Privacy policy

Controller: Botivao. For privacy questions and access or deletion requests: info@botivao.com.

Depending on how you use Botivao, we may process:

• Company details you enter (name, address, VAT, logo, rates)
• Work orders: customer and site data, hours, materials, notes, optional photos
• Team members: name and email when invited
• Subscription and payment data via Stripe (we never see full card numbers)
• Technical data needed to run the service (session cookie, server logs)

• Providing and improving Botivao (performance of the contract)
• Billing the subscription via Stripe (legal obligation / contract)
• Support and security (legitimate interest)

We keep account and work-order data while your account is active and thereafter as long as needed for legal or dispute periods. You can request deletion via info@botivao.com.

We use processors needed to host, measure and bill Botivao, including hosting (Vercel), storage (Upstash Redis / Vercel Blob), authentication (Clerk), payments (Stripe) and usage analytics (Google Analytics). They process data only on our instructions.

Botivao uses necessary (functional) cookies to keep you signed in. For optional usage statistics we use Google Analytics 4. We load the Google script (gtag.js) and analytics cookies only after you choose “Allow statistics” in the cookie banner. Without consent or after “Necessary only” we send no requests to Google and set no analytics cookies. You can change that later via “Cookie settings” in the footer; when you withdraw consent we delete the _ga and _ga_* cookies.

You have rights of access, rectification, erasure, restriction, portability and objection under the GDPR. Contact: info@botivao.com. You may also lodge a complaint with the Belgian Data Protection Authority or the Dutch Autoriteit Persoonsgegevens.

PDF, CSV and JSON exports from Botivao are work aids for your admin. They are not a legal invoice or Peppol e-invoice unless you create that yourself in accounting software.

AI features are off by default. If they are explicitly enabled, text may be sent to an AI provider. Local controls stay local.

Botivao has no ERP connector. If connections are added later, access keys are stored encrypted (AES-256-GCM) on the server — never readable in the browser.