This page tracks material changes to Boei's legal documents. Editorial fixes, typos, broken links, and non-substantive rewording are generally not listed. For sub-processor changes, customers with a signed Data Processing Agreement also receive notice in accordance with that agreement.
If you are a Boei customer and need a prior version of any document for your records, contact us at [email protected].
August 17, 2026
Subprocessors and DPA Annex 1: added ProductLift (Ruby Foundry B.V., Falkenstein, Germany) as a sub-processor. ProductLift powers the product changelog widget embedded in the Boei admin area and the authenticated feedback portal at feedback.boei.help. ProductLift is operated by Ruby Foundry B.V., the same legal entity as Boei, and is listed for transparency. No new data flow; formal disclosure of an existing integration. Processing remains within the same legal entity and infrastructure sub-processors already disclosed in Annex 1.
August 13, 2026
Subprocessors and DPA Annex 1: corrected Mailgun processing location from "USA" to EU (api.eu.mailgun.net). Our Mailgun account has always been on the EU endpoint for all customers; the prior "USA" label described Mailgun Technologies, Inc.'s registered office (San Antonio, TX), which is unchanged. Documentation fix; no change to the actual data flow.
DPA Article 6.2: removed transactional email delivery by Mailgun from the list of processing that involves transfers to the United States, following the correction above. Remaining items re-lettered. Article 6.1 updated to reflect Mailgun EU as part of the EEA-based processing stack.
DPA Article 4.4, Article 5.2, Article 11 and Annex 3 clarified: deletion applies to active systems, while data in encrypted backups is removed on backup rotation within 60 days. Backups are append-only and cannot be selectively purged. No change to retention periods or to what is processed.
Privacy Statement: aligned server-log and IP-address retention to 60 days (previously stated as 90 days) to match DPA Annex 3, section 3. Documentation alignment only.
These are clarifications. No change to commercial terms, no change to what data is processed, where, or by whom, and no re-signature is required for customers with a countersigned DPA.
August 11, 2026
DPA Article 13 (Indemnification): rewritten to (i) apply to any competent supervisory authority rather than singling out the Dutch DPA, (ii) explicitly cover claims under Article 82 GDPR by data subjects and third parties, (iii) tie both directions of the indemnity to the liability cap in Article 12, and (iv) add standard notice, cooperation and defence-control procedures. Broader Controller protection where the Processor is at fault, symmetric Processor protection where the Controller is at fault, and a single hard cap on both sides.
August 10, 2026
DPA Article 9.5: replaced "the Controller will then inform the Dutch Data Protection Authority" with "the competent supervisory authority". Clarification for non-Dutch Controllers who must notify their own lead authority; no change to the Processor's underlying notification obligation.
Privacy Statement and Security page: aligned backup retention to 60 days (previously stated as 90 days in some places) to match the DPA. The DPA's 60-day figure was already the operational reality; this only removes a documentation discrepancy.
Subprocessors and DPA Annex 1: corrected Weaviate hosting location from "Amsterdam/Frankfurt" to Frankfurt, Germany (europe-west3). No change to the actual endpoint; documentation fix only.
August 5, 2026
DPA: added Article 9a (assistance with the Controller's obligations under Articles 32-36 GDPR) and Annex 3 (Technical and Organisational Measures). Only increases the Processor's obligations; no existing customer protection is reduced.
April 23, 2026
Cookie Statement: disclosed the GA4 and Google Ads conversion cookies that load on boei.help after consent (_ga, _ga_*, _gcl_au).
Cookie Statement: added suggested text customers can reuse on their own cookie statement and privacy policy.
Terms: added a Consumer carve-out so provisions incompatible with mandatory Dutch consumer law do not apply to Consumers.
EULA: added AI-specific disclaimer clauses covering output accuracy, Customer responsibility for agent actions, and no Article 22 GDPR decisions without human review.
Affiliate Terms: clarified lifetime commission as the default (with written-override option), rewrote the VAT clause to follow place-of-supply rules.
April 17, 2026
Published a standalone Subprocessors page as the authoritative list and as Annex 1 of the DPA.
Privacy Statement: added sections for AI-powered features, international data transfers, and a structured retention period list.
DPA: new Annex 1 mechanics (central subprocessors page with 30-day prior notice), Controller responsibility for cookie consent on its own site, and DPA liability prevails for data-protection claims. Self-service countersigned DPA at app.boei.help/dpa.
Cookie Statement: rewritten into three contexts (boei.help, app.boei.help, customer websites) with explicit cookie tables.
Terms: added 60-day notice for price changes, 30-day notice for material changes, SLA carve-out, and a clause that DPA liability provisions prevail for data-protection claims.
EULA: scoped indemnification to third-party claims, added a 30-day material-change notice.
Affiliate Terms: rewrote the liability cap (3 months of commission, indirect damages excluded, mandatory-law carve-outs).
April 6, 2026
Rebranded the operating entity across all legal documents to Ruby Foundry B.V. (trading as Boei). Same legal entity, new brand name.
March 13, 2026
Database and backup hosting moved to Hetzner Online GmbH (Nuremberg, Germany); Scaleway and DigitalOcean removed. All primary data now hosted in the EU/EEA.
March 3, 2026
Added Stripe, Inc. as a sub-processor for payments and subscription billing.
March 2, 2026
DPA updated to reflect EU-based AI model option (Mistral AI, France) alongside existing providers.
February 13, 2026
DPA sub-processor annex refresh.
About this changelog
We only list material changes - things that alter rights, obligations, data flows, liability, or the list of sub-processors. Editorial fixes (typos, broken links, renumbering, reworded sentences with the same meaning) are not listed. The "effective date" at the top of each legal document reflects the latest version; prior versions are available to customers on request.
from Utrecht 