Privacy Statement

Last updated: October 9, 2026

This is what we do with personal data when you visit our site, ask us something, book a call, answer one of our campaigns or work with us.

1. Who we are

NoManagement B.V., trading as AIOS, Spijkerkade 31, 1021 JS Amsterdam, the Netherlands, KVK number 80968724, is responsible for your data. We decide why and how it is used.

AIOS is a build-and-release agency. We build and implement acquisition systems, automations and custom software for businesses. We also run performance marketing that is paid per result.

Questions about privacy: [email protected].

2. Our role

For visitors, prospects, clients and their contact persons, and for people who answer one of our own campaigns, we are the controller.

Leads for a client: if you fill in a form we made for a client's campaign, we collect your details as controller. With your consent we pass them to the business named on the form. From then on that business is responsible for its own use.
Software we build: a client runs it. Where we handle personal data on a client's behalf, we are processor and agree a data processing agreement with that client. This statement does not cover that data. Ask the client.
Ad platforms: when you click an ad on Meta or Google, that platform handles your data under its own terms.

3. What we collect

These are the data we get from you or record ourselves:

Contact details: first and last name, email address, mobile number.
Business details: company, region, trade, team size, turnover band (optional), website or social link (optional) and your answers in a check or form.
Your choices: which consent you gave, the exact text, the time, your IP address, your browser, your approximate place and a copy of what you filled in.
Your booking: the time you chose, the invitation, the video link and our notes in the CRM.
The recording of a sales call.
In the chat: the messages you type, the replies, a random browser ID and conversation ID kept on your device, your time zone, and short notes the assistant keeps (such as what you asked) so it can pick up next time.
In the voice demo: your speech through your microphone, turned into text while you talk, the transcript, how long it lasted, the page, the random browser ID, your browser type, a scrambled (hashed) form of your IP address, and your approximate place, which the agent uses to talk about your region. We keep no audio recording of the website demo.
In the demo call that our AI places to your number when you ask for it: your phone number, the call and its recording.
Where your visit came from: the page, the referrer, the ad parameters in the link, your IP address and browser data.
Only with consent: cookie IDs, site usage and data for ad measurement.
If you become a client: company name, invoice address, KVK and VAT number, and payments.

We do not ask for special categories of data, such as health or origin.

4. Why, and on what basis

For each purpose we name the data and the legal basis. Without a basis we process nothing.

Answering your message or request

Data: Name, email address, phone number, your message.
Basis: Steps at your request before an agreement (art. 6(1)(b) GDPR), or our legitimate interest in answering business contacts (art. 6(1)(f)).

Contacting you about an offer you asked about: calls, email and text messages

Data: Name, email address, mobile number, region and your answers.
Basis: Consent (art. 6(1)(a)). You give it with the required tick. You can withdraw it at any time.

Finding and delivering leads for our clients

Data: What you enter in the form and your answers.
Basis: Consent (art. 6(1)(a)). The form names the business that receives your details. You can withdraw consent at any time.

Scheduling a video call and sending the invitation

Data: Name, email address, the time, the video link.
Basis: Steps at your request before an agreement (art. 6(1)(b)).

Recording and keeping a sales call

Data: The recording of the call.
Basis: Our legitimate interest in being able to find what was agreed (art. 6(1)(f)). You can object. See the section on calls.

Making a quote and agreement, keeping the client relationship, sending invoices

Data: Contact and company details, address, KVK and VAT number, payments and how you paid (through Whop, Wise or bank transfer).
Basis: Performing the agreement (art. 6(1)(b)). For bookkeeping: legal obligation (art. 6(1)(c)).

Sending news about AIOS by email and text message

Data: Name, email address, mobile number.
Basis: Consent (art. 6(1)(a)), only if you set the separate tick. You can withdraw it at any time.

Proving that you gave consent, and protecting the site against abuse and bots

Data: The consent text, the time, IP address, browser, page, and a copy of what you filled in.
Basis: Our legitimate interest (art. 6(1)(f)): we must be able to prove your consent (art. 7(1) GDPR) and keep the site safe.

Seeing which ad or page brought you to us, without a cookie

Data: The page, the referrer, the ad parameters in the link, your IP address and browser data. Without your consent we do not tie this to a visitor ID.
Basis: Our legitimate interest (art. 6(1)(f)): knowing which ads work. You can object.

Measuring site use and our ads

Data: Cookie IDs, pages and clicks, ad IDs. On a booking we send your email address, phone number and name to Meta in hashed form (made unreadable).
Basis: Consent (art. 6(1)(a) and Telecommunications Act art. 11.7a). Without your choice these services do not load.

Answering your questions in the chat assistant (AI)

Data: Your messages and the replies, the browser and conversation IDs, your time zone, and the notes the assistant keeps.
Basis: Our legitimate interest (art. 6(1)(f)) in answering visitors and helping them book a call. You can object. If you book, steps at your request (art. 6(1)(b)). Do not type health or other sensitive data.
Kept: 2 years after the last contact
Who gets it: The AI model provider that writes the replies, our hosting, and Cloudflare. See Who we share data with.

Letting you try the voice demo (AI)

Data: Your speech and its text, the transcript with length and page, the random browser ID, your browser type, a hashed IP address, and your approximate place.
Basis: Consent (art. 6(1)(a)): you tap the orb and allow your microphone. You can stop at any time by ending the call. We keep the transcript on our legitimate interest (art. 6(1)(f)) in seeing how the demo is used and improving it. You can object.
Kept: 2 years after the last contact
Who gets it: LiveKit Cloud (audio, and the model that writes the answers), Deepgram (speech to text), Cartesia (the synthetic voice), our hosting. See Who we share data with.

The demo call that our AI places to your number (AI)

Data: Your phone number, your name if you gave it, the call and its recording. The agent says at the start that it is an AI and that the call is recorded.
Basis: Consent (art. 6(1)(a)): you enter your number and set the tick. You can withdraw it at any time.
Kept: 2 years after the last contact
Who gets it: LiveKit Cloud, Deepgram, Cartesia and Telnyx (the phone connection).

Handling our own email and building software with AI tools

Data: Messages you send us.
Basis: Our legitimate interest (art. 6(1)(f)): working efficiently. You can object.

We do not sell your data.

5. Calls and recording

A person calls you: Luca, or someone from our team. We use no AI for sales calls. The one exception is the demo call that our AI places when you ask for it yourself (see AI).

We record sales calls with Fathom. We say so at the start of the call. If you do not want that, say so and we do not record.

We use the recording to note what was agreed. How long we keep it is in How long we keep data.

6. AI

The chat assistant and the voice demo on this site are AI, not a person. The voice you hear in the demo and in the demo call is synthetic. The chat is labelled "AI Agent" and the demo call says at the start that it is an AI. More on how we tell you is in the AI Transparency Statement.

What happens with your data in the chat and the voice demo is in Why, and on what basis: what we keep, on what basis, for how long and who receives it. The AI does not decide anything about you that has legal or similar effect. It answers questions and can book a call.

We also use AI tools in our own work, for example to read and prepare email and to build software. Your messages can reach the provider of the AI model that way. The providers are in Who we share data with.

AI features that we build for a client tell people that they are dealing with AI. The client keeps that notice on. The client's own privacy statement explains what happens with the data.

7. Who we share data with

We share data with companies we need to do our work. They process it for us and on our instructions, except where the list says otherwise. The same list is on the Subprocessors page.

Hostinger

Purpose: Servers for our database and our systems.
Where: Frankfurt, Germany (EU)
Outside the EU: No transfer outside the EU.

Cloudflare

Purpose: Hosting of the website, network and security.
Where: United States, with servers worldwide
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

HighLevel (GoHighLevel)

Purpose: Our CRM and calendar: your contact record, your appointment and our notes.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Resend

Purpose: Sending email, such as the confirmation of a check or a booking.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Fathom

Purpose: Recording and notes of our sales calls.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Google

Purpose: Our email, calendar and video links (Google Workspace). Google Analytics, only with your consent.
Where: Ireland (EU), with the group in the United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

PostHog

Purpose: Measuring how the site is used. Only with your consent. Our servers send PostHog no name, email address or phone number, and without your consent no visitor ID either.
Where: EU
Outside the EU: No transfer outside the EU.

Meta Platforms Ireland

Purpose: Measuring our ads with the Meta Pixel and server conversions. Only with your consent.
Where: Ireland (EU). Meta may pass data on to the United States.
Outside the EU: See above. Meta and we are jointly responsible for collecting and passing on the data through the Pixel.

Whop

Purpose: Payment provider, as our merchant of record for a checkout payment: the checkout, your payment details and the receipt. Whop handles them under its own privacy terms, and Whop's checkout terms apply to the payment.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Wise

Purpose: Payment provider for our business account: it receives the payments for our invoices, with the payer's name, account and payment reference. Wise handles them under its own privacy terms, as a regulated payment institution.
Where: Belgium (EU), with the Wise group in the United Kingdom
Outside the EU: Yes, to the Wise group in the United Kingdom. Covered by the European Commission's adequacy decision for the United Kingdom.

Exact Online

Purpose: Our bookkeeping software: invoices, payments, and the company and contact details on them. Exact processes this for us, as our processor.
Where: Netherlands (EU)
Outside the EU: No transfer outside the EU.

LiveKit Cloud

Purpose: Carries the audio between you and our voice agent in the voice demo and in the demo call, and runs the agent. It also runs the language model that writes the agent's answers in the voice demo (a Google Gemma model).
Where: The voice agent runs in Germany (eu-central). LiveKit is a US company, and its network can route audio through servers outside the EU.
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Deepgram

Purpose: Turns your speech into text while you talk to the voice agent.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Cartesia

Purpose: Turns the agent's answers into the synthetic voice you hear.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Telnyx

Purpose: The phone connection for the demo call that our AI places to your number when you ask for it.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

OpenAI, Anthropic, Google and Cerebras (the chat assistant)

Purpose: AI models that write the replies of the chat assistant on this site. Your messages go to the provider that answers. Which of them that is depends on our settings.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

Anthropic, OpenAI, Google and similar AI model providers (our own work)

Purpose: AI models that help with our own work, such as reading and preparing email and building software.
Where: United States
Outside the EU: Yes. Covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's standard contractual clauses.

If data goes to a country outside the EU, we keep it protected with an adequacy decision of the European Commission (such as for the United Kingdom), with the EU-US Data Privacy Framework, where the provider is certified, or with the standard contractual clauses of the European Commission.

With your consent we also pass lead details to the client named on the form. We pass data on to others only if the law requires it.

8. How long we keep data

These are the periods we set for ourselves. When a period has ended, the data is due to be deleted or made anonymous. You can always ask us to delete it sooner (see Your rights).

Your request, check, booking, call recording and our notes (leads): 2 years after the last contact
Chat messages, voice demo transcripts, the notes the assistant keeps, and the demo call and its recording: 2 years after the last contact
Client data: 2 years after the client relationship ends
Invoices and bookkeeping: 7 years (tax retention duty)
Proof of your consent: As long as we need it to prove your consent
Cookies: Up to 180 days (where your visit came from) and 1 year (your cookie choice)
Visit data, analytics and ad measurement: No longer than needed for the purpose. At PostHog and Meta their settings apply.

9. Your rights

You have these rights:

Access: you see which data we hold about you.
Rectification: you have wrong data corrected.
Erasure: you have data deleted.
Restriction: you have the processing paused for a while.
Objection: you object to processing based on our interest. An objection to direct marketing always makes us stop.
Portability: you get your data in a common file.
Withdrawing consent: possible at any time. What we did before stays lawful.

Send an email to [email protected]. We may ask you to prove who you are. We answer within one month.

If you ask for erasure, we delete your data, but we keep the proof of your consent (text, time, IP address) apart. That is allowed for as long as we need it to show that you gave consent (art. 17(3)(e) GDPR).

10. Security

All connections to the site are encrypted (HTTPS).
Keys and passwords are kept in a vault, not in code.
When you book, we limit how often someone can book.
Only people who need it can reach your data.

If something does go wrong with your data, we report it as the law requires.

11. Cookies

On every visit we ask for your choice first. Without your choice, analytics and ad measurement do not load. Which cookies we use is in the Cookie Policy.

PostHog runs in the EU. Our servers send our analytics no name, email address or phone number, and without your consent no visitor ID either.

12. Contact and complaints

Do you have a question or a request? Email [email protected] or write to NoManagement B.V., Spijkerkade 31, 1021 JS Amsterdam, the Netherlands.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), or to the authority in the country where you live. We would like to hear from you first.

We may change this statement. The date at the top shows when that last happened.