Privacy Policy

1. Controller, scope and roles

For processing where we determine the purposes and means, the controller is IGOR KOTSAR Ε.Ε., a Greek limited partnership registered in English as IGOR KOTSAR L.P., GEMI number 188841201000, VAT number EL803077373, with registered office at 14 Kythiron Street, Porto Rafti, Markopoulo Mesogaias, East Attica 19023, Greece (“BusinessVisor”, “we”, “us”). Privacy requests may be sent to [email protected].

This Policy covers our public website, web application, reporting links, account and billing administration, support, security and service communications. For those activities, we normally act as controller. When a business Customer chooses people, metrics and other personal data placed in its dashboards or reporting flows, the Customer normally acts as controller and we act as its processor under Section 7 of the Terms. The Customer’s own privacy information and instructions then also apply.

2. Personal data we handle

The data depends on your relationship with the Service and selected functions. Required fields must be provided for the relevant function to work; other profile and communication fields are optional. We may handle:

• Account and identity data: email, name, language, role, organisation, account and business identifiers, authentication challenges, session and account status.
• Profile and business-contact data: professional role, optional phone number, notification preference and information entered by a Customer about managers, clients, team members or reporting recipients.
• Staff and manager administration data: name, business email, optional phone and country, role and status, assigned clients, internal administrative comment, commission rate, commission and payout amounts, status and dates.
• Service content: business descriptions, dashboards, groups, widgets, targets, values, comments, submissions, schedules, permissions, AI context, reports and related history.
• Messaging data: push subscription endpoints and encryption keys, outgoing messages, delivery and technical metadata.
• Billing data: Stripe identifiers, plan, subscription and invoice status, amounts, currency, billing country or address, tax identifiers and transaction references. Stripe collects card and payment-account details directly in its hosted fields; we do not store full card numbers or security codes.
• Technical and security data: IP and network information available to infrastructure, request IDs, timestamps, requested route, response status, authentication and security events, errors and delivery diagnostics.
• Communications and browser storage: support or legal requests, the essential session cookie, language preference and notice-status keys which may include a normalised email and expiry date.

3. Sources of data

We receive data directly from you; from the Customer, owner, administrator or manager who adds, invites or assigns you; automatically from use of the Service and infrastructure; and from Stripe, Resend, OpenAI and push service providers when their functions are used.

If a Customer provides your details, that Customer is responsible for required information and a lawful basis. You may contact the Customer or us if you believe your details were added without authority.

4. Purposes and legal bases

We process account and service data to provide access, operate requested functions, administer subscriptions, communicate about the Service and provide support. The basis is performance of a contract where you are the contracting person, or our and the Customer’s legitimate interests in providing an authorised B2B service where you act for an organisation.

We process staff and manager data to administer authorised access, assign managed Customers, calculate and record commissions or payouts, maintain security and audit records, and manage the relevant business relationship. The basis is performance of the relevant agreement, our legitimate interests in operating and accounting for the management service, and legal obligations for tax, accounting or employment-related records where applicable.

We use necessary technical, authentication and event data to secure the Service, prevent abuse, investigate incidents, maintain reliability and establish or defend legal claims. The basis is legitimate interests and, where applicable, legal obligation. We retain transaction, tax and corporate records where required by law.

We process messaging data to perform the requested function. Where consent is required for an optional channel, consent is the basis and may be withdrawn at any time without affecting earlier processing. Operational email necessary for authentication, security, reporting or subscription is not marketing.

When we act as processor for Customer Data, the Customer determines the purpose and legal basis. We do not use Customer Data for independent advertising, sale of personal data or training our own general-purpose AI model.

5. Reporting, messaging and AI

A Customer may add personnel, assign permissions and invite a person to submit information through a time-limited link. We use details supplied by that Customer to authenticate the person, provide access and deliver the requested operational message. Push notifications are optional and enabled by the recipient for each device.

When scheduled AI analysis runs for an eligible active account, selected business, dashboard, metric, trend and responsible-person context may be sent to the OpenAI API. Direct contact fields and internal database identifiers are excluded by design where not needed, but free-text Customer Data may contain information entered by a Customer. At the effective date, OpenAI states that API data is not used to train its models by default unless the API customer opts in. Our Responses requests set ordinary response storage to false. Unless stricter OpenAI data controls apply, abuse-monitoring logs may include prompts, responses and derived metadata for up to 30 days, and supported requests may use encrypted prompt-cache data in GPU-local storage for no more than 24 hours, subject to OpenAI’s current policies and legal exceptions.

We do not use AI output to make our own decisions producing legal or similarly significant effects about individuals. Customers must not use the Service as the sole basis for such decisions.

6. Recipients and providers

We disclose personal data only where needed for the purposes above, under appropriate contractual or legal safeguards. The current providers that may receive personal data are listed below. Providers marked as subprocessors are covered by the Customer’s general authorisation in Section 7 of the Terms to the extent they process Customer Data on our behalf; a provider may separately act as an independent controller for its own account, security or regulatory purposes.

We may also disclose limited data to professional advisers, insurers, auditors, courts, regulators or authorities where reasonably necessary or legally required, and in a merger, financing, reorganisation or sale subject to appropriate confidentiality. We do not sell personal data or share it for cross-context behavioural advertising.

• DigitalOcean, LLC — subprocessor for application, network and managed PostgreSQL infrastructure in Frankfurt, Germany.
• Better Stack, Inc. and its authorised subprocessors — subprocessor for application-error ingestion, storage, search and operational error monitoring.
• OpenAI Ireland Ltd. and its authorised subprocessors — subprocessor for scheduled AI-assisted analysis through the API.
• Plus Five Five, Inc. d/b/a Resend and its authorised subprocessors — subprocessor for one-time codes and operational email.
• Stripe group entities, including Stripe Payments Europe, Limited and Stripe Technology Company, Limited as applicable — Checkout, subscriptions, invoices, billing tax information and the billing portal; Stripe may act as a processor or independent controller depending on the activity.
• Browser and operating-system push services — optional Web Push delivery; the provider processes subscription endpoints, encrypted notifications and technical delivery metadata under its own terms and privacy policy.

7. International transfers

Our primary application and database infrastructure is in Frankfurt, Germany. Some providers or their support and security teams may process data outside the European Economic Area. Where GDPR requires a safeguard, we rely on an adequacy decision, the EU–US Data Privacy Framework for a certified recipient, European Commission Standard Contractual Clauses with supplementary measures where appropriate, or another lawful mechanism.

You may request at [email protected] a copy of an applicable transfer safeguard, or information about where it is made available, subject to lawful redactions. Third-party services may also process data as independent controllers under their own transfer arrangements.

8. Retention

We retain personal data no longer than reasonably necessary for the described purposes, considering Customer instructions, account lifecycle, security, unresolved delivery or payment, legal claims, and tax or accounting duties. Ending a Trial or subscription does not itself delete the account; the ordinary retention periods below continue to apply to its business history. Deleting a widget removes the widget and the data previously submitted through it from the active database; limited residual copies may remain only as described below.

• Core account, dashboard, people and widget configuration data, together with current AI reports and derived statistics, may remain while the account exists. On an eligible account-deletion request, core content, including remaining widget history, is removed from the active database. A person record controlled by another Customer is not deleted merely because that person deletes a separate account.
• Raw submissions stored in widget history generally remain available for about 13 months, followed by an additional 48-hour technical margin before periodic cleanup. To preserve useful context, the ten most recent submissions for each existing widget, or all submissions if there are fewer than ten, remain available regardless of age and may therefore be retained longer. For older submissions outside that exception, this history period takes priority over notification status because the related operational message is no longer useful.
• Staff and manager profile, assignment and internal administration data is kept while the role or business relationship remains active and afterwards only while needed for access security, disputes, legal duties or administration. Commission and payout history may be retained for applicable tax, accounting and legal-claim periods.
• A sign-in code is valid for 10 minutes; terminal code records become eligible for hourly cleanup once more than 24 hours old. Sessions normally expire after 30 days. Push subscriptions are kept until disconnected or removed through account or data cleanup.
• Task access links are valid for 7 days and can be reused during that period. Their access-token records become eligible for deletion 30 days after expiry. Completed reporting tasks generally become eligible for deletion once more than 30 days have passed since their creation. Uncompleted tasks are not deleted solely because a link expires or delivery fails.
• Sent or cancelled trial-notification records, eligible processed or terminal Stripe webhooks, completed, expired or finally failed Checkout records, and successfully processed or terminally failed Stripe Customer email-sync jobs are generally removed after 90 days. Other unresolved retry or security records may remain longer until resolved or no longer necessary.
• Frontend error events sent to Better Stack are retained for the configured application retention period and deleted when they are no longer reasonably needed for operational, security or legal purposes.
• Payment history, invoice and transaction references, and records needed for tax, accounting, fraud prevention or legal claims are kept for the applicable statutory or necessity period. Providers retain their own records under their policies and duties.
• Residual copies may remain in provider resilience or backup systems according to the provider’s configured lifecycle and are not used for ordinary operations. Platform logs and incident copies are retained only while reasonably needed for operational, security or legal purposes. Browser language and notice preferences remain until site data is cleared.

9. Account deletion

An account owner may request deletion through the Service after active subscriptions and open payment operations are closed. Account deletion cannot be undone, so the Customer should retain any needed independent copy beforehand. The Service does not promise a commercial data export. Core content is removed from the active database and deletion of the reusable Stripe Customer is requested where supported, but Stripe may retain transaction records required for financial compliance. Applicable data-protection access and portability rights remain available.

Deletion does not erase financial and security records we must or are entitled to retain, data controlled by another Customer, or data held by an independent provider under its lawful obligations. Retained information is restricted to the purpose that justifies keeping it.

10. Rights and complaints

Subject to GDPR and applicable law, you may request access, correction, deletion, restriction and portability, object to processing based on legitimate interests, and withdraw consent. You may complain to the Hellenic Data Protection Authority at www.dpa.gr or to the authority where you live or work. GDPR requests are normally answered within one month, subject to lawful verification, extension and exceptions.

Send requests to [email protected]. We may verify identity and ask for information needed to locate the data. If the request concerns Customer-controlled data, we may refer it to that Customer and assist as required. Rights are not absolute; we will explain any lawful refusal or limitation.

11. Security

Measures include encrypted transport, role-based access, one-time-code authentication, recent reauthentication for sensitive actions, hashed secrets and tokens, origin and request-size controls, authenticated and, where supported, signature-verified provider webhooks, access controls intended to restrict production access, event logging, provider resilience measures and provider security controls. We review measures as the Service evolves, but no internet service can guarantee absolute security.

Keep your email and devices secure and promptly report suspected unauthorised access or a leaked reporting link to [email protected]. Where law requires, we will notify affected controllers, individuals or authorities of a personal-data breach.

12. Cookies and browser storage

The application uses the essential bv_session authentication cookie. It is HttpOnly, Secure in production, SameSite=Lax and normally expires after 30 days. Browser storage remembers language and notice choices and may include a normalised email and expiry time. At the effective date, we do not use third-party advertising cookies, pixels or optional behavioural analytics. If that changes, we will update this Policy and obtain consent where required.

13. Children and restricted data

The Service is for adults acting in a business or professional capacity and is not directed to anyone under 18. Customers must not add children’s data or restricted sensitive information listed in the Terms. Contact us if you believe such information has been submitted so we can take appropriate action.

14. Changes, contact and language

We may update this Policy when processing, providers or law changes. We will publish the current version and, where required, directly notify affected users sufficiently in advance of a material change. We will provide required information before using personal data for a materially new purpose and request consent separately where consent is required.

Questions, objections and rights requests should be sent to [email protected] or mailed to the registered office in Section 1. The English version controls if a translation differs, to the extent permitted by law.