FutureStep AI

Privacy policy

Last updated: 5 November 2026

This is an English translation of our Dutch privacy policy (privacybeleid). If the two versions differ, the Dutch version applies.

FutureStep AI takes your privacy seriously. In this privacy policy we explain which personal data we process, for what purpose, on which legal basis, how long we keep it and which rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR).

1. Controller

FutureStep AI VOF, registered with the Dutch Chamber of Commerce (KvK) under number 99309742, is the controller for the processing of personal data through futurestepai.nl and the SaaS service.

Contact: info@futurestepai.nl

2. Which data do we process?

Depending on how you use our service, we process the following categories of data:

  • Account and contact details: name, email address, company name, phone number, job title.
  • Company information: industry, website, company description, goals.
  • Instagram data: Instagram handle, received Direct Messages (including sender name, username, profile picture URL and message content), conversation metadata, lead scores, intent classifications and AI-generated summaries. Also comments under your posts that an automation responds to (username, IGSID and the text of the comment).
  • Link clicks: when an automation sends a link in a DM, we turn it into a short link. If the recipient taps it, we record that it was tapped and when. We do not store the recipient's IP address, cookies or device data.
  • Payment and invoice details: subscription status, invoice details, transaction IDs. Card and bank details are processed only by Stripe and are not stored by us.
  • Usage data: login details, last-active timestamp, session data, email statuses (sent, opened, bounced).
  • Communication: messages via the contact form, email correspondence and support requests.
  • Cookies and analytics: only with consent, see section 9.
  • Advertising data: if you reach us through a Google ad and consent to marketing cookies, we store the click ID of that ad (gclid) and the time of the click. This lets us measure whether an ad led to a sign-up or a paid subscription. See section 9.

3. Purposes and legal bases

We process personal data only for the following purposes, based on a valid legal basis:

  • Performance of a contract (Art. 6(1)(b) GDPR): creating and managing the account, providing the DM inbox service, AI analyses, invoicing and customer service.
  • Legal obligation (Art. 6(1)(c) GDPR): keeping records and invoices for the statutory tax retention obligation.
  • Legitimate interest (Art. 6(1)(f) GDPR): security and abuse prevention, product improvement, transactional communication (such as service emails about your account, subscription or security) and limited logging to keep the service reliable.
  • Consent (Art. 6(1)(a) GDPR): analytics cookies, marketing cookies and ad measurement (Meta Pixel and Google Ads, including storing the click ID), any newsletter subscriptions and optional messages. Consent can be withdrawn at any time.

4. Instagram DM data

When you connect an Instagram account, we process the Direct Messages sent to that account. We do this only to provide the service: showing a central inbox, analysing intent, assigning lead scores and creating summaries.

The senders of DMs (your leads and followers) are data subjects whose data we process on your behalf as part of your business. As the account holder, you share responsibility for the lawful use of that data, including informing data subjects where applicable.

4.1 Meta Platform Terms

Our connection with Instagram works through the official Instagram Graph API and falls under the Meta Platform Terms and the Developer Policies. We do not sell, rent or license Instagram data to third parties, do not use it for advertising purposes and do not share it with data brokers or analytics providers beyond the sub-processors listed in section 6.

4.2 Permissions we request

When you connect, Instagram explicitly asks your permission for the following permissions. We use them only for the purposes listed below:

  • instagram_business_basic: reading your IG username and account ID, to link conversations to the right account.
  • instagram_business_manage_messages: receiving and sending Direct Messages, to provide the central inbox and automatic replies.
  • instagram_business_manage_comments: reading and replying to comments under your posts, to start an automation when someone posts a trigger word and to place a public reply under that comment.
  • instagram_business_content_publish and instagram_business_manage_insights: only if you schedule posts through FutureStep AI, to publish those posts and show statistics (such as reach and views) for your own posts.

4.3 Which Instagram data we store

  • The access token (encrypted at rest) and the IG Business Account ID of the connected account.
  • The content of Direct Messages to that account, including the sender IGSID, username, display name and profile picture URL.
  • Timestamps, read/unread status and AI derivatives (intent classification, lead score, summary).
  • Comments that started an automation, and per recipient the steps of that automation (such as: DM sent, link tapped, follow-up message sent).
  • Short links with the recipient IGSID, the target URL, the number of taps and the time of the first and last tap.

4.4 Deleting Instagram data

You can request deletion in three ways:

  • Through Instagram itself: Settings → Apps and websites → FutureStep AI → Remove. Meta automatically sends us a request and we delete all related data within 30 days.
  • Through our website: submit a request at futurestepai.nl/en/data-deletion.
  • By email: send a request to info@futurestepai.nl.

4.5 Follow-up message

If you switch on the follow-up message for an automation, we send the recipient one reminder with the same link if it hasn't been tapped after the time you set. This only happens within 24 hours after the recipient's own contact, as Instagram allows. If the recipient taps the link earlier, we don't send a reminder. We never send more than one reminder per link.

When your Instagram account is disconnected (by you or by Meta), the access token is invalidated immediately and we stop further processing of new DMs for that account.

5. AI processing

For lead scoring, intent recognition and summaries we use AI models, including models from third parties (such as Google Gemini and OpenAI through secure APIs). Messages are only offered to these models for processing insofar as necessary to provide the functionality.

We do not send data to AI providers for the purpose of training their models, and where possible we conclude contracts with AI providers that guarantee the same. AI results are not infallible; you remain responsible for your own actions based on those results.

5.1 AI chat in the portal

In the portal you can ask our AI chat questions. Your question, the page on which you ask it and the data from your own account needed for the answer (such as your automations and their figures) are sent to Google Gemini for this. If you add a photo, it is sent along as well. The conversation itself is only stored in your browser and disappears when you close the tab. Per question we only store the number of tokens used, to monitor costs and abuse. If you give a thumbs up or down, we store that question, the answer and any explanation you add to improve the AI chat.

6. Sub-processors

We use carefully selected sub-processors that help us provide the service. Where required, we have concluded a data processing agreement with each of them.

  • Lovable Cloud (Supabase): hosting, database, authentication, edge functions and file storage (EU region).
  • Stripe: processing of payments and subscriptions.
  • Mailgun / Lovable Email: sending transactional emails (order confirmation, account, subscription).
  • Strato: email infrastructure for the address info@futurestepai.nl.
  • Google (Analytics, Google Ads, Gemini API): website statistics and ad measurement (both only with consent) and AI processing.
  • OpenAI: AI processing for analyses of conversation data.
  • Meta / Instagram: source of the DM data, connected through official APIs.

7. Transfers outside the EEA

Some sub-processors (such as Stripe, Google and OpenAI) are based in the United States or process data there. In those cases we base the transfer on appropriate safeguards, such as the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

8. Retention periods

We do not keep personal data longer than necessary:

  • Account and company details: up to 30 days after the subscription is cancelled, then deleted or anonymised.
  • Instagram conversations and lead data: deleted immediately when the subscription is cancelled (on request an export period of 14 days can be granted).
  • Comments, automation steps and short links: as long as the automation exists. If you delete an automation, the related short links and click data are deleted too. On cancellation the same periods apply as for Instagram conversations.
  • Feedback on the AI chat: as long as your account exists; it is deleted when the account is deleted.
  • Invoices and bookkeeping: 7 years, in line with the statutory tax retention obligation.
  • Contact messages: up to 12 months after the last contact.
  • Email send logs: up to 12 months for diagnosis and deliverability.
  • Suppression list (unsubscribes): indefinitely, to keep blocking unwanted emails.
  • Analytics and marketing cookies: see section 9.
  • Click ID of an ad: up to 90 days in your browser. In our database the click ID is deleted no later than 100 days after the click; after that we only keep the fact that a paid subscription came from an ad, without the click ID.

9. Cookies and similar technologies

A cookie is a small text file that a website places on your device. We use cookies and similar technologies (such as localStorage) in line with the Dutch Telecommunications Act (article 11.7a) and the guidelines of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

On your first visit we show a cookie banner in which you can make choices per category. You can choose "Accept all", "Reject all" or "Preferences", and these options are equally prominent. Non-functional cookies are only placed after you give explicit consent. Making no choice means no consent: then no analytics or marketing cookies are placed.

9.1 Categories

Functional cookies (always on)

Strictly necessary for the site to work. No consent is required for these cookies. They do not collect data for analytics or marketing.

  • cookie-consent-v2 (localStorage): stores your cookie preferences. Retention: 6 months.
  • sb-* / supabase auth tokens (localStorage): session and authentication for logged-in users. Retention: until you log out or the session expires.

Analytics cookies (only with consent)

We use Google Analytics 4 (Measurement ID: G-YT1M56FSD0) to understand how the site is used. IP addresses are anonymised (anonymize_ip). Our Analytics account is linked to our Google Ads account, so we can see which ads bring visitors to the site. These cookies are placed only after explicit consent.

  • _ga: distinguishes unique visitors. Retention: up to 13 months.
  • _ga_*: stores the session state per property. Retention: up to 13 months.

Marketing cookies (only with consent)

We use the Meta Pixel (Facebook/Instagram) to measure how many visitors reach us and convert through our ads. This script is only loaded after you explicitly consent; before that consent there is no Meta cookie or pixel on your device at all.

We also use Google Ads conversion measurement (ID: AW-18544070481). If you arrive through a Google ad, we measure whether you then create an account, start a trial or take out a paid subscription. For this we store the click ID of the ad in your browser and, if you create an account, with your account. At your first payment we send that click ID together with the time and value to Google Ads. We do not send your name, email address or other customer data to Google. Without consent for marketing cookies the click ID is not stored and Google only uses anonymous signals without cookies (Google Consent Mode).

  • _fbp: Meta, recognises browsers for advertising purposes. Retention: up to 90 days.
  • _gcl_au: Google Ads, measures ad conversions. Retention: up to 90 days.
  • _gcl_aw: Google Ads, stores the click ID of an ad. Retention: up to 90 days.
  • fs-gads-click (localStorage): FutureStep, stores the click ID of an ad until you create an account. Retention: up to 90 days.

9.2 How long your consent is valid

Your cookie consent is valid for up to 6 months, in line with the recommendation of the Dutch Data Protection Authority. After that we automatically ask again whether you agree. Your preference is stored in localStorage; we don't use a tracking cookie for this.

9.3 Withdrawing or changing consent

You can withdraw or change your cookie consent at any time with the "Cookie settings" button at the bottom of every page. When you withdraw consent for analytics cookies, the related cookies (_ga, _ga_*) are removed from your browser immediately and measurement stops. If you withdraw consent for marketing cookies, the Meta Pixel and Google Ads measurement stop and we no longer store new click IDs.

9.4 Third-party cookies

For analytics cookies and Google Ads, data is processed by Google; for the Meta Pixel, by Meta. More information is in the Google privacy policy and the Meta privacy policy. Both parties may transfer data to third parties where legally required, or process it outside the EEA based on the EU-US Data Privacy Framework certification (Google and Meta participate in it).

9.5 No automated decision-making

The information collected through cookies is not used for automated decision-making with legal effects for you.

10. Security

We take appropriate technical and organisational measures to protect your data, including TLS/SSL encryption, role-based access control, Row-Level Security on the database, limited access to production data, logging and regular updates of our infrastructure.

11. Data breaches

In the event of a data breach that poses a risk to the rights and freedoms of data subjects, we report it to the Dutch Data Protection Authority within 72 hours of discovery and, where required, to the data subjects.

12. Your rights

Under the GDPR you have the following rights:

  • Access: ask which personal data we process.
  • Rectification: have incorrect data corrected.
  • Erasure: request that data be deleted ("right to be forgotten").
  • Restriction: have the processing restricted.
  • Objection: object to processing based on legitimate interest.
  • Portability: receive your data in a common format.
  • Withdraw consent: where processing is based on consent.
  • No automated decision-making: we do not make decisions with legal effects based solely on automated processing.

You submit a request through info@futurestepai.nl. We respond within 30 days at the latest. We may ask for additional identification to prevent abuse.

13. Data processing agreement (DPA)

For business customers who use FutureStep AI as a processor of personal data of their own leads and customers, we provide a data processing agreement (DPA) on request. Send an email to info@futurestepai.nl.

14. Complaints

Do you have a complaint about how we handle your data? Please contact us first. You also always have the right to lodge a complaint with the Dutch Data Protection Authority through autoriteitpersoonsgegevens.nl, or with the data protection authority in your own country.

15. Changes

We may change this privacy policy when our service, legislation or sub-processors change. The latest version is always on this page; for significant changes we inform account holders by email.