Privacy Policy

Last updated: April 2026

This Privacy Policy explains how Genealogic ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our Service at genealogic.ai and app.genealogic.ai. We are committed to complying with the General Data Protection Regulation (GDPR) and applicable Dutch privacy law.

1. Who we are

Genealogic is operated by a company registered in the Netherlands. For privacy matters, contact us at privacy@genealogic.ai.

2. What data we collect

We collect the following categories of data:

• Account data: name, email address, password (hashed), account tier, registration date.
• Family tree data: names, dates, places, occupations, notes, and relationships you enter about persons in your tree. This may include data about living relatives.
• Uploaded documents and photos: stored securely in AWS S3 (eu-central-1, Frankfurt).
• Usage data: pages visited, features used, error logs, and timestamps — for service improvement and debugging.
• Analytics: we use Google Analytics to understand how the site is used. This collects anonymised data such as page views and session duration.

3. Legal basis for processing

We process your data on the following legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interest: to improve the Service, prevent fraud, and ensure security.
• Consent: for analytics and any optional communications you opt into.
• Legal obligation: where required by Dutch or EU law.

4. How we use your data

• To provide, maintain, and improve the Service
• To authenticate your account and authorise access
• To process documents and generate AI-assisted content
• To send transactional emails (invitations, password resets) via Brevo
• To analyse usage patterns and fix bugs
• To comply with legal obligations

We do not sell your data. We do not use your family tree data or uploaded documents to train AI models.

5. AI processing

Genealogic uses Claude (Anthropic) to generate historical context and analyse uploaded documents. Document content and person data may be sent to Anthropic's API to generate responses. Anthropic processes this data as a data processor acting on our behalf under a data processing agreement. Data is not retained by Anthropic for model training. For more information, see Anthropic's Privacy Policy.

6. Data storage and security

Your data is stored on servers in the European Union. Documents and photos are stored in AWS S3 (Frankfurt, Germany). We use encryption in transit (TLS) and at rest. Access to production systems is restricted to authorised personnel only.

7. Data sharing

We share data with the following third-party service providers solely to operate the Service:

• AWS — file storage (Frankfurt, EU)
• Anthropic — AI processing (data processor)
• Brevo — transactional email delivery
• Google Analytics — anonymised usage analytics

We do not share your data with other third parties without your explicit consent, except where required by law.

8. Your rights (GDPR)

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing in certain circumstances
• Portability — receive your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time where processing is based on consent

To exercise your rights, email privacy@genealogic.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

9. Data about living relatives

Family trees may contain data about living persons. You are responsible for ensuring you have an appropriate basis for recording and storing data about living relatives. We recommend treating information about living persons with care and not sharing trees publicly without their knowledge.

10. Cookies

We use strictly necessary cookies for authentication (session tokens stored in localStorage). We use Google Analytics which sets cookies for traffic analysis. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

11. Retention

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law. Anonymised analytics data may be retained indefinitely.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in the app. Continued use of the Service after changes constitutes acceptance.

13. Contact

For any privacy-related questions, contact us at privacy@genealogic.ai.