for your personal data. For questions or requests regarding your data, contact us at info@brookhuis.com.

3. What data we collect

3.1 Account data

When you create an account, we collect:

• Email address
• Name (if provided)
• Password (stored as a secure hash, never in plain text)

3.2 Calculation data

When you use the calculator, we store:

• Calculation input parameters (particle sizes, product areas, exposure times)
• Calculation results (deposition rates, ISO classifications, risk assessments)
• Session identifiers to associate calculations with your account

This data is stored to provide your simulation history and enable PDF report generation. Free-tier users' calculation data is stored temporarily in the session and is not retained long-term.

3.3 Payment data

All payment processing is handled by our payment provider, Paddle (Paddle.com Market Ltd). We do not store credit card numbers, bank account details, or other financial information on our servers. Paddle processes payments as the Merchant of Record and maintains its own privacy policy regarding payment data.

We store only a Paddle customer identifier and subscription identifier to manage your subscription status.

3.4 Technical data

We automatically collect:

• IP address (anonymized - the last octet is removed before storage, making the address non-identifiable)
• Browser type and version
• Pages visited and features used
• Timestamps of interactions

4. How we use your data

We use your personal data for the following purposes:

• Providing the Service - performing calculations, storing your simulation history, generating reports
• Account management - authentication, password resets, email verification
• Subscription management - processing payments via Paddle, managing your plan status
• Service improvement - understanding usage patterns to improve the calculator (aggregated, non-identifiable data only)
• Communication - sending transactional emails (account verification, password resets, subscription confirmations)

5. Legal basis for processing

We process your data based on the following legal grounds:

• Contract performance (Art. 6(1)(b) GDPR) - to provide the Service you have signed up for
• Legitimate interest (Art. 6(1)(f) GDPR) - for security, fraud prevention, and service improvement
• Legal obligation (Art. 6(1)(c) GDPR) - for tax and accounting requirements related to subscriptions

6. Cookies

We use essential cookies required for the Service to function and analytics cookies to improve our service:

• Session cookie - maintains your login state and stores calculation data during your session
• CSRF token - protects against cross-site request forgery attacks
• Cookie consent - remembers your cookie consent preference
• Referral tracking - if you arrive via a partner link (e.g. ?ref=partner), the referral source is held in your session memory only and is not written to a persistent cookie until you have accepted cookies. After consent, a cookie records the referral source for up to 90 days so we can correctly attribute partner commissions if you later subscribe. If you decline cookies, no referral cookie is set and the attribution expires when your browser session ends. The referral cookie does not track your browsing activity outside our Service.
• Marketing attribution - when you arrive from an ad or campaign, the campaign parameters in the URL (utm_source, utm_medium, utm_campaign, utm_content, utm_term), any click identifier (gclid, li_fat_id), the referring website and the landing page are held in your session memory only and are not written to a persistent cookie until you have accepted cookies. After consent, a cookie records this first-touch source for up to 90 days so we can measure which channels bring in customers. If you decline cookies, no attribution cookie is set and the data expires when your browser session ends. This cookie does not track your browsing activity outside our Service.
• Google Analytics (_ga, _ga_*) - collects anonymous usage statistics such as page views, feature usage, and visitor counts. No personally identifiable information is collected. Data is processed by Google. See Google's Privacy Policy.
• LinkedIn Insight (li_*) - set when you arrive from a LinkedIn ad so we can measure conversions. Set only after you accept cookies. No personal data from your CleanroomIQ account is sent to LinkedIn. See LinkedIn's Privacy Policy.

Analytics and conversion-measurement data is collected anonymously and is not linked to your CleanroomIQ account or personal information. Both Google Analytics and the LinkedIn Insight Tag are loaded only after you accept cookies.

7. Data sharing

We share your data only with the following parties, and only as necessary:

• Paddle (Paddle.com Market Ltd) - our payment provider and Merchant of Record. Paddle processes your payment data and handles billing, invoicing, and tax compliance. See Paddle's Privacy Policy.
• Amazon Web Services (AWS) - our hosting and transactional-email provider. All application data, backups and outbound email (sent via AWS Simple Email Service) are processed and stored in the EU (Frankfurt, Germany region). See AWS Privacy Policy.
• Google (Google Ireland Limited) - we use Google Analytics 4 and Google Tag Manager for anonymous usage statistics. IP addresses are anonymised before transmission. Loaded only after you accept cookies. See Google's Privacy Policy.
• LinkedIn (LinkedIn Ireland Unlimited Company) - we use the LinkedIn Insight Tag for ad-conversion measurement. Loaded only after you accept cookies. No personal data from your CleanroomIQ account is shared with LinkedIn. See LinkedIn's Privacy Policy.
• Cloudflare (Cloudflare, Inc.) - our DNS provider and edge layer that provides DDoS protection and TLS termination for cleanroomiq.com. See Cloudflare's Privacy Policy.
• Sentry (Functional Software, Inc.) - our application error and performance monitoring provider. Sentry receives diagnostic data (error reports, performance metrics) so we can keep the service reliable and secure. Data is stored in the EU and we do not send your email address or IP address to Sentry. See Sentry's Privacy Policy.

We do not sell, rent, or trade your personal data to any third parties.

We have Data Processing Agreements (DPAs) in place with AWS, Paddle, Google, LinkedIn, Cloudflare and Sentry to ensure your data is processed in accordance with GDPR requirements.

8. Data storage and security

Your data is stored on servers located in the European Union (AWS Frankfurt, Germany). We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS)
• Encrypted storage of sensitive configuration data
• Secure password hashing
• Network isolation via Virtual Private Cloud (VPC)
• Regular security updates

9. Data retention

• Account data - retained for as long as your account is active, and deleted upon account deletion
• Calculation history - retained for as long as your account is active
• Payment records - retained as required by tax and accounting regulations (typically 7 years)
• Session data - automatically expires and is deleted after the session ends

10. Your rights

Under the GDPR, you have the following rights:

• Access - request a copy of your personal data
• Rectification - correct inaccurate or incomplete data
• Erasure - request deletion of your personal data ("right to be forgotten")
• Restriction - request restriction of processing in certain circumstances
• Data portability - receive your data in a structured, machine-readable format
• Objection - object to processing based on legitimate interest

You can exercise several of these rights directly from your dashboard:

• Data export - download all your personal data in JSON format from your account dashboard
• Account deletion - permanently delete your account and all associated data from your account dashboard

For other requests, contact us at info@brookhuis.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

11. International data transfers

All data processing takes place within the European Union. We do not transfer your personal data outside the EU/EEA. Our payment provider Paddle may process payment data in accordance with their own privacy policy and applicable data transfer mechanisms.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The current version is always available at this page.

13. Contact

For questions about this Privacy Policy or your personal data, contact us at:

Brookhuis Applied Technologies
Twentepoort West 17
7609 RD Almelo
The Netherlands
info@brookhuis.com