Privacy Policy

This Privacy Policy explains how Buyer Mode AI ("we", "us") collects, uses, discloses, and safeguards your information when you visit our website, use our dashboard, or interact with the embedded copilot widget on a customer's website.

1. Who we are

Buyer Mode AI is an independent multi-tenant SaaS that lets businesses ("Customers") embed an AI copilot on their websites. We are the data controller for Customer account data, billing data, and website visitor data we collect on our own site. For end-user visitors of a Customer's website, the Customer is the data controller and we act as their data processor.

2. Data we collect

• Account data (Customers): email, name, workspace name, hashed password or OAuth identifier.
• Knowledge base content (Customers): documents, URLs, and text uploaded to train the copilot.
• Conversation data (Visitors): messages typed or transcribed from voice, copilot responses, and (if voluntarily provided) name, email, and meeting requests.
• Usage events: timestamps, message counts, token counts, model used, IP address (truncated, kept for up to 30 days for abuse prevention and rate limiting).
• Cookies: only strictly necessary cookies for authentication and session security. See our Cookie Policy.

3. Legal bases (GDPR Art. 6)

• Contract — to provide the service to Customers.
• Legitimate interests — security, fraud prevention, service improvement.
• Consent — for optional features such as voice input.
• Legal obligation — tax, accounting, lawful requests.

4. How we use data

To operate and secure the service, generate AI responses, send transactional emails, bill Customers, and comply with the law. We do not sell personal data, and we do not use Customer content to train third-party foundation models.

5. Subprocessors

• Lovable Cloud (Supabase) — managed database, auth, storage. EU/US regions.
• Lovable AI Gateway — large language model inference.
• Paddle.com Market Ltd — our Merchant of Record: sale of the product, subscription management, payments, invoicing, and sales tax/VAT compliance.
• Cloudflare — edge hosting and DDoS protection.

We also share data with professional advisers (legal, accounting) and with authorities where required by law.

6. Direct marketing and business prospecting

Buyer Mode AI may process limited professional contact data for business-to-business prospecting: name, employer, work role, work email, company location and size, website-fit signals, source, campaign engagement, and suppression status.

Sources may include the recipient themselves, public company websites and business directories, and contracted B2B data providers. We do not use scraped LinkedIn data, private contact details, special-category data, or personal-life data for prospecting.

United Kingdom. For incorporated corporate subscribers only, relevant B2B outreach may rely on legitimate interests, after a documented purpose, necessity, and balancing assessment. Sole traders, ordinary partnerships, individual subscribers, and uncertain subscriber types require consent or a valid soft opt-in.

Ireland. Unsolicited electronic marketing to prospective customers requires affirmative consent. We rely on the existing-customer exception only when all applicable Irish ePrivacy conditions are satisfied, including a completed sale, marketing of Buyer Mode AI's own similar services, an opt-out offered when the details were collected and in every message, and the applicable 12-month timing rule.

If the jurisdiction or subscriber type is uncertain, we apply the stricter rule and do not send until appropriate evidence exists.

Where we collect data indirectly, we provide privacy information by the first communication or within one month, whichever is earlier.

Every marketing message identifies Buyer Mode AI, explains the business relevance and the source of the data, links to this privacy notice, and offers a simple, free opt-out.

You may object to direct marketing at any time by replying "no thanks", using an unsubscribe link, submitting our Data Subject Request form, or emailing support@buyermode.ai. Objections are applied across our connected marketing systems.

Unengaged prospect records are retained for no more than 90 days unless a documented need justifies a fresh review. Consent and campaign-compliance evidence is retained as long as needed to demonstrate compliance. A minimal suppression record may be retained for as long as necessary solely to honour the objection.

Automated eligibility and suppression checks assist campaign administration, but we do not permit solely automated decisions that produce legal or similarly significant effects in this prospecting process.

We review this direct-marketing policy before material channel or source changes and at least every six months.

7. Retention

• Conversations: 90 days by default; Customers can shorten or delete on request.
• Data no longer needed for these purposes is deleted or irreversibly anonymised.
• Usage events: 12 months.
• Account data: until account deletion + 30 days backup window.
• IP addresses: 30 days, then aggregated.

8. Your rights

EEA, UK, Swiss, and California residents have rights to access, correct, delete, port, restrict, or object to processing of their personal data. Submit a request via our Data Subject Request form or email support@buyermode.ai. We respond within 30 days.

9. International transfers

Where data leaves the EEA/UK, we rely on Standard Contractual Clauses and supplementary safeguards with our subprocessors.

10. Security

Encryption in transit (TLS 1.2+) and at rest, per-tenant row-level isolation, hashed API keys, least-privilege access. See our Security overview.

11. Children

The service is not directed to children under 16, and we do not knowingly collect their data.

12. Changes

We will post material changes here and, where required, notify Customers by email.

13. Contact

Buyer Mode AI — Privacy team — support@buyermode.ai.