Privacy Policy

outside/input. is a product of Human in the Loop BV, a private limited company registered in Utrecht, the Netherlands (KVK 42088253). In this policy, "we", "us", and "our" refer to Human in the Loop BV.

We provide a web application that helps inspectors, surveyors, and appraisers capture field observations (voice, photo, text) and generate professional reports with the help of AI.

This privacy policy explains what personal data we collect, why we collect it, how we process it, and what rights you have. It applies to our website at outsideinput.ai and our web application at app.outsideinput.ai. The use of the application itself, including subscriptions and cancellation, is governed by our Terms of Service.

2.1 Account data

When your account is created, we store your email address and a securely hashed password. We do not collect your name, phone number, or other personal identifiers unless you provide them voluntarily.

2.2 Inspection data

When you use the application, we store the data you create:

• Voice recordings and their transcriptions
• Photographs you capture or upload
• Text notes you enter
• Project details (e.g. vessel name, property address)
• AI-generated report drafts based on your observations
• Final reports you approve and deliver

This data belongs to you. We process it solely to provide the service you signed up for. Where your reports contain personal data of your clients, you are the controller and we are your processor; see section 9 of our Terms of Service.

2.3 Website statistics (no cookies)

We count visits to this website with our own statistics, without cookies. For each page you view we record: the page, the website or campaign you came from (only its domain name, never the full address), your country (derived from your IP address by our hosting provider; the IP address itself is not stored), whether you use a phone, tablet or computer, whether you stayed longer than 10 seconds, and clicks on links to the demo, sign-up, sample report or contact details. A random code, kept in your browser tab until you close it, groups the pages of one visit. We do not store anything that identifies you as a person.

If you reach the site through a link in an email we sent you, that link contains a short code for your organisation, and we record it with the visit so we know the email was of interest.

To opt out, choose "Decline" in the cookie banner or turn on Global Privacy Control in your browser. The data is stored with Supabase in the EU and deleted after 13 months.

2.4 Google Analytics (cookie-based, only with consent)

Google Analytics is only loaded if you give explicit consent via the cookie banner. It would then collect:

• Pages visited and time spent
• Referring website or campaign
• Device type, browser, and screen size
• Approximate location (country/city level, IP anonymised)

We do not use advertising cookies, retargeting pixels, or social media trackers.

2.5 Technical logs

Our hosting providers (Vercel for the website, Supabase for the application) automatically log IP addresses, request timestamps, and error details for security and debugging purposes. These logs are retained for a limited period and are not used for profiling.

When you capture observations (voice, photo, text), they are sent to AI services to transcribe audio, describe images, match notes to checklist items, and draft report sections. This processing is essential to the service you use. The providers we use are listed in section 10.

Your data is not used to train AI models. We only use the paid or business API access of our providers, where their terms exclude training on your content, and we turn off optional data-sharing settings where a provider offers them. Before a note goes to TypeSafe, we remove the names and contact details we know of. This filter does not apply to the other providers, and photos and voice recordings cannot be filtered this way.

Providers may keep the data we send them for a period set out in their terms, for example for security and abuse monitoring. The providers that process your inspection data act as our subprocessors under data processing agreements.

• Database and file storage: Supabase (infrastructure hosted on AWS, EU region). Your inspection data, account data, and uploaded files are stored here.
• AI processing: Google (Gemini), Anthropic, ElevenLabs and TypeSafe process data on our behalf, mainly in the USA, under data processing agreements. Providers may keep data for a period set out in their terms, but may not use it to train their models.
• Automation: n8n Cloud (EU) orchestrates background workflows (e.g. triggering AI processing when you finish an inspection).
• Website hosting: Vercel (global CDN, primary in EU).

Where data is transferred outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by the GDPR.

We use the following cookies:

You can change your analytics cookie preference at any time by clicking "Cookie Settings" in the website footer.

• Inspection data: Retained for as long as your subscription is active. After your subscription ends, we keep it for 30 more days so you can download everything via Settings ("Download al mijn data"). After those 30 days we automatically and permanently delete your inspections, photos, voice recordings, notes, reports, report templates and branding. If you subscribe again within those 30 days, nothing is deleted.
• Account and billing data: Your user account and your organisation's name and billing details are kept after your subscription ends, so you can return and our records stay correct. On request we delete your account as well, within 30 days, unless we are legally required to retain the data (for example invoices, which Dutch tax law requires us to keep for 7 years).
• Website statistics: Deleted after 13 months.
• Google Analytics data (if enabled): Retained by Google Analytics for 14 months, then automatically deleted.
• Server logs: Automatically deleted after 30 days.

Under the GDPR, you have the right to:

• Access your personal data — request a copy of what we store
• Rectify inaccurate data — ask us to correct errors
• Erase your data — request deletion of your account and associated data
• Restrict processing — ask us to temporarily stop processing certain data
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent for analytics cookies at any time via the cookie banner

To exercise any of these rights, email us at privacy@outsideinput.ai. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We protect your data with the following measures:

• All data transmitted over HTTPS (TLS encryption)
• Passwords hashed using industry-standard algorithms (bcrypt via Supabase Auth)
• Row Level Security (RLS) on all database tables — users can only access their own data
• Private storage bucket with signed, time-limited URLs for media access
• Inspection data is only shared with the users of your own organisation (per-organisation isolation)

We use the following third-party services to operate outside/input.:

Our service is designed for professional use and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

We may update this privacy policy from time to time. When we make significant changes, we will update the "Last updated" date at the top. We encourage you to review this page periodically.

If you have any questions about this privacy policy or how we handle your data: