Who we are
Pecto B.V., Hellingweg 19, 1151 CS Broek in Waterland, the Netherlands, Chamber of Commerce 88204049. Questions about privacy go to info@pecto.nl.
This statement covers the website pecto.nl and the Pecto platform, the online workspace you sign in to. The same applies to the previous version of Pecto at app.pecto.nl, with the differences listed further down. The Dutch version is the binding one.
Our role
For your account, signing in and this website, we are the controller of your data.
Organisations such as water boards and engineering firms put their own data into Pecto workspaces: layers, drawings, data sources. The organisation is the controller of that content. We process it only on their behalf, as agreed with that organisation.
Which data and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, your password (only as a one-way hash), the two-factor key, your role | Your account and signing in | Performance of the contract |
| The link to your Google account, only when you sign in with Google | Signing in with Google | Performance of the contract |
| IP address and browser of a session, when you sign in | Security and detecting misuse | Legitimate interest |
| Email address of someone you invite | Sending the invitation | Performance of the contract |
| What you do in Pecto: workspaces, layers, drawings, saved versions and changes, who did what when | Working together, and undoing changes | Performance of the contract |
| App passwords for ArcGIS (only as a hash) and the AI assistants you gave access | Connections you switch on yourself | Performance of the contract |
| Notifications and messages from Pecto's administrators | Keeping you informed about your workspaces | Performance of the contract |
| What you email us | Answering your question | Legitimate interest |
We do not track which layers or pages you look at. We do not sell data or use it for advertising.
Cookies and storage in your browser
Pecto and pecto.nl only use functional cookies: to keep you signed in and to remember settings you choose yourself. There are no cookies for analytics, advertising or social media. That is why we do not ask for consent and you see no cookie banner.
| Cookie | Purpose | How long |
|---|---|---|
| better-auth.* (in the app) | Keeping you signed in and completing two-factor sign-in | Until you sign out; a session ends 7 days after you last used it |
| sidebar_state (in the app) | Whether the menu is open or closed | 7 days |
| layer_panel, panel_width_left, panel_width_right (in the app) | Where the panels beside the map are and how wide | 1 year |
Your browser also keeps settings in its own storage (localStorage and sessionStorage): which groups you folded, a panel's height, light or dark, and drafts in the design studio. That stays in your browser; Pecto does not receive it. You clear it by deleting the site's data in your browser.
Who we share data with
These parties process data for us, as processors:
- Vercel: hosting of the website and the platform. The platform's servers are in Frankfurt.
- Neon: the database, in Frankfurt.
- Resend: sending email, such as invitations, notifications and password resets.
- Google: only when you choose to sign in with Google.
When you use Pecto, your browser or Pecto's server also fetches maps and data from other parties. They see your IP address, not your name:
Maps, open data and other services
- Esri and Esri Nederland: the map technology, basemaps and elevation (AHN).
- Dutch government services: PDOK and the Kadaster, the BRO, Rijkswaterstaat and the Omgevingsloket. Questions to the Omgevingsloket go through Pecto's server and only contain the location.
- Google Maps: only when you open Street View or switch on a Google 3D layer. Google then processes data under its own privacy policy.
- YouTube, through youtube-nocookie.com: only when you play a video in a popup.
- Groq: when you ask the map, the Omgevingsregels or the Dijkmodel sketch a question. Groq receives the text you type and layer names, no data from the map. Pecto does not keep your question, so do not put personal data in it.
- DoJo: to decide which dike designs you may see, Pecto sends your email address to DoJo in a signed message.
- Your organisation's data sources, such as an ArcGIS portal or a database. Your browser or Pecto connects to them, sometimes with your organisation's sign-in.
- Your own AI assistant, such as Claude or ChatGPT, when you connect it to Pecto. What the assistant reads in Pecto goes to that assistant's provider, under your own agreement with them.
The previous version: app.pecto.nl
Pecto used to run at app.pecto.nl, and that version still works. On 25 September 2026 a copy of its accounts and workspaces was moved to the new platform; the data on app.pecto.nl is still there. Everything above applies to app.pecto.nl, with these differences:
- Hosting: the app, the database and the files you upload to a workspace are at DigitalOcean, in Amsterdam.
- Signing in: your sign-in is kept in your browser's storage (localStorage) until you sign out. Two-factor sign-in uses a code by email or an app.
- Cookies: the app itself sets no cookies for analytics or advertising. Only when you connect an ArcGIS account, or in the admin screen, the server sets the functional cookies sessionid and csrftoken. Your browser's storage also holds whether you saw the tour, the demo, and your ArcGIS sign-in for as long as the tab is open.
- Email, such as verification codes and invitations, goes through TransIP's mail server.
- The Roboto font comes from Google Fonts. Your browser fetches it from Google, which sees your IP address.
- A workspace can show YouTube videos in popups or embed a dashboard, such as Google Looker Studio. These load from YouTube or the dashboard's provider when you open them, and those parties may set their own cookies under their own policy.
- What it does not have: you cannot sign in with Google there, and the new platform's AI features are missing, so nothing goes to Groq.
Outside Europe
Vercel, Neon, Resend, Groq, Google, Esri and DigitalOcean are American companies. Where data leaves the European Economic Area because of them, that only happens with the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep data
- Your account: as long as you use it. If you ask us to delete it, we do so within a month.
- Sessions: until you sign out, or 7 days after you last used it.
- When you signed in: 12 months.
- Saved versions of a workspace: at most 180 days, and the newest 50.
- An invitation works for 14 days, a password reset link for 1 hour.
- What is in a workspace: as long as the organisation uses that workspace.
Security
All connections are encrypted. Passwords and app passwords are only kept as a hash. Sign-in can use two-factor authentication. Passwords of data sources are encrypted in the database and never reach your browser. You only see the workspaces and layers you have access to.
Your rights
You may see your data, have it corrected or deleted, ask us to process less of it, object, or receive it in a file you can take elsewhere. Email info@pecto.nl; we answer within a month.
If your question is about the content of your organisation's workspace, we pass it on to that organisation.
If you disagree with how we handle your data, you can file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
If Pecto starts handling data differently, we update this statement. The date at the top says when that last happened.