Privacybeleid

Buzzlink is operated by:

We are the controller for the data of people who have a Buzzlink account, and for visitors to buzzlink.app itself.

When you book or pay on a business's Buzzlink page, that business decides what happens with your details — they are the controller and we only process the data on their behalf. Contact the business first; if you write to us instead, we'll pass it on and help them answer.

We don't sell your data, we don't share it with advertisers, and we don't use it to build profiles or to train AI models.

We use a small number of providers to run the service. They may only process the data to deliver their part of it, under a data processing agreement.

• Supabase — database, login and file storage — where your page, your services and your bookings live.
• Stripe — payments, subscriptions and payouts. Card details go straight to Stripe and never reach our servers.
• Resend — sends the emails about a booking — what your customer receives about their appointment, and what you receive about theirs.
• Vercel — hosting and delivery of the application.
• Anthropic — writes the first draft of your page text when you sign up. We send your business name and the design you chose — never customer data — and it isn't used to train models.

These are US companies, so some data is processed outside the EU/EEA. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. We also disclose data when the law requires it.

• Account and page content: for as long as you have an account. Deleting your account deletes it.
• Bookings and orders: kept while your account exists so you have your history. You can erase an individual customer's details at any time from Settings → Customer data requests, and everything goes when the account is deleted.
• Payment records: Stripe keeps the transaction records it needs for accounting and anti-money-laundering rules — typically seven years — even after you leave.
• Email delivery logs: kept for a short period by Resend so we can see whether a confirmation arrived.
• Usage counts and QR scans: while your account exists. They contain no personal identifiers.
• Backups: overwritten on a rolling basis within 30 days of a deletion.

You can access, correct, erase, restrict, object to and port your data. Two of those are self-service, right now, in Settings: download everything in your account as a single file, and delete your account permanently. Deleting the account cancels any active subscription first and removes your page, services, bookings, orders and uploads.

For anything else, email hello@buzzlink.app — we answer within 30 days. Where processing rests on legitimate interest you can object to it, and where it rests on consent you can withdraw it at any time.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se), or to the supervisory authority where you live.

We use no advertising cookies, no cross-site tracking and no third-party analytics. What is actually set:

• Login cookies (sb-…): set by Supabase after you sign in, to keep you signed in. Strictly necessary.
• Language cookie (NEXT_LOCALE): remembers the language you picked.
• Stripe cookies (__stripe_mid, __stripe_sid): set by Stripe's payment script on pages where a payment or booking can be made, and in the checkout. Stripe uses them to detect fraud — they are necessary for the payment, not for advertising. __stripe_mid lasts about a year, __stripe_sid about half an hour. See stripe.com/privacy.
• Embedded content on a business page: if a business adds a video or a map to their page, YouTube or Google Maps loads it and may set their own cookies. That happens under Google's policy, not ours.

Traffic runs over HTTPS. Every account's data is separated at the database level so one account can never read another's bookings. Passwords are stored hashed by Supabase, card details are handled by Stripe, and access to production data is limited to the people who need it. If a breach affects you, we'll tell you without undue delay.

Buzzlink is a tool for businesses and isn't directed at children. You need to be 18 to have an account.

If we change how we handle data, we update this page and the date at the top, and we email you about anything significant. The Terms of Service also contain the data processing agreement that applies when we process your customers' data for you.

Questions about this policy, or want to exercise a right? Email hello@buzzlink.app — a person reads it.