Privacy policy — LowCodeDevs

Who is responsible

LowCodeDevs (lowcodedevs.com) is run by Inesta, a company registered in the Netherlands. Inesta is the controller for the personal data described here. For anything about your data, email us — a person reads every message.

What we collect

Depending on how you use LowCodeDevs, we process these kinds of data:

Account data: your name, email address, password (stored only as a secure hash), preferred language and region, and a profile photo if you upload one.
Sign-in data: if you sign in with Google, GitHub or LinkedIn, that provider shares your name, email address and, where available, your profile photo with us. We never receive your password there.
Profile and listing data: what you publish about yourself, your agency or your projects — description, location, tools, website, team and case studies.
Reviews and contributions: the reviews, ratings, pros and cons and tool-map placements you submit, together with your name.
Project requests: your name, email address, company, phone number if you give it, and what you tell us about the project, budget and timeline.
Payment data: Stripe handles all payments. We receive your billing name, address, VAT number and the status of your subscription — never your full card number.
Email data: which service emails we sent you, whether they were delivered and, where tracking is on, whether they were opened or a link was clicked.
Technical and security data: IP address, browser type, the country derived from your IP address, sign-in attempts and error reports.
Usage data — only with your consent: analytics and advertising cookies and, if you allow marketing, recognition of the company network you visit from.

Why we use it, and on what legal basis

Under the GDPR we need a legal basis for each use. These are ours:

To create and run your account, publish your profile and provide the plan you bought — performance of a contract.
To pass your project request on to the agencies and developers it fits, who can then contact you — performance of a contract, at your request.
To invoice and keep the financial records Dutch tax law requires — legal obligation.
To keep the site secure: verifying sign-ins, limiting abuse, preventing fraud and fixing errors — legitimate interest.
To send service emails, lead alerts and occasional tips about your account — performance of a contract or legitimate interest. You can switch off the optional ones in your notification settings or with the link in every such email.
To send our newsletter, only if you subscribed — consent, which you can withdraw at any time.
To measure how the site is used and which campaigns work — consent, given and withdrawn in the cookie settings.
To translate public content such as profiles and reviews into the languages of the site — legitimate interest in making the directory useful across Europe.

What is public

LowCodeDevs is a public directory. Profiles, case studies, reviews and the name shown with a review are visible to everyone and can be indexed by search engines. Your email address, phone number and project requests are never shown publicly.

Some agency profiles were created by us from publicly available business information, so the market is complete from day one. If such a profile is about your business, you can claim it, correct it or ask us to remove it.

We use a small number of service providers. Each one processes data only on our instructions and under a data processing agreement:

Hetzner Online (Germany) — servers and database hosting.
Cloudflare — content delivery, security, bot protection and file storage.
Stripe — payments, subscriptions, invoices and the billing portal.
AhaSend — delivery of service emails.
ActiveCampaign — our newsletter, only if you subscribe.
Google — Tag Manager, Analytics and Ads, only with your consent; and Google sign-in if you choose it.
Leadinfo — recognising which companies visit the site from their network address, only with your marketing consent.
DeepL — translation of public content.
Sentry — error reports that help us fix bugs.
GitHub and LinkedIn — sign-in, only if you choose it.

When you send a project request, the agencies and developers who take it up receive your contact details and brief so they can reply. We may also share data when the law requires it. We do not sell or rent personal data to anyone.

Transfers outside the EU

Our hosting is in the EU. Some providers — such as Cloudflare, Stripe, Google, ActiveCampaign and Sentry — may process data in the United States. Where that happens we rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

We keep data only as long as we need it for the purpose it was collected for:

Account and profile data: as long as you have an account. When you ask us to delete it, we remove it, apart from what we must keep by law.
Project requests: as long as needed to connect you with agencies and handle follow-up, after which we delete or anonymise them. Requests that were never confirmed are deleted.
Invoices and payment records: seven years, as Dutch tax law requires.
Sign-in attempts and security logs: briefly — only as long as needed to detect and block abuse.
Email records: as long as your account exists, so we can show you what we sent and respect your preferences.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before.

Most of your data you can change yourself in your account settings. For anything else, email us. We answer within one month and may ask you to confirm your identity first.

If you think we handle your data incorrectly, please tell us first — we would like to fix it. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

How we protect it

All traffic is encrypted over HTTPS. Passwords are stored as one-way hashes, and every password sign-in is confirmed with a code sent to your email. Access to personal data is limited to the people who need it to run LowCodeDevs.

Children

LowCodeDevs is a business directory and is not meant for anyone under sixteen. We do not knowingly collect data from children.

Changes to this policy

When our services or the law change, we update this policy and the date at the top. If a change materially affects how we use your data, we tell account holders by email before it takes effect.

Privacy policy.