Privacy · Website & account
Website & Account Privacy Policy
Last updated 16 August 2026
This policy covers privacy.bivelio.com — the site you are reading, the account you sign in to, the organisation and seats you may buy, and the Sandbox. It is published by BiVelio, Inc. and describes what this deployment actually does. Where the page and the software disagree, that is a bug: report it to privacy@bivelio.com.
What we process, and why
| Data | Why | Legal basis |
|---|---|---|
| Account — your email address and user id | To create your account, sign you in, and keep the session secure | Performance of a contract (Art. 6(1)(b)) |
| Organisation, membership and seats — the organisation name, your role in it, the number of licensed seats | To run the team plan and decide what your account is allowed to do | Performance of a contract (Art. 6(1)(b)) |
| Billing and tax — Stripe customer and subscription identifiers, payment status, billing country and VAT number. Card details are entered on Stripe's own pages and never reach us | To charge the subscription and issue a correct invoice | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Invitations — the email address of the person you invite, who invited them, an expiry, and a hash of the invitation token | To deliver the one invitation message you asked us to send on your behalf | Legitimate interests (Art. 6(1)(f)) — you are inviting a colleague to a team they are joining |
| Sandbox text — whatever you paste into the Sandbox | To run the dry-run inspection you asked for. It is processed in memory on our German server, is never forwarded to any AI provider, and is not stored | Your request / performance of a contract (Art. 6(1)(b)) |
| Usage counters and value-free audit metadata — counts, decisions and opaque identifiers, never your text or the values detected in it | To enforce quotas, prevent abuse, and keep the service working | Legitimate interests (Art. 6(1)(f)) |
Who else touches it
A short list of infrastructure providers, and nobody else. None of them is an AI provider, and none receives more than its row says.
| Processor | What it does for us | Where |
|---|---|---|
| Supabase | Sign-in, and the database holding account, organisation and billing metadata | Central EU — Frankfurt |
| Hetzner Online GmbH | The Sandbox compute that inspects, in memory, the text you paste | Germany (EU) |
| Vercel Inc. | This website and its server functions | Frankfurt (fra1), pinned in the repository |
| Stripe | Subscription billing, the customer portal, and VAT-number collection | United States |
| Resend | Delivery of the organisation-invitation email | United States |
What this domain does not do
- It runs no analytics and no advertising. There is no Google Analytics, no tag manager, no product-analytics SDK and no ad pixel anywhere in this site's code.
- It does not sell or share your personal data, and none of it is used to train or fine-tune any model.
- No AI or LLM provider receives your account data, and the Sandbox never forwards the text you paste to a model provider.
- It does not profile you, and makes no automated decisions producing legal effects.
Cookies
The only cookies this site sets are the ones that keep you signed in and protect the sign-in flow. There are no analytics or advertising cookies here — whatever the company-level cookie policy on bivelio.com describes for other properties.
Where the data goes
The three providers holding the bulk of it are in the EU: Supabase in Frankfurt, Hetzner in Germany, and Vercel pinned to Frankfurt (fra1). Two are not: Stripe takes the payment and Resend delivers the invitation email, both from the United States, so those two paths involve a transfer outside the EEA under an appropriate Chapter V safeguard. We name them rather than let a general “EU residency” sentence quietly cover them.
How long we keep it
The text you paste into the Sandbox is not retained at all: it exists in memory for the length of your request and is never written to disk. Everything else — account, organisation, billing and invitation rows, counters and audit metadata — is kept until it is deleted. There is no automated purge in this service today, so nothing ages out on its own; we would rather tell you that than publish a retention period nothing enforces. Deleting your account removes your key metadata and usage counters automatically. For anything else, write to privacy@bivelio.com and we will delete it.
Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and you may lodge a complaint with your supervisory authority. Write to privacy@bivelio.com — that address is the only rights channel this service has, and it is answered by us directly. There is no self-service portal, and we would rather say so than imply one exists. We respond within one month, as Art. 12(3) requires.
Children
This is a business tool. It is not directed at children under 16, and we do not knowingly process their data.
Changes to this policy
We will update this page and its date whenever the service's data behaviour changes.
Contact
Privacy questions, requests, or a correction to this page: privacy@bivelio.com
BiVelio, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States · operating from Andorra 🇦🇩 · +1 302 208 5841