Privacy Policy
This is a translation of the Dutch Privacybeleid. In the event of any difference or inconsistency, the Dutch version prevails.
Last updated: 2 November 2026
This policy explains which personal data we use when you visit our website, contact us or use Moments. It sets out what the data is used for, who may receive it, how long it is kept and how you can exercise your rights.
1. Who is responsible?
Moments is developed and offered by Learnable BV, trading as For The Dream, with company number / VAT number BE 0733.680.680 and registered office at H. Hartlaan 21, 3550 Heusden-Zolder, Belgium.
For privacy questions and requests, you can contact [email protected].
Our role depends on how the data is used:
- For our own website, enquiries, customer relationships, invoicing and communications, we are the controller: we determine for what purposes and in what way we use data.
- For data that an organisation manages in Moments, such as team member data, hours, projects, absences and mailing lists, we act on its behalf as a processor. That organisation is, in principle, the controller. The data processing agreement governs that relationship.
Do you use Moments through your employer, or do you receive a newsletter from a client organisation? That organisation also informs you about its own use of your data and is your first point of contact. Where necessary, we forward any request that reaches us to that organisation.
2. What data do we process and for what purposes?
Website visits
When you visit, we process technical data such as your IP address, the time of the visit, the requested and referring page, and information about your browser and device. Necessary data is used to display the website, secure connections, investigate errors and prevent abuse.
With your consent, we also measure website usage: which pages are visited, through which channels visitors find us and which parts work well. With separate marketing consent, visits and actions may be linked to advertisements and audiences. The cookie policy describes these choices and measurements.
Contact, enquiries and support
We process the data you provide, such as your name, email address, organisation, job title, telephone number and the content of messages and attachments. We use it to answer your question, prepare a proposal, follow up on arrangements or resolve a problem.
Is your enquiry intended for a client organisation, for example when submitting a job ad? In that case, your contact details, the enquiry, the planning and files are shared with the authorised persons of that organisation. Your email address is also used for a confirmation and the follow-up of the enquiry.
Moments AI product help
If you send a question through Moments AI, we send your question, the visible conversation history and a fixed page or module name to the Reflection API to generate an answer. No company data, screen content, account data or client files are added automatically. Do not share passwords, keys, client data or staff data in the conversation.
Moments does not store these conversations in the database or application logs. The visible history remains in the memory of your open page until you clear the conversation or reload the page. Reflection receives the text sent for the purpose of answering; this explanation makes no commitment about a retention period at that external service. To prevent abuse, Moments separately keeps an IP code derived using a secret key, request counters and expiry times for a maximum of approximately two days plus the five-minute clean-up interval. These counters contain no questions or answers.
Write with AI in the newsletter module
Admins of an organisation with the newsletter module can paste or upload a text themselves to have it turned into a newsletter draft. That text is sent via Vercel AI Gateway to a Google language model (Gemini). For every request, Moments asks that it is only processed by providers that do not retain the text or train on it. Moments does not store the text entered or the suggestion in the database or application logs; only what the admin adds to a draft and saves is kept as part of that draft. Nothing is sent automatically. To prevent abuse, Moments only keeps request counters and expiry times per organisation, for a maximum of approximately two days. Leave out personal data that does not belong in the newsletter.
Accounts, subscriptions and invoicing
For registration and access, we use, among other things, your name, email address, organisation, role, invitations, work addresses and sign-in data. Passwords are stored in a secured form that cannot be read directly. Sign-in data and access rights help to protect accounts and give the right people access.
For the customer relationship and administration, we process company and contact details, invoicing details, the company or VAT number, the agreed plan and payment status. We use these to manage the subscription, draw up invoices and fulfil our accounting obligations.
Hours, projects and collaboration
Depending on the features your organisation uses, we process:
- clock-in and clock-out times, work date, duration and the selected workplace category;
- clients, projects, tasks, assignments, rates and associated hours;
- notes, comments, files, notifications and progress;
- corrections, the reason for them, the person who made them and the time.
This data is used for time tracking, planning, collaboration, review, reporting and the administration or invoicing of your organisation. A workplace category such as office, home or client site is a choice made by the user and not a GPS record.
Leave and absences
For leave administration, we process the type of leave, period, request, decision and, where applicable, an attachment. In the case of sickness, this may include health data, including a certificate intended for the employer. The free-text explanation is not stored for a sickness request.
We process this data on behalf of the employer in order to handle requests and staff administration. The employer determines the legal basis, the applicable exception for health data and who may consult the data. Do not add a diagnosis or other medical information that is not needed for that administration.
Newsletters from client organisations
When an organisation manages newsletters through Moments, we process the data it enters or imports: email address, name, company, additional contact attributes, segments and available information about origin, consent and unsubscribes.
On its behalf, we manage recipients, send messages, process unsubscribes and monitor delivery. In doing so, send times, delivery status, error messages and any complaints are recorded. If the sender enables open or click tracking, the opening of a message and clicks on a link may also be recorded. The sender must inform you about this and ensure the required consent. Consent to receive a newsletter is not automatically consent to such tracking; your website cookie choice does not replace that consent either.
The organisation that emails you remains responsible for its mailing list and messages. An unsubscribe applies to the sender concerned. A minimal unsubscribe record may be kept separately in order to respect your choice.
Integrations and administrative exchange
When you or your organisation activate an integration, data is exchanged with the chosen external service for the task carried out through that integration. The permissions granted determine which data can be consulted or changed. For this purpose, we also process data about the consent, access rights and secured access credentials of the integration.
When hours are submitted for administrative processing, the team member, period, client, project, task, hours and associated explanation may be forwarded to the designated administrative service. An admin can also export data about team members, time worked and absences and deliver it themselves to the competent payroll administration.
Check what access you grant. Where the receiving service carries out its own processing, its own terms and privacy information also apply.
Security and reliability
Data about access, changes and errors helps us to secure the service, investigate incidents and restore operation. This may involve processing times, user attributes and technical connection data. Access to this information is limited to what is necessary for administration, support and security.
3. Where does the data come from?
We receive data from you, your employer or another client organisation, persons acting on behalf of that organisation, and integrations that you or your organisation activate. Technical data is also collected while the website or service is being used.
An organisation that enters, imports or passes on your data must inform you of its source, purpose and use.
4. On which legal bases do we rely?
For processing for which we ourselves are responsible, the following legal bases apply:
| Use | Legal basis |
|---|---|
| Handling your enquiry, making a proposal or performing a contract with you | Steps necessary at your request prior to entering into a contract, or the performance of that contract, where you yourself are a party to it |
| Contact with representatives of a client organisation, support and contract administration | Our legitimate interest in maintaining business contacts, performing arrangements with that organisation and supporting clients |
| Invoicing and mandatory accounting | The performance of the contract where applicable, and our statutory administration and retention obligations |
| Security, error investigation and abuse prevention | Our legitimate interest in protecting accounts, data and the availability of the service |
| Non-essential visit measurement and advertising tracking | Your prior consent for the purpose concerned |
| Our own electronic newsletters and commercial messages | Your consent. For messages about our own similar services to existing clients: our legitimate interest in informing them about those services, insofar as the statutory conditions for sending without prior consent are met. Unsubscribing always remains possible free of charge. |
| Establishing, exercising or defending a legal claim | Our legitimate interest in protecting our rights, or an applicable legal obligation |
Where we rely on legitimate interest, we weigh the necessity and purpose against the impact on your privacy. You may object to such processing. You can always object to our own direct marketing; that use will then stop.
For data that we process on behalf of an organisation, that organisation determines the legal basis. Its contract with us does not in itself justify all processing of team members' or newsletter recipients' data. For health data, an applicable exception to the prohibition on processing such data is also required.
Some data is needed to handle an enquiry, create an account or perform a contract. Without that data, we cannot carry out that action. Refusing optional measurement or marketing has no effect on access to the regular service.
5. Who may receive data?
For the purposes described, data may be received by:
- authorised users of your organisation, according to their role and the feature used;
- service providers for the availability and security of the service, data storage, message delivery and technical support;
- Reflection, when you yourself send a question to Moments AI, for the purpose of answering as described above;
- Vercel (AI Gateway) and Google, when an admin uses Write with AI themselves, to create a newsletter draft;
- external services with which you or your organisation activate an integration or data transfer;
- parties for invoicing, accounting, payroll administration and professional advice, insofar as that processing applies;
- measurement and advertising partners, for optional processing to which you consent; the cookie policy lists the recipients and purposes concerned;
- competent authorities where the law requires it, or other entitled parties where this is necessary for a legal claim.
Parties that process data on our behalf must act in accordance with arrangements on purpose, confidentiality and security. Some recipients are themselves responsible for their own processing. The data processing agreement governs the arrangements with client organisations on engaging other processors.
For the Moments platform, we use Supabase for the database, authentication and storage, Vercel for hosting and Resend for email. The current list of their functions, processing locations and supplier agreements can be found in article 7.2 of the data processing agreement.
Data that we manage on behalf of your organisation is processed for the services provided to it. We do not use its team member data or mailing lists as our own commercial contact list.
6. Processing outside the European Economic Area
External services and integrations chosen by you may involve processing outside the European Economic Area. That area comprises the EU, Norway, Iceland and Liechtenstein. This policy does not constitute a commitment that all processing takes place exclusively within it.
A transfer outside that area requires a valid legal basis for the transfer, such as an adequacy decision of the European Commission or appropriate contractual safeguards, with supplementary measures where necessary. For information about the locations and safeguards that apply to your data, or a copy of the applicable safeguards, you can contact us. For a transfer that your organisation itself has carried out to a chosen service, its information about that service is also relevant.
7. How long do we keep data?
For as long as your organisation remains a subscriber, we keep its data for the provision of the service. Upon deletion, the data concerned is removed from the active environment; any backups then remain in existence for a maximum of 24 hours. This backup period runs from the deletion, not from an ordinary cancellation or the expiry of a free trial.
For the termination, return or deletion of organisation data, the authorised admin contacts us. We act in accordance with the instructions of the organisation and the data processing agreement. An expired free trial or blocked account does not in itself lead to deletion.
For data for which we ourselves are responsible, the following periods or criteria apply:
| Data | Period or criterion |
|---|---|
| Enquiries, quotations and support | The handling and associated follow-up of the question. In a customer relationship, what is necessary to perform arrangements or to handle a pending complaint or dispute is also taken into account. |
| Account and contract administration | The duration of the customer relationship and its settlement; thereafter only insofar as a legal obligation or a specific legal claim justifies retention. |
| VAT invoices and related documents | Ten years from 1 January of the year following the issue of the document, unless a longer statutory period applies. |
| Technical and security data | According to the need to investigate and handle errors and incidents, to establish abuse and to account for relevant security measures. An incident or dispute may require longer retention of the data concerned. |
| Our own mailing list | Until you unsubscribe or the legal basis ceases to apply. The minimal record needed to respect your objection or unsubscribe may be kept separately. |
| Cookie preferences | A maximum of 180 days after your choice, unless you change or delete it earlier. Other cookies and measurement techniques are listed in the cookie policy. |
The deletion of organisation data is without prejudice to a statutory retention obligation, for example for our invoices. Data that we must keep separately because of such an obligation or a specific legal claim remains limited to that purpose. A limit on what an overview displays is not a retention period and does not restrict your statutory privacy rights.
8. How do we protect data?
We take measures against unauthorised access, loss and unintended alteration. These include secured connections, protected accounts, role-based access rights, separation between organisations and logging of relevant changes. Access for support and administration is limited to the task concerned.
In the event of a personal data breach, we assess the consequences and comply with the applicable notification obligations. If data of a client organisation is involved, we inform that organisation without undue delay and in accordance with the data processing agreement.
9. What rights do you have?
Depending on the processing and the statutory conditions, you have the right of access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interest. For direct marketing, you do not need to give reasons for your objection.
Where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of the use before the withdrawal. You can change your cookie preferences via Cookie settings at the bottom of the website. For our own commercial emails, use the unsubscribe link or contact us.
Send a request to [email protected]. For data managed by your employer or another client organisation, preferably address your request to that organisation. We support it in handling the request.
We respond, in principle, within one month. For a complex request or a large number of requests, that period may be extended by a maximum of two months in accordance with the GDPR. In that case, you will receive an explanation within the first month. If there is reasonable doubt about your identity, we only ask for the additional information needed to confirm it.
You may lodge a complaint directly with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, via [email protected], or with another competent supervisory authority. You do not need to contact us first.
10. Automated decisions and changes
For our own processing described here, we do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Where your organisation has an additional processing operation or automation set up, it must inform you of the purpose, the consequences and the data used.
When our processing changes, we update this policy. The date at the top indicates when the text was last updated. Where new consent or additional information is required, we will provide it at the appropriate time.