Privacy Policy
Last updated 27 September 2026
This policy explains what personal data Beviso processes when you visit our website or use the Beviso platform, why we process it, and the rights you have. Beviso is built and operated from Berlin, Germany.
Who is responsible
Beviso is the controller for personal data processed on our website and for account data of people who sign up. You can reach us at contact@beviso.app.
For the data our customers bring into the platform — for example employee records or evidence collected from connected tools — the customer is the controller and Beviso acts as their processor under our Data Processing Agreement.
What we collect
- Account data: your name, email address, organisation and role, provided when you sign up or are invited.
- Platform content: controls, policies, risks, vendors, uploaded evidence and questionnaire answers you add.
- Integration data: information read from the tools your organisation connects, such as user lists, device inventories and security findings.
- Usage data: pages visited and features used, collected through product analytics.
- Support conversations: messages you send us through chat or email.
Why we use it and on what legal basis
- To provide the platform and support you — performance of our contract with you (Art. 6(1)(b) GDPR).
- To send service emails such as invitations and security notices — performance of contract.
- To understand how the product is used and improve it — our legitimate interest in improving Beviso (Art. 6(1)(f) GDPR).
- To meet legal obligations such as tax and accounting — legal obligation (Art. 6(1)(c) GDPR).
We do not sell personal data, and we do not use customer content to train AI models.
Who we share it with
We use the following service providers (sub-processors). Each is bound by a data processing agreement. Where a provider processes data outside the European Economic Area, the transfer is protected by the EU Standard Contractual Clauses or an adequacy decision.
| Provider | Purpose |
|---|---|
| Vercel Inc. | Application hosting, file storage, background jobs and AI model routing |
| MongoDB, Inc. | Database hosting |
| Resend | Transactional email, such as invitations and notifications |
| PostHog, Inc. | Product analytics (EU instance) |
| Crisp IM SAS | Support chat |
| Anthropic, PBC | Drafting suggested answers to security questionnaires, when you use that feature |
How long we keep it
We keep account and platform data for as long as your account is active. When an organisation closes its account, we delete its data within 30 days, unless we must keep specific records longer to meet legal obligations.
Your rights
- Access the personal data we hold about you (Art. 15)
- Have inaccurate data corrected (Art. 16)
- Have your data erased (Art. 17)
- Restrict or object to processing (Arts. 18 and 21)
- Receive your data in a portable format (Art. 20)
To exercise any of these rights, email contact@beviso.app. You can also complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Changes
We will update this page when our processing changes and notify customers of material changes by email.