Loading...

PRIVACY POLICY EARLYUP - PRO

1.Introduction and Scope

Ergon AI B.V. operating under the trademark and brand name Earlyup (“Earlyup”, “we” or “us”) respects your privacy and is committed to protecting your personal data.

Purpose Privacy Policy

This Privacy Policy explains how Earlyup processes the personal data of professionals who register and use the Earlyup platform to offer their services. Earlyup operates as a digital platform that facilitates connections between independent professionals and private individuals (“users”) seeking to have certain services carried out. In doing so, we act as an intermediary and not as a contracting party between the professional and the user.

Pre-App and full version App

Earlyup will launch in two stages. The first stage is the Pre-App, which contains only limited core functionalities such as registration, account creation, and basic profile management. The Pre-App is designed to allow professionals to familiarise themselves with the platform and to start building their profile and presence. It does not yet include features such as bookings, integrated payments, full contractual workflows, or automated service agreements. The Pre-App may, however, include a limited payment feature that allows professionals to create payment links and receive payments through Stripe Connect, without Earlyup holding funds. Where this feature is enabled, Earlyup collects the required onboarding information and identity documents directly from you and submits these to Stripe for verification and payment processing. The second stage is the full launch of the Earlyup platform, which will introduce these additional features and functionalities.

For clarity, this Privacy Policy covers both the pre-launch version of the platform (the Pre-App) and the full version (the App). When reading this Privacy Policy in the context of the Pre-App, any section or functionality that is not yet available will be explicitly marked as “Not Applicable for Pre-App”. These provisions automatically apply once the App is launched in full. Upon launch of the full App, we will share the (updated) Privacy Policy and the General Terms and Conditions for the App with you again, and you will be asked to review and accept them before continuing to use our services.

Applicability Privacy Policy

This Privacy Policy applies exclusively to the processing of personal data of professionals who register, create a profile, manage their availability and services, interact with users, and carry out assignments through the Earlyup platform. With “professionals” we mean independent contractors, freelancers or service providers who offer their services through the platform, whether as natural persons or through a business entity. If you use the platform as a private individual, a separate privacy policy applies. That policy can be accessed here.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and, where applicable, the Dutch Implementation Act (Uitvoeringswet Algemene Verordening Gegevensbescherming, "UAVG"). This Privacy Policy includes detailed information about the types of data we collect, the purposes for which we use it, the legal bases we rely on and the rights you have as a data subject.

By creating an account and using our platform as a professional, you acknowledge that you have read and understood the General Terms and Conditions and this Privacy Policy.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, by updating your profile from time to time.

For an overview of the countries in which Earlyup is available, please refer to Annex II.

Contact Details

Earlyup is the controller of your personal data as described in this Privacy Policy. As controller, Earlyup determines the purposes for which and the means by which your personal data is processed, in line with the General Data Protection Regulation (GDPR) and the Dutch Implementation Act (UAVG). We are a company registered in the Netherlands, with our registered office at:

Pieter Breughelstraat 50
4625 BH in Bergen op Zoom

And registered in the Dutch Chamber of Commerce under number 91931797.

If you have any questions or concerns about the way we process your personal data, or if you wish to exercise your rights under the data protection law, you can contact our Data Protection Officer (DPO) at privacy@earlyup.ai.

We aim to handle all concerns with care and confidentiality. If you are not satisfied with the way we handle your personal data or respond to your request, you have the right to lodge a complaint with the Dutch Data Protection Authority: the Autoriteit Persoonsgegevens,. More information can be found at www.autoriteitpersoonsgegevens.nl.

2.What personal data we process and why

To provide you with access to the Earlyup platform as a professional, we need to process personal data. This data is either provided directly by you or collected automatically when you use the platform. In the table below, we explain what types of data we collect, when we collect them and for what purposes they are used. We only collect the information that is necessary for the operation of our platform, the fulfilment of our legal obligations, or the improvement of our services.

Type of dataWhen we collect itWhy we collect it
Account and identification details (name, date of birth, business name, address, email, phone number, Chamber of Commerce registration number, VAT number, profile photo) When you register for an account or update your details To identify you, create and maintain your account, and display your profile to customers
Stripe onboarding and verification data (KYC) (e.g. legal name, date of birth, address, nationality, business details, Chamber of Commerce details, beneficial owner / controlling person details, identity document data and verification status, copies of government-issued identity documents which may contain biometric data in the form of a photograph, bank account details for payout purposes, and, where required, supporting documents such as proof of address or company documentation) When you complete the Earlyup onboarding process and provide your personal details, identity documents (such as a copy of your passport or ID), and any supporting documentation required for payment processing. Additional documents may be requested if further verification is needed. Earlyup uses Stripe Custom Connect for payment processing. This means, Earlyup collects all required onboarding information and identity documents directly from you through the Earlyup platform. Stripe is not visible to you during this process. The information you provide is securely submitted by Earlyup to Stripe, after which Stripe performs the identity verification and KYC checks on our behalf. Stripe acts as a processor in this context, processing your data only on Earlyup’s instructions. You will interact exclusively with Earlyup throughout the onboarding process. Therefore we collect this information to verify your identity and eligibility for payment processing in accordance with applicable KYC and AML regulations.
Professional credentials and qualifications (diplomas, certificates, licences, proof of specialisation) During onboarding or when updating your profile To verify your qualifications and authorisations for the services you offer
Profile and service information (biography, list of services, specialisations, rates, service locations, photos, descriptions) When you complete or update your profile To inform customers about your services and match you with relevant work requests
Agenda and booking data (availability, scheduled appointments, confirmations, cancellations, rescheduling and AI-driven calendar management and automated scheduling) When you update your calendar or when customers book or amend an appointment, or when you provide us with instructions or information to manage and schedule your calendar automatically. To manage your availability, coordinate appointments, and keep both parties informed and to enable us to automatically manage and schedule your calendar based on the instructions or information you provide.
Communication data (content and metadata of messages and video calls via the platform) (Not Applicable for Pre-App) When you use the chat or video call function to interact with customers To facilitate service coordination, prevent misuse, and support dispute resolution
Financial and transaction data
Platform financial and billing data (Full App only) (e.g. bank details, subscription type, invoice data, payment history, commission records, revenue data)
When you set up payouts, complete bookings, or process payments through the platform To process your earnings, handle invoices, manage commissions, and meet financial and tax obligations
Payment links Pre-App + App (if payment links are enabled): when you activate Stripe Connect, create payment links, receive payments or request/receive payouts through Stripe.

Full App only: when you use paid platform features, process bookings, or when commission/subscription billing applies
Pre-App + App (if payment links are enabled): to enable payment links through Stripe Connect and provide transaction/payout insights. Payments and payouts are processed by Stripe; Earlyup does not hold funds and does not store full card data.

Full App only: to administer subscriptions and billing, calculate and charge commissions/fees (where applicable), and comply with accounting/tax obligations.
Tool and equipment rental data (details of rented items, price, availability, terms of use) (Not Applicable for Pre-App) When a customer books a service that includes tool or equipment rental To record rental agreements, arrange delivery or availability, and handle related payments
Ratings and performance metrics (customer reviews, response times, booking acceptance rates, completion rates, platform activity data) (Not Applicable for Pre-App) When you complete assignments or interact with customers To monitor quality, improve platform reliability, and determine visibility or perks
Technical and usage data (IP address, device identifiers, browser type, access logs, login times, interaction data) Automatically when you use the platform To maintain security, ensure platform functionality, and improve user experience
AI-matching and automated suggestions (profile data, service information, advice, and other relevant indicators) (Not Applicable for Pre-App) Automatically generated when a user submits a question or describes a need through the platform To analyse the request and provide initial guidance on possible steps the user could take to address the issue themselves, and to identify the type of professional or specific services that may be required, based on profile and service data
Minor verification data (copies of consent forms, verification of service risk category) When a professional under 18 registers and seeks to offer services To comply with legal requirements and internal safety standards regarding services offered by minors
Assignment agreement data (details of the specific job contract, including service description, agreed terms, date, time, and confirmation or signature records) (Not Applicable for Pre-App) When an assignment agreement is generated through the platform and confirmed or signed by the professional and the user To provide both parties with a legally valid record of the agreed service, to store a copy for administrative purposes, and to meet legal and contractual obligations
Insurance documentation (Not Applicable for Pre-App) When the professional uploads or updates proof of professional or business insurance To verify compliance with platform requirements and to ensure that services are provided safely and in line with applicable obligations
Location When you provide your service area or when we derive an (approximate) location from your device or IP address To show relevant job requests near you and to improve matching accuracy and fraud prevention
Support and correspondence records (communications with customer support or Earlyup) When you contact us or respond to our communications To resolve your issues, provide assistance, and maintain service quality

Special categories of personal data

We do not intentionally collect special categories of personal data (such as health information or data revealing racial or ethnic origin) unless strictly necessary and permitted by law. Similarly, we do not process information about criminal convictions unless legally required for certain services, in which case you will be informed in advance.

If, in exceptional circumstances, we need to process special categories of personal data, we will do so only where a lawful ground under Article 9 GDPR applies and with additional safeguards, which include restricted access, enhanced security controls and purpose limitation. We will inform you in advance and, where required, obtain your explicit consent.

Where identity documents such as passports or national ID cards are collected as part of the Stripe Custom Connect onboarding process, these may contain biometric data in the form of a photograph. Such data is processed solely for identity verification purposes and in accordance with applicable law. Earlyup does not use biometric data for any purpose other than forwarding it to Stripe for identity verification. Earlyup does not perform biometric analysis itself. Once submitted to Stripe, the data is processed by Stripe in accordance with its own privacy policy and retention obligations.

Please note that providing identity documents containing biometric data is strictly required for payment processing purposes only. If you do not wish to provide such documents, you will not be able to use the payment link feature. Earlyup does not use or analyse biometric data for any other purpose and does not retain it beyond the period required by applicable law. Where Earlyup operates outside the EEA, the processing of biometric data is subject to applicable local law in addition to the safeguards described in this Privacy Policy.

3.How we collect your data

We collect personal data from you in different ways. Some of this information is provided directly by you, while other information is collected automatically when you use the platform, or comes from third parties that help us operate and improve our services. The table below explains the sources and methods we use to collect your data and the reasons for doing so.

SourceHow we collect itWhy we collect it
Directly from you When you create an account, fill in your profile, update your details, upload documents, respond to customer requests, or communicate via our chat or video tools. Where payment processing is enabled, this also includes providing your identity documents and supporting documentation (such as a copy of your passport or ID, proof of address, and business details) directly through the Earlyup platform as part of the Stripe Custom Connect onboarding process. To set up and maintain your account, verify your identity and qualifications, match you with relevant assignments, and enable you to communicate with users
Automatically through your use of the platform When you log in, browse, interact with features, or exchange messages, our systems generate technical data such as log files, device identifiers, IP addresses, and session information To keep the platform secure, ensure proper functionality, measure performance, and improve user experience
From your transactions on the platform When you submit offers, agree on assignments, complete services, receive ratings, or make/receive payments, including updates to your availability or bookings initiated by the customer and When you and a customer confirm or sign the job contract generated by Earlyup To process payments, calculate commissions, maintain transaction records, monitor quality, reward high performance and To create a binding record of the service agreement
Through automated matching and ranking systems When your profile and performance data are used by our AI-based matching tools to suggest your services to customers To match you with relevant customer requests, provide advice to users, and improve the efficiency of the platform
From third parties From service providers that support our payment processing, hosting, analytics, and identity verification, or from customers providing feedback or ratings about your services. Where payment links are enabled, we receive back from Stripe only the verification status of your account (for example: pending, approved, rejected, or additional information required). Because we have not developed these tools in-house and leading third-party providers in the market offer proven, high-quality solutions. By relying on their expertise, we can deliver a secure, reliable, and high-performing platform while ensuring compliance with legal requirements, preventing fraud, verifying the information you provide, and maintaining trust on the platform

We only collect personal data from external sources when it is lawful to do so and when it is necessary for the operation of our platform. In all cases, we ensure that such data is processed in accordance with this Privacy Policy and applicable data protection laws.

4.Personal Data of Minors

  1. General principle
    The Earlyup platform is designed and intended for use by adults. We do not knowingly collect or process personal data of individuals under the age of eighteen without appropriate parental or guardian consent.
  2. Minor professionals
    Although the Earlyup platform is primarily intended for use by adults, certain low-risk services offered through the platform may also be performed by minors (for example: providing tutoring to younger students). In such exceptional cases, a minor may register and operate as a professional on the platform only if verifiable consent from a parent or legal guardian has been obtained in advance. The required consent must be granted before any personal data of the minor is processed or any service is provided, and the consent documentation will be retained in accordance with this Privacy Policy.
  3. Parental consent form
    The required parental consent form will be provided through the Earlyup platform. Both the professional and the parent or guardian must complete this form before any personal data of the minor is processed or the service is carried out.
  4. Applicability of this Privacy Policy
    When a minor is registered as a professional on the platform, all provisions of this Privacy Policy apply fully to the processing of their personal data. In addition, the parent or legal guardian who has provided consent has the right to exercise, on behalf of the minor, all rights described in the section Rights of data subjects.
  5. Retention of consent documentation
    A copy of the completed parental consent form will be retained by Earlyup for as long as necessary to demonstrate compliance with legal obligations, and in accordance with the retention periods set out in this Privacy Policy.
  6. Removal of unauthorised data
    If we become aware that personal data of a minor has been collected without the necessary parental or guardian consent, we will take steps to delete such data and the account promptly, unless retention is required by law.

5.Legal bases for processing and how we use your data

Under the GDPR and the Dutch UAVG, we must have a valid legal basis for every processing activity involving your personal data. This means that we only process your data when it is lawful, fair, and transparent to do so. The table below explains the legal grounds on which we rely, what types of data this applies to, and why the processing is necessary.

Legal basisWhat this meansExamples of processing activities
Performance of a contract We process your personal data where it is necessary for the execution of the agreement between you and Earlyup, or between you and a user through our platform. Without this data, we cannot provide you with access to our services or enable you to complete assignments. Where payment links are enabled, this also includes collecting onboarding information and identity documents through the platform and submitting these to Stripe for verification and payment processing. Creating and maintaining your account, verifying your identity and qualifications, matching you with customer requests, facilitating communication via chat or video, processing payments, handling customer bookings and your calendar, tool rentals and automated service matches for customers based on your profile. This includes processing platform credits or promotion features that affect your visibility, and managing any related billing events.

(For the Pre-App, this legal basis applies only to registration and account management; all activities marked as “Not Applicable for Pre-App” in Article 2 are excluded.)
Compliance with a legal obligation We process certain personal data to comply with laws and regulations that apply to us. Storing transaction records for tax purposes, complying with anti-money laundering regulations (AML), responding to lawful requests from regulatory authorities and verifying the age and permitted service categories of minors offering services through the platform. Retaining transaction and payout-related records where legally required (for example under accounting and tax rules). Earlyup collects all required onboarding information and identity documents directly from you and submits these to Stripe for identity verification (KYC) and payment processing. Stripe performs the actual verification on our behalf as processor.

Where biometric data is processed as part of identity verification, this is done solely on the basis of a legal obligation under applicable KYC and AML regulations, and only to the extent strictly necessary for verification purposes
Contract between professional and user When you and a user confirm or sign the job contract generated by Earlyup To create a binding record of the service agreement, ensure both parties have a copy, and store it in our system for contract administration and dispute resolution. In certain cases, we retain assignment agreements for a legally required period to comply with tax, accounting, or dispute-handling obligations.
Legitimate interests We may process your personal data where this is necessary for our legitimate business interests and where these interests are not overridden by your rights and freedoms. Our legitimate interests include maintaining the integrity and security of the platform, improving our services, and promoting trusted interactions. Monitoring usage patterns and performance metrics, operating ranking systems, preventing fraud or misuse, maintaining quality through ratings and reviews, developing new features, and improving user experience
Consent In certain cases, we process your personal data only with your explicit consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Sending you direct marketing communications not covered by legitimate interest, processing optional profile information you choose to share, collecting or storing sensitive personal data if ever applicable
Protection of vital interests In rare and exceptional circumstances, we may process your personal data to protect your vital interests or those of another person. Disclosing information to emergency services in case of an incident during the performance of a service

Provision of personal data and consequences of refusal

Certain information is necessary to create and maintain your account, to verify your qualifications and to process bookings and payments. If you do not provide this information, we may be unable to offer our service and offer you access to the platform or to complete specific transactions.

We only process your personal data for the purposes described in this Privacy Policy. If we wish to process your data for a new purpose that is not compatible with the original reason for collection, we will inform you in advance and, where required, ask for your consent.

6.International Data Transfers

Where possible, your personal data is processed and stored within the European Economic Area (EEA). Our servers are located in Germany. As Earlyup is available in several countries worldwide, personal data of professionals based outside the EEA may be transferred to and processed within the EEA. Such transfers are carried out in accordance with applicable data protection laws and the safeguards described hereunder.

When such transfers occur, we ensure that your personal data remains adequately protected in accordance with applicable data protection laws. Depending on the provider and the country of destination, we rely on one or more of the following safeguards:

  1. Transfers to countries that are the subject of an adequacy decision by the European Commission, confirming that they provide an adequate level of data protection.
  2. Transfers to United States organisations that participate in the EU–U.S. Data Privacy Framework.
  3. The use of standard contractual clauses (SCCs) approved by the European Commission, combined with additional technical and organisational measures where necessary.
  4. Other appropriate safeguards as required by law.

Where payment links are enabled, Stripe may process personal data (including verification data) in locations necessary to provide its services and comply with legal requirements. Stripe provides information on its international data transfer safeguards in its privacy documentation and contractual terms.

Where in-app subscriptions are enabled, RevenueCat may process personal data in the United States. RevenueCat provides safeguards for international data transfers in accordance with applicable data protection laws, including through Standard Contractual Clauses approved by the European Commission.

You may request further information about these safeguards, including a copy of the relevant transfer mechanism, by contacting our Data Protection Officer at privacy@earlyup.ai.

7.Data Sharing and Disclosure

We do not sell your personal data. We only share it when it is necessary for the purposes described in this Privacy Policy, when required by law, or when you have given your consent.

The table below outlines with whom we may share your personal data, when we share it and why.

RecipientWhen we share your dataWhy we share your data
Customers using the platform (Not Applicable for Pre-App) When you respond to a work request, exchange messages through the chat or video call function, share your availability via the calendar, confirm a booking, or agree on tool/equipment rental To enable customers to communicate with you, schedule appointments, request or confirm services, and make arrangements for tool or equipment rental
Payment and billing providers (Stripe) (Applicable only if payment links are enabled) When you complete the Earlyup onboarding process and submit your identity documents and details, when you create payment links, receive payouts, or when a booking involves commission handling by Earlyup. Earlyup operates a Custom Stripe Connect integration, meaning Earlyup collects all onboarding data and identity documents directly from you and submits these to Stripe via API for verification and payment processing. Stripe does not interact directly with you and acts as a processor on Earlyup’s behalf for verification activities. Stripe processes personal data in connection with payment processing, payouts and regulatory compliance. Depending on the activity, Stripe may act as an independent controller (for example when performing identity verification and meeting financial compliance obligations) and/or as a processor. Please review Stripe’s privacy policy for more information on how Stripe processes personal data.
IT and hosting (Supabase, Railway) Automatically, when you use the platform and its scheduling tools To securely host your profile and service listings
Tool and equipment rental partners (if applicable) (Not Applicable for Pre-App) When a customer books a service that includes hiring tools or extras through you To arrange delivery or availability of the equipment, record rental details, and handle related payments
Advertising and marketing partners (Meta, Google, TikTok, Apple, LinkedIn) When we run targeted advertising campaigns, use analytics, or build marketing audiences that may include hashed contact details or usage data To promote the platform, measure the effectiveness of advertising, and reach relevant audiences
Email marketing and campaign management providers (Mailchimp, Intuit, Amazon) When we send communications, newsletters, or promotional offers to professionals or customers To manage mailing lists, distribute communications, and monitor campaign performance
Analytics and performance monitoring providers (Posthog, Sentry) When you interact with the platform or complete assignments To measure response times, booking rates, ratings, monitor system errors and other performance indicators, which may influence visibility or perks
AI providers (OpenAI, Amazon Web Services – future) When AI-based tools are used to generate advice, suggestions, or matching To analyse service requests, provide guidance to users, and improve the accuracy of professional matching
SMS and communication providers (Twilio) When we send SMS confirmations for registration or account verification To confirm your phone number and secure your account
Customer support providers (Retool) When you request assistance from our helpdesk To respond to your questions, resolve technical issues, and support your use of the platform
Regulatory authorities and law enforcement When required by applicable law or following a lawful request To comply with legal obligations, respond to lawful investigations, or protect our rights and those of our users
Legal and professional advisers When necessary to defend against claims or to enforce our terms To obtain legal advice, manage disputes, and protect our business interests
Subscription management providers (RevenueCat) When you purchase, renew, cancel or restore an in-app subscription through the EarlyUp app To manage in-app subscription status, validate purchase receipts, prevent fraud, track entitlements and provide subscription analytics. To processes transaction data and device information on our behalf. RevenueCat does not have access to your full payment details; payment processing is handled by Apple or Google directly.

Please note, that when you make an in-app purchase, Apple (App Store) and Google (Google Play) also process transactional and technical data as independent controllers, in accordance with their own privacy policies. EarlyUp does not control or have access to this data. For more information, please refer to Apple’s Privacy Policy at apple.com/legal/privacy and Google’s Privacy Policy at policies.google.com/privacy.
Internal use within Earlyup Automatically, as part of platform operation To analyse performance data, determine visibility in rankings, maintain the quality of the platform, and prepare internal or external presentations about the company, its performance, and the functioning of the platform

The providers listed above reflect the external systems currently used by Earlyup. This list may change over time. We may replace these providers with equivalent or higher-standard providers offering the same or better levels of security and GDPR compliance. Where a change introduces a new category of processing or has a material impact on your personal data, we will update Annex 1 to this Privacy Policy and inform you where required.

All third parties processing personal data on our behalf are bound by written agreements to keep your data secure, to process it only for the specified purposes, and to act in accordance with applicable data protection laws.

Controller vs processors

For clarity, Earlyup acts as the controller for the personal data it processes in operating the platform. This means that Earlyup determines the purposes and means of processing. Third parties engaged by Earlyup, such as hosting, payment, or communication providers, generally act as processors, processing personal data only on our instructions. In some cases, such as when advertising partners use their own tracking technologies, these third parties may act as independent controllers for the data they collect. Where this is the case, we ensure responsibilities are allocated in accordance with applicable law and we provide you with clear information on how to exercise your rights.

An exception applies to in-app purchases made through the Apple App Store or Google Play. In these cases, Apple and Google act as independent controllers for the data they process in connection with the transaction. EarlyUp is not responsible for the data processing activities of these platforms.

Roles and responsibilities of Earlyup and professionals

Earlyup acts as an independent controller for the personal data it processes in operating the platform. In principle, and in accordance with the Earlyup General Terms and Conditions, all assignments facilitated via the platform must be performed and completed through the platform. If a service is carried out entirely outside the platform, whether or not the introduction between the professional and the customer occurred via the platform, or whether services were previously provided through the platform, Earlyup will not be considered a data controller for any personal data processed in connection with that service, and the professional will bear full responsibility for compliance with applicable data protection law. In limited cases where the platform integrates third-party technologies that collect data upon loading, Earlyup and the relevant third party may act as joint controllers for the initial collection of data, with responsibilities allocated in accordance with applicable law.

8.Rights of Data Subjects

You have several important rights under the GDPR and the Dutch UAVG, as described hereunder

  1. Right to be informed
    You have the right to know what personal data we collect, why we process it, who receives it, how long we retain it, and how we protect it. This Privacy Policy is intended to provide that information clearly and transparently.
  2. Right of access
    You may request a copy of the personal data we process about you, including details on our processing activities and the recipients of your data. You can make such a request free of charge at any time.
  3. Right to rectification
    If any personal data we hold about you is inaccurate or incomplete, you may ask us to correct or update it promptly.
  4. Right to erasure (“right to be forgotten”)
    You may request deletion of your personal data under certain conditions, such as when it is no longer necessary for the purposes for which it was collected or when you withdraw your consent. We will also instruct our partners to delete your information where possible.
  5. Right to restriction of processing
    In some cases, you may ask us to limit how we process your data, for example while we verify its accuracy or if you have objected to certain uses
  6. Right to data portability
    Where possible, you can request to receive your personal data in a structured format, and have it transferred directly to another controller if technically feasible.
  7. Right to object/opt-out
    You may object/opt-out to our processing of your personal data when it is based on our legitimate interests. You may opt out of receiving marketing communications from us at any time by using the unsubscribe link in our emails or by contacting us at privacy@earlyup.ai.
  8. Rights related to automated decision-making and profiling
    If our system uses automated decision-making or profiling, such as AI-assisted matching or ranking, and advisory guidance, you have the right to obtain human intervention or request an explanation of the logic involved.

When you exercise any of these rights, we will respond within one month. If your request is complex, we may extend this period by up to two additional months, provided we notify you without delay.

To make a request or ask any questions about your rights, you can contact our Data Protection Officer (DPO) at privacy@earlyup.ai. If you are not satisfied with our response or believe your rights have been violated, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To protect your personal data, we may ask you to provide information that allows us to verify your identity before we act on your request. We will use any such information only for verification and will delete it shortly after the request is resolved.

9.Retention periods

In line with the GDPR and Dutch UAVG, we retain your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy. Once the data is no longer needed, we either delete it securely or anonymise it, unless longer retention is required by law.

  1. Factors Considered When Setting Retention Periods
    • Legal obligations, such as tax, accounting, or billing laws requiring us to retain financial and transaction data for several years.
    • Operational needs, including managing bookings, contracts, service delivery, and dispute resolution.
    • Data minimisation and accuracy, ensuring that we do not keep outdated or excessive personal information.
    • Risk management, mitigating the potential impact of retaining data for extended periods.
  2. Examples of Retention Timelines (Provisional)
    Data categoryRetention periodJustification
    Pre-App profile and participation data Up to 1 year after termination of participation To perform internal analysis, optimise onboarding processes, evaluate patterns, and prepare for the transition to the full platform
    Financial and billing records (including invoices and assignment agreements) (Applicable only if payment links are enabled) Up to 7 years To comply with accounting, tax, and other legal obligations
    Contractual and booking data (including signed agreements and service history) (Not Applicable for Pre-App) As long as required for legal or operational purposes, deleted no later than three years after service completion To manage and evidence contractual relationships, handle disputes, and meet operational needs
    Communication and messaging data (chat/content of assignments) (Not Applicable for Pre-App) Up to 1 year, unless needed for dispute resolution To coordinate services, provide support, and resolve disputes
    Profile and account data (including credentials and qualifications) (Not Applicable for Pre-App) While the account remains active, and up to 5 years after deactivation (subject to your rights) To maintain service history, enable account reactivation, and ensure compliance with applicable laws
    KYC and identity verification documents (including copies of passports, national ID documents, proof of address, business documentation and verification status records) Up to 5 years after termination of the professional relationship, or longer where required by applicable AML, KYC or financial regulations To comply with KYC, AML and financial regulatory obligations. Earlyup collects and retains these documents directly as part of the Custom Stripe Connect integration. Retention beyond 5 years may apply where required by law. In accordance with the principle of data minimisation, biometric data contained in identity documents is retained only for as long as strictly necessary to fulfil the applicable legal obligations and is deleted or anonymised as soon as the retention period has lapsed.
    Marketing and analytics data No longer than necessary for performance evaluation, anonymisation, or removal To measure and improve marketing effectiveness, and respect data minimisation principles
  3. Retention Policy Documentation and Review
    We maintain an internal retention schedule that specifies retention periods for each data category, with clear justification. This schedule is reviewed periodically and updated whenever legal requirements or platform needs change.
  4. Automated Deletion and Anonymisation
    Wherever feasible, we use automated systems to flag and purge data at the end of its retention period. If immediate deletion is not possible, data is anonymised so that it can no longer be linked to you.
  5. Your Rights Remain Unaffected
    Regardless of the retention timelines above, you retain all rights as described in the Rights of data subjects section. If you request erasure or data portability, we will take action at any time, unless otherwise legally required to retain it.
  6. Contact for Retention Queries
    If you have questions regarding our data retention practices, want a copy of our retention schedule, or wish to request earlier deletion of your data, please contact our Data Protection Officer at privacy@earlyup.ai.

10.Automated decision-making and profiling (Not Applicable for Pre-App)

  1. Use of automated decision-making and profiling
    Earlyup uses automated decision-making and profiling technologies, including artificial intelligence (AI), to enhance the efficiency, accuracy, and personalisation of the services provided through our platform. This includes generating advice for users on the type of professional they may require for a specific task, as well as offering guidance on how certain issues may be resolved independently before engaging a professional. Use of these AI tools does not require you to provide personal data; if you voluntarily choose to do so, you remain responsible for the information you provide.
  2. How the process works
    When a user describes a need or issue through the platform, our AI systems analyse the information provided (such as: text descriptions, uploaded images, location data, availability, and service categories) and compare it to historical data, service offerings, and performance indicators of professionals. This process allows the platform to:
    1. Suggest a category of professional suitable for the described task.
    2. Recommend one or more professionals whose services, skills, and availability best match the request.
    3. Provide preliminary general guidance to the user on potential steps to address the issue themselves before booking a professional.
  3. Data used and generated
    The AI process may use personal data you provide directly (such as: service request details, profile data, availability), data generated through your activity on the platform (booking history, ratings, dispute records), and relevant contextual data (like location and required tools). The system may also generate outputs such as advice given to users, matching results, and ranking positions. These AI-generated outputs may be stored to improve matching accuracy, support dispute resolution and monitor system performance. Where possible, such data is anonymised when no longer linked to an active account.
  4. Logic and criteria used
    Matching and ranking rely on factors including service request details, profile information, skills, qualifications, location, ratings, availability, historical booking outcomes, completion rates, and tool/equipment availability. We regularly review and test these criteria to ensure accuracy.
  5. Purpose limitation
    AI-generated data is used solely for platform-related purposes, such as facilitating matches, improving algorithms, auditing outcomes, and ensuring quality. It is not used for unrelated purposes (like for external marketing) without a separate legal basis.
  6. Significance and consequences
    Automated decision-making and profiling may affect a professional’s visibility in search results, the likelihood of being matched or recommended for a job, and the guidance presented to users. These processes may influence booking opportunities and platform exposure.
  7. Human oversight
    Automated decisions are not made in isolation. Human review and intervention are available upon request in cases where the outcome of an automated process significantly affects your ability to receive work through the platform or impacts your rights.
  8. Your rights in relation to automated decision-making
    Under the GDPR and UAVG, you have the right to request human intervention in decisions that are based solely on automated processing and have legal or similarly significant effects on you, to express your point of view and contest the outcome of such decisions, and to obtain an explanation of the logic involved in the automated process. You can exercise this right as described in the section on Rights of data subjects.
  9. Data Protection Impact Assessment
    Earlyup has conducted a Data Protection Impact Assessment (DPIA) for the AI-based matching and guidance functionalities described in this Privacy Policy, in order to assess potential risks and implement appropriate safeguards in line with the GDPR and UAVG.

11.Cookies and Tracking Technologies

  1. Use of cookies and tracking technologies
    At present, the Earlyup application (the Pre-App and App) itself does not use cookies or tracking technologies for its core functionalities, such as login, availability management, chat, or profile display. These functions operate without tracking mechanisms inside the app. Cookies, tracking pixels, web beacons, and similar technologies may however be applied in connection with external services and third-party providers (see Article 7). These may include marketing campaigns, newsletters, analytics, and advertising activities that take place outside the core application. Such technologies allow us to understand how our services are used, measure the effectiveness of our communications, personalise the user experience, and deliver relevant advertising through third parties.
  2. Types of cookies we use
    We use four main categories of cookies: strictly necessary cookies that allow fundamental platform features to work correctly, functional or preference cookies that remember your choices and settings, analytics or statistics cookies that help us understand how professionals and users engage with the platform, and marketing or advertising cookies that enable us to serve targeted messages or promotional content based on your interactions.
  3. Consent and legal basis
    Under the GDPR and the ePrivacy Directive, functional and analytical cookies require your informed and unambiguous consent before they are placed, whereas strictly necessary cookies do not. We provide granular cookie settings that let you choose which categories you agree to, and you can withdraw your consent or modify your preferences at any time, for example via the cookie banner or settings menu.

    When we seek your consent for non-essential cookies, we present separate choices for each cookie category. You can accept all categories, select only some categories or refuse all non-essential cookies. Consent is obtained through an affirmative action and is never assumed or obtained through preselected options. You can withdraw consent at any time through the cookie settings.
  4. Scope of privacy protections
    Cookies and similar tracking technologies can collect data such as IP addresses, browser type, device information, browsing history on the platform and interactions with ads or content. This information can be considered personal data under GDPR when it can directly or indirectly identify individuals, including through combination with other data points. Transparency about this processing is essential.
  5. Third-party tracking and sharing
    Some cookies are placed by third parties such as advertising networks, analytics platforms, or social media services used by Earlyup (for example Meta, Google Analytics, TikTok or LinkedIn). These third parties may collect data for their own purposes. We require that any third party we work with meets GDPR standards and have contractual safeguards in place. Some third-party cookies may transfer your personal data outside the European Economic Area, such as in the United States. Where such transfers occur, we ensure they are protected by appropriate safeguards such as standard contractual clauses or an applicable adequacy decision. You may request more information by contacting us.
  6. Management of consent
    Consent is obtained through clear and accessible cookie banners at first access. You have the option to accept all non-essential cookies, to accept only selected categories, or to decline non-essential tracking altogether. Your choice is recorded securely and persistently. If legal requirements change or new categories of tracking are introduced, we will ask for renewed consent.
  7. Retention of cookie data
    We retain cookie data only for as long as it is necessary for the purpose for which it was placed. Once the data is no longer required for that purpose, it will be deleted or anonymised. Retention periods vary depending on the type of cookie and the reason for its use. Strictly necessary cookies are kept only for operational purposes, while functional, analytics, and marketing cookies are retained only for the time needed to fulfil their function or until you withdraw your consent. We regularly review our retention schedules and update them where necessary to remain compliant with applicable laws.
  8. Your rights regarding cookies
    You have the right to withdraw cookie consent at any time, to access how cookie data about you is processed, and to exercise all rights described in the Rights of data subjects section of this Privacy Policy. If you wish to disable all tracking outside of strictly necessary cookies, you may adjust settings through the cookie consent interface or your browser preferences.
  9. Compliance and updates
    We regularly audit our use of cookies and tracking technologies to ensure compliance with GDPR, the ePrivacy Directive, and guidance from regulators such as the Autoriteit Persoonsgegevens. Should regulations evolve or our tracking technologies change, we will update this section accordingly and inform users where necessary.

12.Data Security

  1. Commitment to security
    Earlyup is committed to protecting the personal data of professionals and users by implementing appropriate technical and organisational measures that ensure a level of security appropriate to the risk, in accordance with the GDPR and the UAVG. These measures are designed to maintain the confidentiality, integrity and availability of personal data at all times.
  2. Technical security measures
    We protect personal data using encryption in transit and, where appropriate, encryption at rest. The specific encryption standards used will be confirmed based on the technical configuration of our systems. Network security is reinforced through measures such as firewalls and intrusion detection or prevention systems. The precise technologies in place will be determined in line with the platform’s operational requirements and industry standards. Moreover, in test environments, we only use fictitious or de-synchronised data, never real user data. Identity documents and other sensitive personal data collected as part of the KYC onboarding process are subject to enhanced security measures, including strict access controls limiting access to authorised personnel only, and are stored in encrypted form separate from other personal data.
  3. Organisational security measures
    Access to personal data is limited to authorised personnel who require such access for the performance of their duties. Access controls are applied in accordance with the principle of least privilege, and may include role-based access and multi-factor authentication. All personnel with access to personal data receive training on data protection and security best practices. The exact configuration of these access controls will be confirmed internally.
  4. Backups and recovery
    We maintain secure backups of personal data to ensure business continuity and rapid restoration of availability in the event of a technical incident. Backups are encrypted and stored in secure environments. The retention period and storage locations for backups will be confirmed based on operational needs. These backups are encrypted and stored on servers located in Germany.
  5. Incident detection and response
    We have procedures in place to identify, investigate and respond to potential data breaches. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Dutch Data Protection Authority within 72 hours, and where required, also inform the affected individuals without undue delay.
  6. Third-party security requirements
    All third-party service providers who process personal data on behalf of Earlyup are contractually obliged to implement security measures that meet GDPR standards. This includes providers of communication, analytics, hosting and advertising services. We review the security measures of these providers on a regular basis, the frequency and scope of which will be determined in accordance with our internal compliance programme. Details of the specific providers engaged by Earlyup are listed in Annex I, as referenced in Article 7.
  7. Testing and risk management
    We may perform periodic vulnerability assessments or penetration testing to evaluate the resilience of our systems. The frequency, scope and methodology of such testing will be decided based on our risk assessment processes.
  8. Anonymisation and pseudonymisation
    We apply anonymisation or pseudonymisation to reduce the risks associated with processing personal data. The specific techniques used will depend on the nature of the data and the purposes for which it is processed.
  9. Data protection by design and by default
    We design and operate our systems in line with the principle of data protection by design and by default. This means that we implement measures to ensure that, by default, only the personal data necessary for each specific purpose are processed and that retention, access and disclosure are limited accordingly.

13.Third-Party Links

  1. Scope of third-party links and integrations
    The Earlyup platform may contain links to websites, applications, or services operated by third parties. It may also integrate with third-party tools and services, such as payment processors, marketing platforms, and social media services, to enable or enhance certain functionalities.
  2. No control over third-party processing
    These third parties operate independently from Earlyup and have their own privacy policies and terms of service. We have no control over, and are not responsible for, the content, security, or data processing practices of these third parties.
  3. Data sharing in integrations
    If you choose to use third-party integrations or access services through the platform, certain personal data may be shared with the relevant third party as necessary to perform the requested functionality. This may include, for example, sharing payment details with a payment provider or booking-related information with a tool that facilitates your service delivery.
  4. Your responsibility
    We encourage you to review the privacy policies of any third-party services you interact with through the platform to understand how they process your data. Your use of such services is at your own discretion and subject to the terms and privacy practices of the respective third party.

14.Changes to This Privacy Policy

  1. Right to update and amend
    Earlyup may update or amend this Privacy Policy from time to time to reflect changes in our data processing activities, legal requirements, or operational needs.
  2. Notification of changes
    If we make material changes that significantly affect your rights or the way we process your personal data, we will inform you in advance by sending a notice via email or by posting a prominent notification on the platform before the changes take effect.
  3. Review of updates
    We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal data. Your continued use of the platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
  4. Applicable Law
    This Privacy Policy is governed by Dutch law. Where mandatory local laws of the country in which you are based provide you with stronger privacy protections or obligations, those mandatory protections will apply in addition to and, where they conflict, will prevail over the terms of this Privacy Policy.
  5. Effective date
    This Privacy Policy is effective as of the 21st of May of 2026 and replaces any previous version applicable to professionals using the platform.

Annex I – List of Third-Party Providers

This annex provides an overview of the third-party providers currently used by Earlyup to process personal data in connection with the services described in Article 7.

This list will be updated whenever Earlyup changes or replaces third-party providers. Any replacement will always meet equivalent or higher standards of security and GDPR compliance. In addition, as Earlyup continues to develop its own technology, certain functionalities currently provided by third parties may in the future be handled directly by Earlyup itself. Where a change introduces a new category of processing or has a material impact on your personal data, we will update this Privacy Policy and inform you where required.

CategoryProvider(s)Purpose / Role
Advertising & Marketing Meta (Facebook, Instagram), Google Ads, TikTok Ads, Apple App Store Ads, LinkedIn Ads Targeted campaigns, analytics, audience building
Email Marketing & Campaigns Mailchimp, Intuit Distribute newsletters, promotions, manage mailing lists
Payments & Financial Services Stripe Payment processing, identity verification (KYC) on behalf of Earlyup via Custom Connect integration, payout facilitation, and provision of payment receipts/transaction records
Subscription Management RevenueCat In-app subscription management, receipt validation, fraud prevention, entitlement tracking and subscription analytics
Communication Twilio Email communication, SMS confirmation
Hosting, Authentication & Security Supabase, Railway Authentication, hosting, data security (anti-hacks)
Analytics & Monitoring Posthog, Sentry Usage analytics, click tracking, error monitoring
AI & Automation OpenAI, Amazon Web Services (future) AI-based suggestions, advisory guidance
Customer Service & Internal Tools Retool, Bill and PR Admin panel (support), internal software tools

Annex II — Geographic Availability

Earlyup's calendar and AI scheduling functionalities are available in several countries worldwide. An up-to-date overview of the countries in which Earlyup is can be applied for at privacy@earlyup.ai. In-app subscription purchases in all listed countries are processed exclusively through Apple (App Store) or Google (Google Play), who act as independent controllers for payment processing and carry their own compliance responsibilities.

Earlyup monitors applicable laws, sanctions, and regulatory requirements across all jurisdictions and reserves the right to restrict or discontinue availability in any country at any time and without prior notice, where required by law or regulation.

The payment link feature (Stripe) is currently available exclusively to professionals registered in the Netherlands.

Version 2.2026.05.21

Ergon AI B.V.
Pieter Breughelstraat 50,
4625 BH Bergen op Zoom, Netherlands
pro.ergonai.ai