Privacy Statement

Last updated: November 11, 2026

This Privacy Statement explains what personal data The Accounted collects, why, and what rights you have over it. It applies to theaccounted.com, the Dashboard research platform, and the public D-Day KIA database (together, the "Service"). We're based in the Netherlands and process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Who we are

The Accounted is registered with the Dutch Chamber of Commerce (KvK) under number 68145535, at Chopinplein 232, 3122 VM Schiedam, the Netherlands. J. van Meesen is the controller of the personal data described in this Privacy Statement. For any question about this statement or your personal data, contact us at contact@theaccounted.com. Our business details are also on the About page.

2. What we collect

We collect the following categories of personal data:

Account information: the name and email address you provide when registering, and your password (stored securely, hashed — we never see or store it in plain text).
Acceptance record: the date you accepted our Terms and Conditions and which version, the date you confirmed you had read this Privacy Statement, and your confirmation that you are 18 years or older, kept as part of your account.
Payment data (when you choose a paid plan, which you can do now with the first payment on January 1, 2027 when the plans start, or buy a photograph): when you pay for a plan or a photograph, Stripe, our payment provider, receives your name, email address, billing address and country, your VAT number if you enter one, and your card or bank details. Your card and bank details go straight to Stripe; The Accounted never sees or stores them. We keep a record of each payment: the amount, the VAT, your country, whether you paid as a business, the plan or item, and the dates.
Your research content: anything you create or upload through the Service — research notes, soldier profiles, documents, photographs, and map overlays.
Collaboration data: if you invite another researcher to a project, or are invited to one, we process the email address involved to send and manage that invitation. If you were invited and don't have an account, we received your address from the person who invited you; we use it only for that invitation and delete it 30 days after the invitation email was last sent if you don't respond. You can remove it sooner with the “Remove my address” link in the invitation email, without an account.
Technical data: a session cookie that keeps you signed in, and some local browser storage used to cache data (like the public soldier database) for faster loading. To protect the website from automated abuse, Cloudflare may check your browser when you visit and set a cookie (cf_clearance) that remembers for a few hours that you passed the check. None of these are used for advertising or cross-site tracking. Optional storage (such as the copy of the KIA database kept for speed) is only used with your consent; which cookies we use, and how to change your choice, is explained in our Cookie Policy.

We do not use third-party analytics, advertising, or tracking scripts anywhere on the Service. We do not sell your personal data to anyone.

3. Why we process your data, and on what legal basis

Purpose	Data involved	Legal basis
Creating and managing your account, and providing the features of the Service you have asked to use	Account information, acceptance record, your research content, collaboration data	Performance of a contract (Art. 6(1)(b) GDPR)
Taking payment for a plan (first payment on January 1, 2027) or a photograph	Payment data	Performance of a contract (Art. 6(1)(b))
Keeping payment and VAT records	Payment records	Legal obligation under Dutch tax law (Art. 6(1)(c))
Keeping the Service secure and preventing abuse	Technical data (session cookie, Cloudflare check)	Legitimate interest in protecting the Service and its users (Art. 6(1)(f))
Account emails (e.g. confirmation, password reset) and notifications you switch on in Settings	Email address	Performance of a contract (Art. 6(1)(b))
Collaboration invitations	Email address of the invited researcher	Legitimate interest in letting researchers work together (Art. 6(1)(f)). If you are invited, we receive your email address from the researcher who invited you. If the invitation is not accepted within 30 days, we delete the email address.
The monthly “New in the Collections” email	Email address	Consent (Art. 6(1)(a)), given by ticking the optional box or switching it on in Settings; withdraw at any time. Sending also complies with Art. 11.7 Telecommunicatiewet (prior consent).
News and offers (new features, research tips, early-bird pricing)	Email address, record of when you opted in	Consent (Art. 6(1)(a)), by ticking the optional box or switching it on in Settings; withdraw at any time. Sending also complies with Art. 11.7 Telecommunicatiewet (prior consent).
Publishing a profile, map or timeline at a public URL	The content you choose to publish	Consent (Art. 6(1)(a)), by actively choosing to publish; unpublish at any time
Optional browser storage (e.g. cached copy of the KIA database)	Technical data	Consent; see the Cookie Policy

4. Where your data is stored

We store your data in the European Union:

Your account and research content: with Supabase, our database and authentication provider, in its West EU (Ireland) data center.
Documents, photographs and overlay images you upload: with Cloudflare, in Western Europe.
Our historical record databases and the record service that searches them: with Railway, in its EU West (Amsterdam) region.
Emails we send you: through Resend, from its Ireland region.
Payments: with Stripe, through Stripe Payments Europe, Limited in Ireland.

Cloudflare also delivers the website and your files through its worldwide network, so a request can be handled by the server nearest to you. Supabase, Cloudflare, Railway, Resend and Stripe are companies based outside the EEA (mostly in the United States). They act as our data processors under data processing agreements, and any access to personal data from outside the EEA is covered by the safeguards the GDPR requires: the European Commission's standard contractual clauses, or certification under the EU-U.S. Data Privacy Framework.

Stripe processes payments for us as our processor. For some purposes, such as preventing fraud and meeting its own legal duties as a payment provider, Stripe is responsible for your data itself; its own privacy policy then applies.

When the Service looks up a soldier in the U.S. National Archives' catalog, only the service number being searched is sent to the National Archives, never anything about you.

Map images come from Esri (ArcGIS) through our own server (satellite.theaccounted.com): your browser never contacts Esri, so Esri does not receive your IP address. Esri, a U.S. company, acts as our processor for these requests under a data processing agreement with the standard contractual clauses. The mapping library and the fonts are served from our own website, not from public content delivery networks. When you search for a place in the Dashboard, our server asks OpenStreetMap's Nominatim service for you: Nominatim receives only what you typed, not your IP address or anything else about you.

5. Historical research data and the people in the records

Separately from your own account data, the Service contains historical records about U.S. servicemen and servicewomen of the Second World War: Army enlistment records, Morning Reports and other unit records, prisoner-of-war records, hospital admission cards and photographs, taken from the holdings of the U.S. National Archives (NARA), where they are public archival records. This section is our notice to the people in those records and their families.

Why we use these records. For historical and genealogical research: to help families, historians and researchers find a veteran's records and reconstruct his or her service.
Our legal basis. Data protection law protects living people, not people who have died. Almost everyone in these records has died, but we can't tell which few are still alive, so we treat every record with care. For living people we rely on our legitimate interest in historical research (Article 6(1)(f) GDPR), with the safeguards for research in Article 89 GDPR. Some records contain information about health (hospital admission cards) or a racial classification used by the U.S. Army in the 1940s; for living people we process this only for historical research and archiving in the public interest, under Article 9(2)(j) GDPR and Article 24 of the Dutch GDPR Implementation Act (UAVG), with the safeguards below.
Safeguards. Records are shown only to signed-in users; the website search shows matches, not the records themselves. Race and diagnosis are never search filters. Searches are limited, and bulk downloading is not allowed. We decide nothing about anyone on the basis of these records.
Public pages. A researcher can publish a soldier's profile. Race and health details from the records (enlistment, prisoner-of-war and hospital admission records, and personnel files) appear on a public page only once the researcher has confirmed that the soldier has died and noted what shows it. Until then they stay off public pages.
Veterans who are still alive. Anyone who believes a veteran is still alive can tell us. On the website and in the app, the question "I have reason to believe this veteran is still alive" is asked before a record is opened, and every record has a "Report a living veteran" link. When someone answers Yes, the records of that service number are hidden on The Accounted straight away, any public profile of that soldier is taken offline, and we review the report. A report is a precaution, not proof that anyone is alive or has died.
Your rights. If you are in these records, or are writing on behalf of a veteran, you can object to our use of the records, or ask for access, correction or removal, at contact@theaccounted.com. We do not change the original archival records, which are kept by NARA; where a family's information contradicts a record, we can add a note.
What a living-veteran report stores. Only the service number (and, when there is no usable number, the name that was searched, so we can review it). For a report made in the app we also keep which account made it, visible only to us, until the report is reviewed and at most 12 months, so that misuse can be traced. A report made on the website stores nothing about the visitor.
Consent from a living veteran. A living veteran (or his or her legal representative) can let a relative or researcher see his or her records by filling in and signing our consent form and emailing it to contact@theaccounted.com. On the form the veteran chooses whether the records are shown only to the person named on it, or to all users. We don't ask for a copy of an ID. By emailing the form, the sender agrees that we keep the form, and the details in it (the veteran's name, service number, signature and contact details, and the requester's name, account email and relationship), in our email, together with a short record in our admin system of what was agreed and when. We use these details only to apply the consent and to show what it covered. The veteran can withdraw consent at any time by emailing us; access then ends, and we delete the form, keeping only a record that consent was given and withdrawn.

Purposes and legal bases at a glance

Purpose	Data involved	Legal basis
Historical and genealogical research, and archiving in the public interest: helping families, historians and researchers find a veteran's records	Details in the NARA records (enlistment records, Morning Reports, prisoner-of-war records, photographs)	For veterans who may still be alive: legitimate interest in historical research and archiving in the public interest (Art. 6(1)(f)), with the safeguards of Art. 89. The GDPR does not apply to deceased persons.
Same purposes, where the record contains health information (hospital admission cards) or a racial classification used by the U.S. Army	Health data, racial classification	Archiving and historical research in the public interest (Art. 9(2)(j) GDPR and Art. 24 UAVG), with the safeguards described in section 5
Showing records to a relative or researcher at the request of a living veteran	The veteran's records	The veteran's explicit consent (Art. 6(1)(a) and 9(2)(a)), given on the consent form; withdrawable at any time
Keeping the signed consent form and a record of what was agreed	Veteran's name, service number, signature, contact details; requester's name, account email, relationship	Legitimate interest in being able to show that consent was given and what it covered (Art. 6(1)(f))
Handling reports of a living veteran	Service number (or the name searched); for app reports, the reporting account for at most 12 months	Legitimate interest in protecting living veterans and acting on reports (Art. 6(1)(f))

6. Public sharing

Some features let you choose to publish a soldier profile, map, or timeline at a public URL. Publishing is always something you actively choose — nothing about your account or research is public by default. Once you publish something, treat it as public: it's viewable by anyone with the link, and specific sensitive fields (like a service number or date of birth) have their own separate visibility toggle within the publishing settings, off by default. You can unpublish anything at any time.

7. Who we share data with

We don't sell or rent your personal data. We share it only with:

Supabase, our database, authentication, and hosting provider, acting as our data processor;
Railway (our record database and record service), Cloudflare (files, images and the website), Resend (email) and Esri (map images, through our own server), also acting as our data processors;
Stripe, our payment provider, for paid plans and purchases (see section 4);
Other researchers you specifically invite to collaborate on a project, or who invite you — limited to what's needed for that collaboration;
Anyone who views content you've deliberately chosen to make public;
Law enforcement or regulators, only where we're legally required to.

8. How long we keep your data

We keep your account and research data for as long as your account is active. If you delete your account, we delete your personal account data within a year, except where we're required to retain something for legal reasons. Payment and VAT records are kept for 7 years, as Dutch tax law requires, also after you delete your account. Content you've made public may remain accessible to others who already viewed, saved, or shared the link before deletion.

Historical records are kept for as long as the Service exists, as a research archive. A living-veteran block is kept for as long as it applies, with a history of every decision; the account that made a report is removed from it when the report is reviewed, and after 12 months at the latest. A living veteran's consent form is kept in our email for as long as the consent applies, and deleted when it is withdrawn; a record that consent was given and withdrawn is kept with the block's history.

9. Your rights

Under GDPR, you have the right to:

Access the personal data we hold about you, and receive confirmation whether or not we hold information about you;
Correct inaccurate or incomplete data we hold about you;
Erase your data ("right to be forgotten");
Export your data in a structured, commonly used and machine-readable format;
Object to processing in certain cases;
Restrict processing in certain cases;
Withdraw consent at any time, where processing is based on consent;
Lodge a complaint with your local data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

To exercise any of these rights, contact us at contact@theaccounted.com.

10. Children's privacy

The Service is not directed at children, and you must be at least 18 years old to create an account, in line with our Terms and Conditions. We do not knowingly collect personal data from children under that age.

11. Security

We take reasonable technical and organizational measures to protect your data, including encrypted storage of passwords and industry-standard access controls through our infrastructure provider. No system is completely secure, and we can't guarantee absolute security of information transmitted to the Service.

12. Changes to this Statement

We may update this Privacy Statement, for example when we add a feature or start working with a new service provider. Important changes — such as new kinds of data, new purposes, or new parties we share data with — we announce at least 30 days before they take effect, by email to the address on your account and with a notice in the app, saying in plain words what changes. Small changes, like a new address or clearer wording, can take effect straight away; we always update the "Last updated" date above. We never start using data you already gave us for a new purpose that needs your consent without asking you first.

13. Contact

Questions about this statement or your personal data? Reach us at contact@theaccounted.com.