Privacy · Website & account
Website & Account Privacy Policy
This policy covers privacy.bivelio.com — the site you are reading, the account you sign in to, the organisation and seats you may buy, the Sandbox, and inspect.bivelio.com, the names service a Team organization’s BiVelio Shield sends message text to. It is published by BiVelio, Inc. and describes what this deployment actually does. Where the page and the software disagree, that is a bug: report it to privacy@bivelio.com.
At a glance
- Account and billing metadata onlyYour email, your organisation, your seats and Stripe identifiers. Card numbers never reach us.
- Your prompts come here on one route only, and only on the Team planThe extension and the gateway redact on your side; this site only ever learns value-free counts. The one route is inspect.bivelio.com: message text that a Team organization’s BiVelio Shield sends there is answered as positions in memory and stored nowhere. That service is offered under its own data-processing agreement, which forms part of the terms the Team plan is sold on. On Team an owner or an administrator switches the layer off from the dashboard; on Pro, and on any install whose gateway comes from a managed policy, that policy takes precedence and the layer goes off by removing the address from it. On any other plan no prompt of yours comes here on that route at all.
- EU by default, three US exceptions namedFrankfurt and Germany for the site, the database and the Sandbox. Stripe (payments), Resend (invitation email) and Google (ads measurement on the public pages) operate from the United States.
- Ads cookies only with your consentGoogle's ads tag runs on the public pages only, cookieless and with click identifiers redacted until you choose. It sets advertising cookies only if you accept the banner. Sign-in cookies are the only ones that always load.
Three documents, and which one you want
- This page governs privacy.bivelio.com and inspect.bivelio.com, and nothing else.
- The BiVelio Shield browser extension has its own policy, because it behaves completely differently: everything happens on your machine and nothing is sent to us. That is the document the Chrome Web Store listing points at. The one exception is described below: a names service BiVelio operates, which the Team plan points the extension at under that service’s own data-processing agreement, and which an organization’s administrator can redirect to a gateway of its own.
- The legal documents on bivelio.com are company-level. They cover BiVelio's main website and its other products, and name a representative for a different entity. They do not describe this service, and this page should not be read through them.
What we process, and why
| Data | Why | Legal basis |
|---|---|---|
| Account — your email address and user id | To create your account, sign you in, and keep the session secure | Performance of a contract (Art. 6(1)(b)) |
| Organisation, membership and seats — the organisation name, your role in it, the number of licensed seats | To run the team plan and decide what your account is allowed to do | Performance of a contract (Art. 6(1)(b)) |
| Billing and tax — Stripe customer and subscription identifiers, payment status, billing country and VAT number. Card details are entered on Stripe's own pages and never reach us | To charge the subscription and issue a correct invoice | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Invitations — the email address of the person you invite, who invited them, an expiry, and a hash of the invitation token | To deliver the one invitation message you asked us to send on your behalf | Legitimate interests (Art. 6(1)(f)) — you are inviting a colleague to a team they are joining |
| Sandbox text — whatever you paste into the Sandbox | To run the dry-run inspection you asked for. It is processed in memory on our German server, is never forwarded to any AI provider, and is not stored | Your request / performance of a contract (Art. 6(1)(b)) |
| Names-service text — the text of a message that BiVelio Shield sends to inspect.bivelio.com, on a Team organization whose licence carries that address under the service’s own data-processing agreement, or whose administrator has pointed the extension at it | To find the positions of the personal data the service detects in that text — names and places, and also contact details, identifiers, financial data, network addresses, secrets and GDPR Art. 9 special-category terms — and return them; the extension does the replacement. The text is held in RAM only for the length of the request, is never written to disk, is never logged, and is never forwarded to any AI provider | Your organization’s instruction under its data-processing agreement (Art. 28) — your organization is the controller |
| Usage counters and value-free audit metadata — counts, decisions and opaque identifiers, never your text or the values detected in it | To enforce quotas, prevent abuse, and keep the service working | Legitimate interests (Art. 6(1)(f)) |
What you must provide, and what happens if you do not
An email address and a password are required to hold an account; without them there is no account to sign in to. A billing country and, for business buyers, a VAT number are required by contract and by tax law to buy seats; without them checkout cannot complete. Everything else — an organisation name, invitations, text pasted into the Sandbox — is optional and the service works without it.
Who else touches it
A short list of providers, and nobody else. None of them is an AI provider, and none receives more than its row says.
| Recipient | What it does for us | Where |
|---|---|---|
| Supabase | Sign-in, and the database holding account, organisation and billing metadata | Central EU — Frankfurt |
| Hetzner Online GmbH | The Sandbox compute that inspects, in memory, the text you paste — and the names service (inspect.bivelio.com) that inspects, in memory, the message text BiVelio Shield sends from Team organizations that chose it, returning the positions of every kind of personal data it detects, GDPR Art. 9 special-category terms included. Offered under that service's own data-processing agreement | Germany (EU) |
| Vercel Inc. | This website and its server functions | Frankfurt (fra1), pinned in the repository |
| Stripe | Subscription billing, the customer portal, and VAT-number collection | United States |
| Resend | Delivery of the organisation-invitation email | United States |
| Google (Google Ireland Ltd / Google LLC) | Google Ads campaign measurement on the public pages only: the gtag.js tag sends cookieless page-view and consent-state pings with click identifiers redacted, and sets advertising cookies and reports conversions only after you accept the banner. An independent controller for that data, not a processor. Never loaded on the account, dashboard or invitation pages | Ireland (EU) / United States |
What this domain does not do
- It runs no product-analytics SDK and no session recording: nothing watches, replays or profiles what you do inside the app itself.
- It does not sell or share your personal data, and none of it is used to train or fine-tune any model.
- No AI or LLM provider receives your account data, and neither the Sandbox nor the names service forwards the text it receives to a model provider.
- It does not profile you, and makes no automated decisions producing legal effects.
Cookies
Two kinds of cookies. The ones that keep you signed in and protect the sign-in flow always load — the product needs them. Google Ads campaign-measurement cookies (set by Google: _gcl_au, 90 days, and related _gcl_* cookies) load ONLY if you accept them in the consent banner: they are denied by default through Google Consent Mode, so if you reject or ignore the banner the site stays cookie-free beyond sign-in. Google's tag itself runs on the public pages before you choose, in cookieless mode and with click identifiers redacted, and sends Google consent-state pings. Your choice is stored in your browser (localStorage key bv-ads-consent) and you can change it at any time from “Cookie settings” in the footer.
Where the data goes
The three providers holding the bulk of it are in the EU: Supabase in Frankfurt, Hetzner in Germany (the Sandbox and the names service), and Vercel pinned to Frankfurt (fra1). Three are not: Stripe takes the payment and Resend delivers the invitation email, both from the United States, and Google receives ads-measurement pings from the public pages — cookieless until you consent, never from the account, dashboard or invitation pages. Those paths involve a transfer outside the EEA under an appropriate Chapter V safeguard. We name them rather than let a general “EU residency” sentence quietly cover them.
Copies of the transfer safeguards
For the three United States recipients — Stripe and Resend as processors, Google as an independent controller for ads measurement — the transfer relies on the appropriate Chapter V mechanism each provider offers: the EU-US Data Privacy Framework where the provider is certified, standard contractual clauses otherwise. Write to privacy@bivelio.com and we will tell you which one applies to each and how to obtain a copy.
How long we keep it
The text you paste into the Sandbox, and the message text BiVelio Shield sends to the names service, are not retained at all: they exist in memory for the length of the request and are never written to disk or to a log. Everything else — account, organisation, billing and invitation rows, counters and audit metadata — is kept until it is deleted. There is no automated purge in this service today, so nothing ages out on its own; we would rather tell you that than publish a retention period nothing enforces. Deleting your account removes your key metadata and usage counters automatically. For anything else, write to privacy@bivelio.com and we will delete it.
Automated decisions
This service makes no decision about you within the meaning of Art. 22 and builds no profile. Quota limits and seat counts are simple arithmetic on the counters described above; they never use the content of anything you paste.
Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and you may lodge a complaint with your supervisory authority. Write to privacy@bivelio.com — that address is the only rights channel this service has, and it is answered by us directly. There is no self-service portal, and we would rather say so than imply one exists. We respond within one month, as Art. 12(3) requires.
Complaints and the supervisory authority
You may lodge a complaint with a supervisory authority — in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77). The European Data Protection Board keeps the list of every authority and its contact details. Writing to privacy@bivelio.com first is faster, but it is your choice. edpb.europa.eu ↗
Data protection officer
BiVelio has not designated a data protection officer: the processing on this domain is account, billing and value-free usage metadata for a business tool, not the large-scale or systematic monitoring Art. 37 requires one for. All privacy matters are handled directly at privacy@bivelio.com, and this section will change the day that changes.
If you run the gateway: controller and processor
When your organization runs the self-hosted gateway, the prompts that pass through it never reach BiVelio: you are the controller of that data and no processor relationship with us arises for it. The only data your gateway can send us is value-free usage counts, if you configure metering. When your organization instead points BiVelio Shield at the names service BiVelio operates (inspect.bivelio.com), BiVelio processes the text of each message on your instruction as your processor, under a data-processing agreement specific to that service, which forms part of the terms your organization’s Team subscription is made under. For that account and billing service BiVelio is the processor, and the sub-processors it relies on are the ones listed above.
Children
This is a business tool. It is not directed at children under 16, and we do not knowingly process their data.
Changes to this policy
We will update this page and its date whenever the service's data behaviour changes.
Contact
Privacy questions, requests, or a correction to this page: privacy@bivelio.com
BiVelio, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States · operating from Andorra 🇦🇩 · +1 302 208 5841
Version history
Every change to what this document declares is listed here with its date. Earlier wording is kept in the public repository history.
- v1.6
A same-day correction to 1.5, and it is about the off switch rather than about what travels: wherever this document described one road to switching the names layer off, it now names both in the same sentence. On Team an owner or an administrator switches the layer off from the dashboard; on Pro, and on any install whose gateway comes from a managed policy, that policy takes precedence and the layer goes off by removing the address from it. What travels, what comes back and what is kept are unchanged from 1.5; no new recipient and no new category of data.
- v1.5
The names service at inspect.bivelio.com is offered. Its own data-processing agreement — Annex IV of BiVelio's DPA — is the instrument it is supplied under and forms part of the terms the Team plan is sold on, so a Team organization's licence carries the address signed by BiVelio and nobody has to configure anything. On Team an owner or an administrator switches the layer off from the dashboard; on Pro, and on any install whose gateway comes from a managed policy, that policy takes precedence and the layer goes off by removing the address from it. That switch takes up to an hour to reach a browser, and the agreement says so. No new recipient, no new category of data, and no change to what travels or what is kept — the 1.4 description of that still holds.
- v1.4
The names service at inspect.bivelio.com brought into scope: message text that BiVelio Shield sends from a Team organization whose administrator chose it is inspected in memory on Hetzner (Germany), answered as the positions of every kind of personal data it detects — GDPR Art. 9 special-category terms included — never stored and never logged; BiVelio acts as processor under a service-specific data-processing agreement. That agreement does not exist yet, so the service is built and tested but not offered and the address is not handed out. Hetzner's row widened; no new recipient.
- v1.3
Google named as a third United States recipient. The Google Ads tag is limited to the public pages (never the account, dashboard or invitation pages), runs cookieless with click identifiers redacted before you choose, and its cookies, the stored consent record and the “Cookie settings” control in the footer are declared.
- v1.2
Layered layout with an index and an at-a-glance summary. Consent-gated Google Ads cookies declared (Consent Mode v2, denied by default). Added: what you must provide, automated decisions, complaints, the DPO statement, transfer-safeguard copies, and the controller/processor split for gateway customers.
- v1.0
First publication: this domain had linked to the company-level policy on bivelio.com, which does not describe this service; the footer now labels that link as corporate.