Privacy Policy

Version: 1.5

Table of Contents

1. Security Measures
2. Information We Collect
3. Local Edition Purchase and Licence Data
4. Legal Bases for Processing
5. Third-Party Services
6. User Type Tailored Settings
7. International Data Transfers
8. Your Privacy Rights
9. Data Retention
10. Contact Information
11. Data Controller Information
12. Supervisory Authority and Complaints

1. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: HTTPS encryption for data transmission to protect data in transit
• Access Controls: Role-based access controls and authentication systems with session management
• Infrastructure Security: Secure cloud hosting with enterprise-grade data protection safeguards

While we use industry-standard security practices, no method of transmission over the internet or electronic storage is 100% secure. We are committed to protecting your personal data and implementing security measures appropriate for our service.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide to us, including:

• Account Information: Name, email address, password when you create an account
• Payment Information: Billing details processed through Stripe (we do not store payment card details)
• Content: Chat messages, process map diagrams, and other content you create using our service
• Communications: Messages you send to our support team or feedback you provide

2.2 Information We Collect Automatically

We automatically collect certain information when you use our service:

• Usage Data: How you interact with our service, features used, time spent
• Technical Data: IP address, browser type, device information, operating system
• Performance Data: Error logs, page load times, API response times
• Referral Data: Partner referral codes (including legacy affiliate codes) and marketing campaign attribution data

2.3 Local Edition Purchase and Licence Data

When you buy or activate Local Edition, we process the purchaser and named licensee's name and email, organisation name where relevant, seat assignments, billing address and tax identifiers, order and payment status, licence identifiers, activation status, and support history. We also process a one-way hashed device fingerprint so a licence can be limited to its permitted machine without receiving the underlying Windows, macOS, or installation identifier.

Process maps and local app data remain on the device unless you deliberately export or share them. If you configure a cloud or network AI engine in Local Edition, prompts and the content needed to answer them are sent to the endpoint you selected under that provider's terms; they are not routed through BA Copilot merely because you use the desktop app.

3. Legal Bases for Processing

Under GDPR, we process your personal data based on the following legal bases:

3.1 Necessary for Service Delivery (Article 6(1)(b))

Processing necessary for the performance of our contract with you or to take steps at your request prior to entering into a contract:

• Account creation and authentication
• Providing the AI process map generation service
• Payment processing and billing
• Customer support and service communications
• Analytics for registered users (required for service optimization and contract performance)

3.2 Legitimate Interest (Article 6(1)(f))

Processing necessary for our legitimate interests, where these interests are not overridden by your fundamental rights:

• Analytics for guest users: Understanding how our service is used to improve functionality and user experience
• Partner referral tracking: Managing our Consultant Partner Program (and the legacy affiliate program for existing referrers) and ensuring proper commission payments to partners
• Security and abuse prevention: Protecting our service through authentication controls and monitoring for malicious activity

3.3 Consent (Article 6(1)(a))

Processing based on your explicit consent, which you can withdraw at any time:

• Marketing analytics (Google Analytics when used for marketing attribution)
• Advertising tracking (Google Ads conversion tracking, Reddit Pixel)
• Marketing communications and promotional content

4. Third-Party Services

We work with the following third-party services to provide and improve our service:

4.1 Analytics Services

4.2 Marketing and Advertising Services

4.3 Partner and Referral Services

4.4 Cloud Infrastructure Providers

4.5 Local Edition Licensing and Fulfilment

4.6 Payment Processors

4.7 AI Content Processing

5. User Type Tailored Settings

We provide customized privacy settings based on your relationship with our service:

5.1 Guest Users (Unregistered Visitors)

5.2 Registered Users (Account Holders)

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). We ensure appropriate safeguards are in place:

6.1 EU-US Data Privacy Framework

Google services (Analytics, Ads) are covered by the EU-US Data Privacy Framework, providing adequate protection for data transfers to the United States.

6.2 Standard Contractual Clauses

For non-EU service providers (Stripe, PostHog, Supabase production, Reddit Pixel), we use Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection.

6.3 Service Hosting

Our production services are hosted in the United States with appropriate data protection safeguards including encryption, access controls, and contractual protections.

7. Your Privacy Rights

Under GDPR, you have the following rights regarding your personal data:

7.1 Right of Access (Article 15)

You can request a copy of the personal data we hold about you, including information about how we process it.

How to exercise: Email us at support@ba-copilot.com with "Data Access Request" in the subject line.

7.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

How to exercise: Update your account settings or contact support@ba-copilot.com.

7.3 Right to Erasure (Article 17)

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the original purpose.

How to exercise: Delete your account through settings or contact support@ba-copilot.com.

7.4 Right to Data Portability (Article 20)

You can request your personal data in a structured, machine-readable format to transfer to another service.

How to exercise: Email support@ba-copilot.com with "Data Portability Request" in the subject line.

7.6 Right to Withdraw Consent

You can withdraw consent for marketing tracking at any time without affecting other services.

How to exercise: Use our privacy preferences banner or account settings.

7.7 Response Timeframes

We will respond to your privacy rights requests within one month of receiving your request. In complex cases, we may extend this by an additional two months with explanation.

8. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected:

8.1 Account Data

• Active Accounts: Retained while your account is active and for 3 years after account deletion
• Deleted Accounts: Most data deleted within 30 days, with some records retained for legal compliance

8.2 Payment Data

• Billing Records: Retained for 7 years for tax and accounting purposes
• Payment Details: Not stored by us (handled directly by Stripe)

8.3 Support Communications

Support tickets and communications retained for 3 years for quality assurance and legal compliance.

8.4 Local Edition Licence Records

Order, invoice, tax, licence ownership, seat-assignment, activation, refund, and revocation records are kept for as long as needed to provide the perpetual licence, prevent duplicate launch-price purchases, meet legal and accounting obligations, and handle support or disputes. Raw payment card details are retained by Stripe, not BA Copilot.

9. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes:

• We will update the effective date at the top of this policy
• We will provide notice of any material changes through our website or via email

10. Contact Information

If you have any questions about this privacy policy or how we handle your personal data, please contact us:

For formal complaints about our data processing, you also have the right to lodge a complaint with your local data protection authority.

11. Data Controller Information

The data controller responsible for your personal data is:

12. Supervisory Authority and Complaints

You have the right to lodge a complaint with the relevant supervisory authority if you believe we have not handled your personal data in accordance with data protection laws.

For UK Residents

For EU Residents

EU residents can contact their local data protection authority. You can find your local authority at: European Data Protection Board - Members