Privacy statement

This privacy statement describes what data we process about you, for what purpose and on what legal basis.

It covers irisijzerman.nl, Your Unicorn Way (yourunicornway.nl and yourunicornway.com) and all connected web applications, forms and emails. It applies to the guidance and the work we take off your hands as well as to the digital products.

Who is responsible for your data:

1. What data we process

• Contact details: your name and email address, entered at sign-up, purchase, quiz or contact form.
• Quiz answers: what you fill in inside the Unicorn Quiz and the pattern that follows from it.
• Content answers: what you fill in inside the onboarding, reflection and week forms, the archetype workbook and the intake questionnaires.
• Booking details: name, email address, selected time and the questions you answer when scheduling a call.
• Collaboration data: what you share with us during a track, including documents, figures, planning and access to systems.
• Generated content: the strategy, audio and notes created for you on the basis of your answers.
• Voice recording: only when you take The Mirror Session and consciously record an audio.
• Payment details: processed by Plug & Pay and their payment partners. We never see or store credit card or bank details ourselves.
• Business contact details: company name, role, business email address and website of entrepreneurs we approach. See section 8.
• Technical data: standard logs (IP address, browser) for security and troubleshooting.

2. What we use your data for

• Carrying out the guidance and the work we take off your hands.
• Scheduling, preparing and following up on calls.
• Delivering your order: workbook, strategy, audio and dashboard access.
• Showing your quiz result and sending it to you by email.
• Granting access to your dashboard via a secure magic-link login.
• Sending service emails (login links, delivery emails, scheduling) and, if you opt in, our newsletter.
• Approaching entrepreneurs with a business offer.
• Complying with legal obligations, including tax retention requirements.

3. Legal basis

• Performance of the contract: your purchase, your track or your request for a call.
• Consent: the voice recording and the newsletter. You can withdraw that consent at any time.
• Legitimate interest: fraud and incident detection, security, and business outreach to entrepreneurs.
• Legal obligation: administration, invoicing and tax retention.

4. Who we share data with

We rely on the following parties to run our services.

• Vercel, for hosting our websites and applications.
• Supabase (EU region), for storing your account, answers and content.
• Anthropic, for generating your strategy. Your answers are processed for this purpose and, under our contract, not used for model training.
• ElevenLabs, for producing The Mirror Session.
• Resend, for transactional email such as your quiz result and delivery emails.
• Plug & Pay and their payment partners, for processing payments and invoicing.
• MailBlue (ActiveCampaign), for sending service and marketing emails, maintaining tags and measuring opens and clicks.
• Calendly, for scheduling intake and strategy calls.
• FormSubmit, for forwarding submissions of the onboarding, reflection and week forms by email.
• Google Fonts, for loading typefaces. Your IP address is passed to Google in the process.
• Team members and partners who work for us under confidentiality, with access limited to what their task requires.

These parties operate under a data processing agreement or an equivalent arrangement. We never sell your data to third parties.

5. Transfers outside the European Union

Some of these parties are established in the United States or the United Kingdom. For transfers outside the European Economic Area we apply appropriate safeguards, including the European Commission Standard Contractual Clauses or the EU-US Data Privacy Framework.

6. Cookies and statistics

Our websites and applications use functional cookies to keep you logged in and to remember your language choice. No consent is required for those.

When you open a scheduling module or an email from us, Calendly and MailBlue may set cookies or tracking pixels so that the booking and the email statistics work. We use no advertising cookies and no social network tracking pixels on our websites.

7. The Unicorn Quiz and the newsletter

If you complete the quiz and leave your email address, we use that address to send you your result and to sign you up for our newsletter with content updates and offers. We keep your answers so we can show and improve the result.

You can unsubscribe at any time through the link at the bottom of every email. Unsubscribing has no effect on products you already purchased or on an ongoing track.

8. Business contact details and outreach

We approach entrepreneurs with a business offer. The contact details we use for this come from public sources, including company websites, public profiles on professional networks and public registers. We collect business data only: company name, role, business email address and website.

The legal basis is our legitimate interest in finding new clients. You can object at any time through the unsubscribe link in the email or by writing to the address at the top of this page. We will then remove your details from our records.

We process no special categories of personal data in this context and we do not buy address lists.

9. Voice recordings

When you take The Mirror Session, you consciously record a short piece of text. This recording is used to create a temporary voice clone that produces only your personal audio. The source demo file is deleted immediately after successful production. The final audio stays in your dashboard until you delete it yourself.

10. When we work on your instruction

When we take work off your hands, for example inbox management, client contact, social media or building a funnel or website, we process data about your clients and contacts. In that situation you are the data controller and we are the processor.

We process that data solely on your instruction, record this in a data processing agreement, limit access to the people doing the work, and delete or return the data once the collaboration ends.

11. How long we keep data

• Account and content: for as long as your dashboard is active. You can request deletion at any time.
• Quiz answers: twenty-four months after your last interaction.
• Form submissions: for the duration of the track and twenty-four months after that.
• Booking details: twelve months after the call.
• Business contact details from outreach: twenty-four months after the last contact, or immediately upon a deletion request.
• Voice recording (source): deleted immediately after production.
• Invoices: seven years, due to tax retention requirements.
• Service emails and logs: twelve months by default, anonymised after that.

12. Security

Access to your dashboard goes through a passwordless magic link, valid for fifteen minutes. Data is stored and transmitted in encrypted form. Storage buckets with personal content are private and only accessible through your own session.

Access within our team is limited to those who need it for the work. Where a system supports it, we use two-factor authentication.

13. Data breaches

We keep an internal register of security incidents. If a breach poses a risk to your rights and freedoms, we report it to the supervisory authority within seventy-two hours. In case of a high risk we inform you directly.

14. Automated processing

We use automated systems to produce your quiz result, strategy and audio. No decisions are made that are based solely on automated processing and that produce legal effects for you or similarly significantly affect you.

15. Age

Our offer is aimed at entrepreneurs and is not intended for people under the age of sixteen. We do not knowingly collect data about children. If you believe this has happened, email us and we will delete the data.

16. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability and objection to processing. You can also withdraw consent at any time, without affecting the lawfulness of processing before that point.

Email info@irisijzerman.nl and we will pick it up as soon as possible, within one month at the latest.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl. Because our company is registered in Estonia, you can also turn to the Estonian supervisory authority, the Andmekaitse Inspektsioon.

17. Changes

If this statement changes materially, you will read about it here. For substantive changes you will receive an email.

Questions? Just email us. No form needed.