Privacy
What happens to your data. Only what the code actually does.
No account, no profile
You do not have to register. There is no user database and no account.
What stays in your browser
What you type in the check sits in this tab’s session storage: postcode, house number, a floor area if you entered one, name, address, email, phone number, BSN, whether you are the owner, tenant or user, the municipality’s address, the assessment number, the date on the decision, the grounds and the comparison that was looked up. That storage disappears when you close the tab. The site sets no cookies and does not use local storage.
When your details are sent to the server
Your browser sends data to our server at three moments, only so the site can do its job. When you look an address up: the postcode, the house number and, if you entered it, the floor area in square metres. When you review the letter, and again if you change something there: the whole comparison (your address and the addresses and WOZ figures of the homes it was compared with), your name, address, postcode, town, email, phone number, BSN, whether you are the owner, tenant or user, the municipality’s address, the assessment number, the date on the decision, the grounds you picked with any note you typed, and the letter text. When you download, the same package is sent once more so the PDF can be built. The contact form does not do this: it opens your own email programme and sends nothing to this site. The anonymous count sent when a page opens, described below, contains no address and no name.
What the server keeps for a while
There is no database and no file is written with your letter. The PDF is built in memory and sent straight to you, with a request that your browser not keep it. The server process does keep the answers from the public registers in memory: six hours by default, at most two thousand answers, and gone when the process stops. That cache holds the addresses and WOZ figures that were looked up, tied to the query (postcode and house number, or a building id from the register). Your name, email, phone number, BSN and assessment number are not in it. The retention time and the maximum are configuration and can be changed by the operator.
Which other services the server asks
To build the comparison our server, not your browser, asks three public sources. The PDOK location server receives your postcode and house number, and if that postcode has too few homes also the street name and the town. The Kadaster WOZ register receives the building id of the homes that were found, not your name. PDOK BAG receives those building ids to look up the floor area. Your IP address is not sent to those services. The site runs on Google Cloud Run in europe-west4 (the Netherlands).
Counting use, anonymously
To see whether the site is actually used, the server counts anonymous events: a page view, a lookup, a comparison, a letter preview or a PDF, and the step reached in the check. A page view sends only the kind of page (such as /woz-bezwaar/:gemeente), the language and, on a municipality page, the municipality slug. Never a postcode, house number, name, email, BSN or a WOZ amount tied to an address. There is no cookie and no id stored in the browser. For a daily count of different visitors the server makes an anonymous code from the IP address, the browser string and the Europe/Amsterdam date. That code changes every day, cannot be linked across days, and cannot be turned back into an IP address. The full IP address and the full browser string are not kept. Only whether the device is mobile or desktop is. Bots and visits via a *.run.app address are not counted. People who share an IP address can look like one visitor, so the count is approximate.
What can appear in logs
The application does not write a postcode, street, house number, name, email, phone number or BSN in its own log lines, nor a WOZ amount tied to an address, a full IP address or a full browser string. It does write the anonymous counts from the previous section: the kind of page, the language, the municipality slug, whether a lookup found anything, the kind of comparison outcome and whether a letter preview or PDF was made. When a register fails, the log names the service, not the building id. The application’s access log does contain your IP address, and it removes the postcode and house number from the check-page address. Google Cloud Run keeps its own request logs as well. Those contain the requested address, the status code and your IP address. If you open or refresh a page such as /check/1234AB/12, that address contains the postcode and house number, and that platform log can keep it. This application does not put the contents of a submitted letter (name, BSN) in those logs. How long Google Cloud Logging keeps those lines is not set by this site.
Your rights
You can ask to see or delete data via sales@regproconsultancy.nl. There is no account to sign in to. What is in this tab, you clear by closing the tab. The temporary cache of public register answers disappears on its own. There is no button on this site for Google Cloud’s platform logs.