PLEXARIS
Privacy Policy | version 2.1 | September 2026
This translation is provided for convenience. In case of conflict the Dutch version prevails.
Plexaris Privacy Policy
This policy explains which personal data Plexaris processes, why, on what legal basis, for how long, with whom they are shared and what rights you have. It applies to the website, to the services Plexaris provides to businesses, to the Direkto platform (for connected businesses and for people who use Direkto through an AI assistant or website) and to SPEAQ ID to the extent that Plexaris is the controller for it.
1. Who we are
QSR2go Operations B.V., trading as Plexaris (hereinafter: Plexaris), established at Waaier 30b, 2451 VV Leimuiden, Chamber of Commerce (KvK) number 62031619, is the controller for the processing operations described in this policy, except where it is stated that Plexaris is a processor.
Contact for privacy questions: Frank van Bokhorst, by e-mail to frank@plexaris.com, or in writing to the above address marked "Privacy". Plexaris has not appointed a data protection officer; the processing operations of Plexaris do not fall within the cases in which that is mandatory (Article 37 GDPR).
2. Who this policy applies to
| You are | What you use | See in particular |
|---|---|---|
| A visitor to the website | plexaris.com, portal.direkto.org, speaq.id and subdomains | sections 4.1, 10 |
| A contact person at a (prospective) client or partner | Quotations, projects, invoices, portal accounts | section 4.2 |
| A business connected to Direkto | Listing, own app, website assistant, portal | sections 3, 4.2, 4.3 |
| An end user of Direkto | Direkto or an own app in ChatGPT, Claude or another AI platform; a website assistant on the site of a connected business | sections 3, 4.4, 4.5 |
| A user of SPEAQ ID | Signing in with SPEAQ ID | section 4.6 |
3. Who is responsible for what (Direkto)
Direkto brings three parties together: Plexaris, the connected business and the AI platform. That calls for a clear division of roles.
| Processing | Controller | Explanation |
|---|---|---|
| Your conversation with an AI assistant (what you type, what the assistant replies) | The AI platform (OpenAI for ChatGPT, Anthropic for Claude, or another platform) | Processed under the privacy policy of that platform. Plexaris does not receive your whole conversation, only the structured requests that the assistant sends to Direkto (such as a search query or a price request). |
| The requests to Direkto and the usage statistics (which tool, which connected business, when; without personal data) | Plexaris | To make Direkto work, to secure it and to improve it, and to report to connected businesses. |
| Your account with a connected business, your orders, order status, shipping details, customer prices, sample requests | The connected business; Plexaris is the processor | Plexaris processes these data only on behalf of the connected business, under a data processing agreement, in order to provide the requested function (for example, showing your order status). |
| Data of contact persons of connected businesses, portal accounts, invoicing | Plexaris | To provide the service and to invoice. |
| Website assistant on the website of a connected business | The connected business as the controller for its website; Plexaris as the processor for the assistant, and as the controller for its own usage statistics | The connected business informs you in its own privacy policy. |
Where an own app is published under the name of a connected business, the privacy policy of that business is shown with the app on the AI platform; this Plexaris policy applies in addition to the part for which Plexaris is the controller.
4. Which data we process, why and on what legal basis
4.1 Visitors to the website
| Data | Purpose | Legal basis |
|---|---|---|
| Technical data: IP address, browser, device, operating system, pages visited, referring page, time | Displaying the website, securing it and tracing errors | Legitimate interest (operation and security) |
| Data you enter in forms: name, company, position, e-mail, telephone, message | Answering your question, scheduling a meeting, preparing a quotation | Taking (pre-contractual) steps at your request; legitimate interest in business contacts |
4.2 Clients, connected businesses and partners (contact persons)
| Data | Purpose | Legal basis |
|---|---|---|
| Name, position, business e-mail address and telephone number, company details, correspondence | Quotations, agreements, project delivery, support, relationship management | Performance of the agreement; legitimate interest |
| Portal account: login credentials (hashed), role, actions in the portal (audit log) | Access to the Direkto portal, security, accountability for changes | Performance of the agreement; legitimate interest (security) |
| Invoicing and payment details | Invoicing, collection, accounting | Performance of the agreement; legal obligation (statutory tax retention obligation) |
| Data from conversations, including recordings or transcripts of video calls | Keeping a record of arrangements and requirements | Legitimate interest; a conversation is only recorded if this has been announced in advance, and you may object to it |
| Business newsletters and invitations | Informing you about services and developments | Legitimate interest for existing clients; consent for others; you can always unsubscribe |
4.3 Connected businesses: content and data about the business
The content that a connected business supplies (products, prices, texts) does not in principle contain personal data. If the content does contain personal data (for example, a contact person in a "contact us" text), Plexaris processes those data in order to display the content, on the basis of the agreement with the connected business. The connected business is responsible for the lawfulness of that content.
4.4 End users of Direkto through an AI assistant
| Data | Purpose | Legal basis | Role of Plexaris |
|---|---|---|---|
| Structured requests from the AI assistant to Direkto: products searched for, configurations chosen, information requested, language, channel; technical request ID | Providing the requested information (search, price, availability, link) | Legitimate interest (providing the service you request through the assistant) | Controller |
| Usage statistics: which tool, which connected business, result (succeeded, error), time; without the content of your question and without identifying data | Making Direkto work, securing it, improving it and reporting to connected businesses | Legitimate interest | Controller |
| Access token if you sign in to a connected business from the assistant; a hashed reference to your customer ID at that business | Showing your customer prices or order status | Performance of the agreement between you and the connected business; processing on behalf of that business | Processor |
| Order status, shipping details (track-and-trace number, postcode of the delivery address) that the connected business supplies to Direkto | Showing your order status and parcel status | Same as above | Processor |
| Data you provide with a sample or trial request (company name, contact details, address) | Forwarding the request to the connected business | Same as above; the request is made at your request | Processor |
What Plexaris does not do: Plexaris does not store the full content of your conversation with the AI assistant, does not store passwords, does not build a profile of you across multiple connected businesses, and does not use your data for advertising.
4.5 End users of a website assistant
With a website assistant on the site of a connected business, your conversation runs through the systems of Plexaris and through a language model provider (see section 6). Plexaris processes the content of the conversation only for as long as is necessary to reply and does not store any conversation content containing personal data; only usage statistics without content. The connected business is responsible for the information on its website and informs you in its own privacy policy.
4.6 SPEAQ ID
If you sign in with SPEAQ ID, Plexaris processes the data needed to verify your sign-in: a public key or decentralised identifier (DID), a cryptographic signature on a one-time challenge, and the time. In doing so, Plexaris does not receive a password, e-mail address or telephone number from SPEAQ ID. If you sign in to the Direkto portal with SPEAQ ID, Plexaris links your DID to your portal account and stores a display name and the times of linking and of the last sign-in. A separate privacy policy applies to SPEAQ ID at speaq.id/privacy.
5. How we obtain your data
- Directly from you: through forms, e-mail, telephone, conversations, the Direkto portal, or through the AI assistant that forwards your request.
- From the connected business: if you are a customer of a connected business and request your order status, that business supplies the status to Direkto.
- From the AI platform: only the structured requests that the assistant makes on your behalf and, if you sign in, a technical session identifier.
- From public business sources (such as the website of a company, the Chamber of Commerce (KvK), LinkedIn) in the course of business contact with companies.
6. With whom we share data
Plexaris does not sell personal data. Plexaris shares data with:
| Recipient | For what purpose | Location |
|---|---|---|
| Connected businesses on Direkto | Your request, sample request or click-through goes to the business from which you want to order something; that business is itself responsible for this | The Netherlands and the EU |
| AI platforms (OpenAI, Anthropic, possibly others) | They process your conversation and send requests to Direkto; they are independent controllers for the conversation | See the privacy policy of the platform; processing may take place outside the EEA |
| Language model provider: Google (Gemini) | Summarising the public website of a business that applies to join Direkto | Possibly outside the EEA (United States); see section 9 |
| Hosting and database: Supabase (database), Vercel (hosting) and Google Cloud (back-ups) | Storage and operation of Direkto and the portal | EU: Frankfurt (Supabase, Vercel) and Belgium (Google Cloud); the providers are American companies, see section 9 |
| E-mail: Resend | Sign-in links, confirmations and notifications by e-mail | Possibly outside the EEA (United States); see section 9 |
| Accounting, payment and collection services | Invoicing and payment | The Netherlands and the EU |
| Advisers (accountant, lawyer) | To the extent necessary for advice and accountability | The Netherlands |
| Government and supervisory authorities | Where the law requires it | The Netherlands and the EU |
Plexaris enters into a data processing agreement with its processors. An up-to-date list of processors is available on request via the address in section 15.
7. Automated decision-making and AI
Direkto provides information to AI assistants; it does not take decisions about you that have legal effects and does not create a profile of you. Which connected businesses an AI assistant suggests is determined by the AI platform on the basis of your question and the structured data that Direkto provides (category, characteristics, location, offering), not on the basis of data about you as a person.
8. How long we keep data
| Data | Retention period |
|---|---|
| Technical web logs | 30 days, then deleted or anonymised |
| Contact requests and correspondence without follow-up | 12 months |
| Client and partner data, agreements, project documentation | Duration of the relationship plus 5 years |
| Recordings and transcripts of conversations | 12 months after the conversation; if they form part of a project file, the period for that file |
| Invoices and tax data | 7 years (statutory retention obligation) |
| Direkto usage statistics (without personal data) | Indefinitely in aggregated form; request logs with technical request ID 12 months |
| Access tokens and hashed customer references (account linking) | For as long as the link is active; deleted immediately upon revocation, upon termination of the connected business, or after 12 months without use |
| Order status and shipping data retrieved by Direkto | Not stored; only temporarily in cache for a maximum of 24 hours |
| Sample requests | Forwarded to the connected business; kept by Plexaris for 90 days for accountability purposes, then deleted |
| Website assistant conversation content | No website assistant is in use yet; once there is one, the conversation content will not be kept after the reply |
| Portal audit log | 2 years |
Periods may be longer where a legal obligation, pending dispute or legitimate interest requires it.
9. Transfers outside the European Economic Area
Plexaris stores Direkto data in the EU: the database and hosting in Frankfurt, the back-ups in Belgium. The providers of these services (Supabase, Vercel and Google) are American companies, and when AI platforms, the language model (Google Gemini) and the e-mail service (Resend) are used, data may be processed outside the EEA, in particular in the United States. Plexaris bases such transfers on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the standard contractual clauses of the European Commission, supplemented by appropriate measures. The Data Privacy Framework was upheld by the General Court of the European Union on 3 September 2025; an appeal against that judgment is pending before the Court of Justice. If the Data Privacy Framework lapses, the standard contractual clauses will apply to the recipients concerned. You may request a copy of the safeguards used via the address in section 15.
10. Cookies and similar technologies
The Plexaris website uses:
- Strictly necessary cookies for the operation of the site and, where applicable, for signing in to the portal. No consent is required for these.
- No analytical cookies or scripts.
- No other cookies.
Because no non-essential cookies are placed, there is no cookie banner. The application form on portal.direkto.org stores what you enter locally in your browser for up to seven days, so that you can continue later; those data only leave your browser when you submit the form. You can refuse or delete cookies and locally stored data through your browser.
The AI platforms and the websites of connected businesses place their own cookies under their own policies.
11. Security
Plexaris protects personal data with measures appropriate to the nature of the data, including: encryption in transit (TLS) and encryption of API keys and access tokens at rest; logical separation of data per connected business; role-based access; logging without personal data; regular updates and monitoring; and data processing agreements with suppliers. No method is completely secure; in the event of a breach that poses a risk to you, Plexaris will inform the data subjects and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) in accordance with the law.
12. Your rights
You have the right to:
- request access to the personal data that Plexaris processes about you;
- have inaccurate data rectified;
- have data erased, if there is no longer any ground for keeping them;
- have the processing restricted;
- object to processing based on legitimate interest, including direct marketing;
- receive your data in a commonly used format (data portability), where applicable;
- withdraw any consent you have given, without affecting the processing carried out before the withdrawal.
Send your request to the address in section 15, or by e-mail to frank@plexaris.com. Plexaris will respond within one month; for complex requests that period may be extended by two months, in which case you will be notified. Plexaris may ask for identification to prevent data from being disclosed to the wrong person.
If your request concerns data for which a connected business is the controller (such as your orders), Plexaris will forward your request to that business or refer you to it. If it concerns your conversation with an AI assistant, please contact the AI platform.
You have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or with the supervisory authority in the EU country where you live or work.
13. Children
The website and services of Plexaris are aimed at businesses and at persons aged sixteen and over. Plexaris does not knowingly process data of younger children; if this has nevertheless happened, please contact us so that the data can be erased.
14. Changes
Plexaris may amend this policy, for example in the case of new services, new processors or changes in legislation. The date at the top indicates the most recent change. In the case of material changes, Plexaris will inform clients and connected businesses by e-mail or through the portal.
15. Contact
QSR2go Operations B.V., trading as Plexaris
Waaier 30b
2451 VV Leimuiden
Chamber of Commerce (KvK): 62031619
E-mail: frank@plexaris.com
Privacy requests may be sent in writing to this address, marked "Privacy", or by e-mail to frank@plexaris.com. Contact person: Frank van Bokhorst.
Version 2.1, September 2026. This version replaces the Privacy Policy of March 2026.