Privacy Policy

This policy explains what data we collect, why, and what rights you have over it.

Last updated: 6 February 2026

Who we are

Ashby is an AI governance consultancy registered in the Netherlands.

  • KVK: 99686430
  • BTW: NL003485803B71
  • Contact:

What data we collect

We currently collect only your email address when you sign up for the Requisite early access waitlist. We don't collect names, IP addresses, or any other personal data through the waitlist form.

We do not use analytics, tracking pixels, or advertising cookies on this site.

Why we collect it

We use your email address solely to notify you when Requisite is available and to send occasional updates about the product. We won't share your email with third parties or use it for any other purpose.

Legal basis

We process your email address based on your consent (Article 6(1)(a) GDPR), given when you submit the waitlist form. Our email service uses double opt-in, so you'll need to confirm your subscription before we store your address.

How we process your data

Waitlist signups are processed by EmailOctopus, our email service provider. EmailOctopus is operated by Three Hears Digital Ltd, based in the United Kingdom. The UK is covered by an EU adequacy decision, meaning your data receives equivalent protection to EU data protection standards.

This website is hosted on Vercel. Vercel may process server logs (including IP addresses) as part of normal hosting operations. We do not access or store these logs.

Cookies and local storage

This site does not set cookies. We use your browser's local storage to remember your light/dark mode preference. This data stays on your device and is never sent to us.

Data retention

We keep your email address for as long as you remain subscribed to the waitlist. You can unsubscribe at any time using the link in any email we send, and your address will be deleted from our mailing list.

Your rights

Under the GDPR, you have the right to:

  • Access — request a copy of the data we hold about you
  • Rectification — correct any inaccurate data
  • Erasure — ask us to delete your data
  • Portability — receive your data in a machine-readable format
  • Withdraw consent — unsubscribe at any time
  • Complaint — lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

To exercise any of these rights, email . We'll respond within 30 days.

Changes to this policy

We'll update this page if anything changes. When Requisite launches with user accounts and payment processing, this policy will be expanded to cover that additional data processing.