Privacy Policy
Last updated: July 2026
What data we collect, why we collect it, and your rights.
1. Data We Collect
| Category | What | Why |
|---|---|---|
| Account | Email, organization name | Authentication, communication |
| Store data | Store name, address, zip code | Signal generation, action plans |
| Visitor fingerprint | Canvas hash (pseudonymized, no PII) | Personalization memory (Mem0) |
| Email hash | SHA-256 of visitor email (pseudonymized) | Cross-device personalization (opt-in) |
| Behavioral tags | Inferred interests (e.g. health-conscious, coffee-culture) | Banner selection, personalization |
| Operational | IP addresses, user agents | Rate limiting, audit logs (90-day retention) |
| Waitlist | Email address | Product updates (unsubscribe anytime) |
2. Data We Don't Collect
- No cookies
- No raw visitor emails (only SHA-256 hashes)
- No browsing history outside our platform
- No device identifiers beyond the canvas fingerprint
- No payment card data (handled by Stripe)
3. Data Processors
Third parties that process data on our behalf, all under Data Processing Agreements:
| Processor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication | Frankfurt (EU) |
| Vercel | Hosting, edge functions | US (SCCs) |
| Upstash | Rate limiting (Redis) | US (SCCs) |
| Mem0 | Personalization memory | US (SCCs) |
| Sentry | Error tracking | US (SCCs) |
| Langfuse | Observability, tracing | EU |
| Resend | Transactional email | US (SCCs) |
4. Your Rights
GDPR (EU/UK)
- Right to access: Export all your data via
GET /api/user/data-export - Right to erasure: Delete personalization memories via
DELETE /api/v1/persona/memory - Right to portability: Data export returns machine-readable JSON
- Right to rectification: Update your profile in Settings
CCPA (California)
- “Do Not Sell”: We do not sell personal information
- Right to opt-out: Unsubscribe from waitlist via the link in your confirmation email
- Right to know: Same as GDPR right to access
- Right to delete: Same as GDPR right to erasure
To exercise any right, contact privacy@busyfolder.com.
5. Retention Periods
| Data | Retention |
|---|---|
| Audit logs (IP addresses) | 90 days, then anonymized |
| Decision cache | 15 minutes |
| Mem0 memories | Until deletion request |
| Waitlist emails | Until unsubscribe |
| Account data | Until account deletion |
6. Contact
Privacy inquiries: privacy@busyfolder.com
General inquiries: hi@busyfolder.com