BusinessVeno

Privacy Policy

How BusinessVeno collects, uses and protects personal data.

DRAFT — for legal review, not yet in force.

Who we are

BusinessVeno is operated by XVeno v/Saroj Adhikari (CVR 46872614), a sole proprietorship owned by Saroj Adhikari, Fiskerhusene 29, 2620 Albertslund, Denmark, VAT DK46872614 ("BusinessVeno", "we", "us"). We are the data controller for the personal data described here. Contact: support@businessveno.com.

What BusinessVeno does

BusinessVeno shows how AI search engines describe a business, compares this with competitors, audits the business's website and drafts improvements that the customer reviews and approves. To do this we fetch public web pages and send questions about businesses to AI search providers. We never publish anything on your behalf.

What we collect

  • Account data - name, email address, username and a hashed password. If you sign in with Google, we receive your Google account identifier, name and email address.
  • Organization and team data - organization name, country and language, team members, their roles and invitations.
  • Websites and competitors - the websites and competitor websites you enter, and the business details you add or confirm (for example services, location and contact details).
  • Fetched web pages - public pages of those websites, fetched by our crawler BusinessVenoBot, which respects robots.txt (see our crawler). Business websites can contain personal data, such as the names of owners and staff. From competitors' pages we remove email addresses and phone numbers before storing them; we keep only what is needed to show how the page changed.
  • Questions and answers - the questions (prompts) we send to AI search engines about your business and its market, and the answers and sources they return.
  • Results you create - measurements, recommendations, drafted fixes and your edits and decisions on them.
  • Billing data - your plan, subscription status and invoices. Payments are handled by Paddle (Paddle.com Market Ltd), our reseller and merchant of record; we never receive or store your card details.
  • Usage data - counters of how much of your plan you have used.
  • Instant check without an account - the website you check, your email address (used only to send you the link to your result, never for marketing) and a hashed (one-way scrambled) version of your IP address, used to enforce the free quota and prevent abuse.
  • Ownership confirmations - when you run a free check, your email, the website and the time you confirmed that it is your business or that you may act for it.
  • A website's free check - the result of a website's one free check (public information: the business, AI answers and Google rankings) is shown to everyone who checks that website for free, with or without an account. Your own audit, recommendations, fixes and verified business facts are never shared.
  • Last activity - the day you last used BusinessVeno, so free accounts that are no longer used stop being monitored.
  • Technical and security data - server logs (IP address, time, requested address, browser type), hashed IP addresses in our audit log, and error reports.
  • Visits from AI to your website - if you install our plugin or script, or upload your server logs, we receive which AI bot or AI assistant visited which page and when. We do not store visitors' IP addresses, and for people who arrive from an AI answer we store only which AI they came from. For this data we act as your processor.
  • Email preferences - which notifications and digests you want to receive.
  • Messages - what you write to us when you contact support.

Why we use it and our legal basis

  • To provide the service you signed up for - your account, organizations, monitoring, analyses and drafted fixes (GDPR Art. 6(1)(b), contract).
  • To bill subscriptions and keep accounting records (Art. 6(1)(b) and Art. 6(1)(c), legal obligation under Danish bookkeeping law).
  • To analyse public websites and AI answers about businesses, including competitors you choose to track (Art. 6(1)(f), our and our customers' legitimate interest in understanding how businesses are presented online). We only process public business information and do not build profiles of private individuals.
  • To show that checks were requested by the business - we keep proof that the person running a free check confirmed the business is theirs or that they may act for it, so we can show we follow our data providers' terms and establish or defend legal claims (Art. 6(1)(f)).
  • To keep the service secure - preventing abuse, fraud and attacks, and enforcing plan limits (Art. 6(1)(f)).
  • To send service emails - account, security, billing and the alerts you have switched on (Art. 6(1)(b)).

How AI is used

Questions about businesses are asked on the real AI websites (ChatGPT, Google AI Overviews and AI Mode, Gemini, Perplexity and Microsoft Copilot) through two data providers, DataForSEO and Bright Data, which return the public answers. If you buy extra AI engines, the questions are also sent to Anthropic (Claude) through its API. We do not use DeepSeek. These questions are about businesses and markets, and normally contain business names, websites, locations and services - not your account details. If your business trades under a person's name, that name appears in the questions and answers. To get the answers, the questions are asked on the AI assistants' public websites (logged out), such as ChatGPT, Gemini, Perplexity and Microsoft Copilot. These services process the questions under their own terms. Please do not enter personal data about private individuals into business descriptions or custom prompts.

Texts are also analysed by an AI model that runs on BusinessVeno's own hardware. That analysis does not leave our servers. Scores are calculated by our own rules and shown with their evidence and confidence; AI is used to classify, extract, explain and draft. Drafted texts are marked as AI-generated, and AI answers and drafts can contain mistakes. We do not make decisions about you as a person by automated means.

Who we share it with

We do not sell personal data and we do not use it for advertising. We use these providers:

  • Cloudflare - all traffic to businessveno.com and api.businessveno.com passes through Cloudflare's network for security and delivery; also routes email to our addresses (processor).
  • Resend (United States) - sends our emails (processor).
  • Paddle (Paddle.com Market Ltd, United Kingdom; Paddle.com Inc. for US buyers) - our reseller and merchant of record: it sells the subscription to you, takes the payment, handles VAT and sales tax and sends receipts, as an independent controller. Paddle receives your email address, country and payment details.
  • Google - Google sign-in if you choose it; Web Risk, which receives only website addresses, to warn you if Google lists your website as unsafe.
  • Cloudflare Turnstile - tells people from bots on protected forms such as registration, sign-in and the instant check, without tracking cookies (processor).
  • DataForSEO (DataForSEO OÜ, Estonia; data processed on its own servers in Germany) - asks the questions about businesses described above on ChatGPT, Gemini, Google AI Mode and Google AI Overviews, and checks Google rankings (processor; it keeps results about 30 days, deletes everything after at most 12 months, and does not use our queries for training).
  • Bright Data (Bright Data Ltd., Israel) - asks the same questions on Perplexity and Microsoft Copilot (processor). Its hosting providers are in the Netherlands, Israel and the United States; transfers to the United States are covered by the EU Standard Contractual Clauses in its data protection agreement. Results are kept by Bright Data for up to 30 days. Bright Data does not use them for its own purposes or to train AI models.
  • OpenAI (United States) - reads AI answers and drafts texts on paid plans (processor; does not train on our data).
  • Anthropic - only if you buy extra AI engines: receives the questions about businesses described above (processor; it does not train on our data).

We may also disclose data where the law requires it, or to protect our rights in a legal claim.

Where your data is stored

Our database, background processing and our own AI model run on our own servers in Copenhagen, Denmark. Some providers above process data outside the EU/EEA, mainly in the United States. Where they do, we rely on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses in each provider's data processing terms. [To be confirmed per provider.] Contact us for details of the safeguards.

How long we keep it

  • AI answers (the answers and the websites they cite) - 30 days; each website's latest check is kept until a newer one replaces it.
  • Monitoring history (scores and measurements, website snapshots, competitor changes) - according to your plan: 30 days (Scout), 90 days (Analyst), 365 days (Strategist) or 1,095 days (Sentinel). Older history is deleted.
  • Instant checks without an account - each website gets one free check, and its result (public information about the website: the business, AI answers and Google rankings) is kept so later requests for the same website see that check. The email address of everyone who asks is deleted after 7 days.
  • Ownership confirmations - when you run a free check, we store your email, the website and the time you confirmed that it is your business or that you may act for it. We keep this for 3 years, the general limitation period in Denmark, to show that checks were requested by the business, and then delete it.
  • Deleted websites and companies - kept for 30 days so you can undo the deletion (adding the website or creating the company again brings it back), then deleted for good.
  • Account and organization data - while your account exists. When you delete your account or organization, the data is deleted within 30 days, except what we must keep by law.
  • Invoices and accounting records - 5 years from the end of the financial year, as required by Danish bookkeeping law.
  • Server logs - 30 days. Audit log (what was done in an account) - one year. Hashed IP addresses - 30 days.
  • Backups - deleted after 14 days.

Cookies and browser storage

We use only what the site needs to work. We use no statistics, analytics or advertising cookies, so there is no cookie banner:

  • businessveno_auth_token (local storage) - keeps you signed in until you sign out. Necessary.
  • theme, businessveno.language, businessveno.language.lastSeen (local storage) - remember light/dark mode and your language. Your settings.
  • businessveno.languages, businessveno-dismissed-notices (session storage) - available languages and closed notices; deleted when you close the tab. Necessary.
  • Short-lived security cookies on api.businessveno.com while you sign in with Google. Necessary.
  • Cloudflare Turnstile on protected forms sets no tracking cookies.

Your rights

You have the right to access your data, have it corrected or deleted, restrict or object to processing, and receive your data in a portable format. Where we rely on consent, you can withdraw it at any time. Most data can be viewed, changed or deleted in your account settings; otherwise write to support@businessveno.com. We answer within one month.

If your personal data appears on a website that a BusinessVeno customer monitors, you can also contact us and we will look into your request.

You can complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk, or the authority in the EU country where you live.

Children

BusinessVeno is a service for businesses and is not intended for anyone under 18.

Changes

We will update this policy when our processing changes. The date at the top shows the latest version. We will notify account holders by email of important changes.