Who is responsible
This website is run by Joost Tamboer, trading as Tamboer AI, Chamber of Commerce (KVK) number 42176016. Send questions about your data, or a request for access or deletion, to joost@tamboerai.nl.
Campaign codes and page addresses
While visit measurement is on, Google receives the page path and accepted campaign codes only. We exclude URL fragments, arbitrary query parameters and free search terms (utm_term). The referrer is reduced to its origin. The same limits apply to stored attribution; codes may be carried across a language switch. WhatsApp and email drafts contain only your message or tool result, without campaign codes or referral information. A contact click records a contact start, not a received lead. Switching measurement off keeps all tools and contact routes available. It stops further events and reloads the page to stop active measurement code, so save a tool result first.
What runs today
- Cloudflare Web Analytics measures aggregated visits and traffic sources. This measurement uses no cookies, local storage or browser fingerprinting. Read how Cloudflare Web Analytics works.
- Google Analytics 4 starts by default on a visit, without asking for permission first. A saved opt-out and internal test traffic remain excluded. It measures page views and fixed events for CTA visibility and clicks, navigation, sections, FAQs, scroll milestones, active time, cases, tools, steps, safe error codes, output actions and contact clicks. Web performance is measured only as a metric, rating and number. Google Signals and advertising personalisation are disabled in the site code; advertising storage, advertising user data and advertising personalisation remain denied.
- Microsoft Clarity also starts by default, for heatmaps and session recordings. Google Analytics and Clarity use cookies for this visit measurement. You can turn both off through Analytics preferences. Public page content, mouse movements, clicks and scrolling may be visible. Input, selection and output fields, email drafts and dynamic tool results are masked. Clarity does not start when the page address contains a URL fragment or unknown query parameters, or the referrer contains query parameters. Tamboer AI does not use Clarity identity links with names or contact details.
- The site does not send entered free text, an email address, email content, a tool result or a full contact destination as a custom analytics field. WhatsApp and email message content stays in browser memory until the contact click and is not present in the measured link.
- A click on email or WhatsApp is a start of contact, not proof that the message was sent. The site sends no name, email address, email content, WhatsApp destination or tool outcome to Google Ads. Enhanced conversions are switched off.
- While visit measurement is on, the browser stores the first and last traffic source locally, for example "google" and a campaign name, never your name or search query. The last traffic source expires after 30 days. Attribution stays in analytics and is not added to WhatsApp or email messages. Apart from the request form, the site sends nothing.
- The page /en/free-ai-plan has a request form. What you enter (name, email, company or website, and if you like your question and phone number) goes through Cloudflare to storage at Cloudflare (D1) and as a notification through SMTP2GO to the Tamboer AI mailbox. Cloudflare Turnstile checks that a person fills in the form. WhatsApp and email keep working alongside it; there you compose your message yourself. WhatsApp runs through a redirect on this site, without a phone number in the pages.
- The AI Operating System scan, process check, calculator, baseline builder, prompt builder and control card builder work in your own browser. They send nothing to a Tamboer AI server.
- If you download a tool outcome, the browser creates a text file locally. Tamboer AI does not receive a copy.
- GA4 event data is retained for 14 months without renewal on new activity. Clarity retains ordinary recordings for 30 days and click and heatmap data for up to 9 months under its current service terms.
Visit measurement starts by default. You can turn it off below.
Local storage and analytics
The site uses tamboer_measurement_consent_v2 for your active choice about visit measurement, with a version and timestamp. The default setting is not saved as an active visitor choice. A previous refusal in tamboer_marketing_consent_v1 remains in effect. An existing refusal in tamboer_analytics_optout_v1 remains in effect. tamboer_internal_traffic_v1 excludes internal traffic locally. tamboer_attribution_v1 stores first and last traffic sources while visit measurement is on. Switching it off removes that attribution and accessible Google and Clarity cookies on this domain.
Analytics receives fixed page, navigation, visibility, section, case, CTA, tool, performance, error and contact codes. Tool runs are numbered within the open page only. Free text, email addresses, volume, minutes, rates, costs and tool output are never included as custom event parameters. While visit measurement is off, fixed events may remain temporarily in page memory for site operation and testing; they are not stored or sent later.
The baseline builder can pass core fields to the calculator via the URL hash. That hash is not sent to analytics. The tools do not store the content and only build an email locally.
If you message or email
A WhatsApp message arrives on Joost's phone, via the WhatsApp service of Meta. An email arrives in the Tamboer AI mailbox at STRATO, a German hosting provider. Joost uses your message, your name or company name and your contact details only to answer your question or your request for a free AI plan. The legal basis is your own request for contact. If no programme follows, Joost deletes your message and your contact details no later than 12 months after the last contact. If a programme does follow, the retention period is in the proposal. Do not send client, case-file or other sensitive personal data in that first message. Use anonymised examples.
The request form
If you fill in the request form on /en/free-ai-plan, Joost uses your name, email address, company or website and, if you enter them, your question and phone number to answer and follow up your request. The legal basis is that you ask for a free AI plan yourself: steps taken at your request, before any agreement exists. If no programme follows, Joost deletes your request no later than 12 months after the last contact. If a programme does follow, the retention period is in the proposal. What you enter in the form is not sent to Google Analytics or Clarity; the form is masked for Clarity and the measurement only sees that a request has arrived.
Your request is stored in a Cloudflare database (D1) within the EU jurisdiction and sent as an email notification through SMTP2GO. SMTP2GO (Sand Dune Mail Ltd) is based in New Zealand. For accounts in the EU, SMTP2GO states that it processes emails through servers in the EU and the United Kingdom, and keeps the data of those emails for 35 days by default. Cloudflare Turnstile uses your IP address, the TLS fingerprint and user agent of your browser and the address of this website to recognise whether a person fills in the form. Turnstile does not read what you enter and sets no cookie by default. Cloudflare states that it does not use this data for advertising, but does use it as an independent controller to improve bot detection.
Parties that process data during the visit and contact: Cloudflare (hosting, cookieless visit measurement, Turnstile and storage of requests in D1), SMTP2GO (email notification of a request), Google (Analytics), Microsoft (Clarity), STRATO (email) and Meta (WhatsApp).
Transfers outside the EEA
Google and Meta are US companies. When using Google Analytics and Microsoft Clarity, or the WhatsApp button, data can be transferred to the United States. Google states that it relies on the EU-US Data Privacy Framework for such transfers; see the Google frameworks page. For WhatsApp, Meta's own privacy policy applies; the safeguard Meta uses is stated there, not here. Cloudflare provides hosting through an international network. Hosting data may also be processed outside the EEA; a regional processing boundary requires a separate Cloudflare Pages configuration. Cloudflare states that it participates in the EU-US Data Privacy Framework and uses standard contractual clauses for other transfers; see the Cloudflare privacy policy. Your visit-measurement choice does not change necessary hosting. International processing is subject to the contractual and legal safeguards of the provider involved; email uses STRATO and WhatsApp uses Meta.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to object, and to receive the data you provided yourself. For analytics you do not need to ask: use the "Change analytics preferences" button above, and you can switch it off at any time. If you want to know what was kept from your message, or want it deleted, email joost@tamboerai.nl. You get an answer within one month. If you disagree with how Tamboer AI handles your data, you can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
What this does not cover
A workflow at a client processes different data from this website. Which fields, systems and permissions belong to it is stated per process in the proposal and on the security page. This page says nothing about that processing.
