How BusyVault handles your data

Overview

BusyVault is team chat for work. It has workspaces, channels, chat, files, tickets, and automations. We use personal data to run the service, keep accounts safe, and follow the law.

This policy applies to people who use busyvault.com/app. BusyVault runs in the browser and can be installed from Chrome or Edge on Windows, macOS and Linux. The Android app is on Google Play and uses the same account. The iPhone and iPad app is coming soon. Enterprise customers can run BusyVault on their own servers under a separate contract. BusyVault encrypts messages, voice notes, files sent in conversations, tickets, tasks, checklists, notes and scheduled messages with Aegis-128L before storage. The hosted service decrypts them to run chat, search, previews and notifications. Files opened through a public share link are not protected that way, so someone without an account can open them. A self-hosted setup may have its own terms. Contact contact@busyvault.com for on-premise terms.

Data controller

The data controller for the BusyVault cloud service is KLIENCIDLAFIRM.PL sp. z o.o., ul. Szczęsna 26, 02-454 Warsaw, Poland, KRS 0001045371, NIP 5223263785. Contact: contact@busyvault.com.

Privacy questions: contact@busyvault.com. For GDPR-specific requests and RODO procedures, see also our GDPR / RODO page.

Data we collect

Categories depend on how you use BusyVault. We collect only what is needed to run the service.

• Account data: email, display name, user ID, password hash, workspace roles.
• Chat content: messages, files, voice notes, channel details, checklists, tasks, and notes you send.
• Billing data: plan, purchase IDs, and billing records. Stripe bills web plans. Google Play bills purchases in the Android app. We do not store full card numbers.
• Technical data: IP address, device and browser type, session IDs, security and audit logs.
• Push alerts: device push tokens (FCM/APNs) tied to your account when you turn alerts on.
• Choices: language, theme, and alert settings stored on your account or in the browser.

We do not sell personal data to other firms for their ads.

Purposes & legal bases

Under GDPR, we rely on the following bases (see our RODO page for detail).

• Contract performance (Art. 6(1)(b)): providing BusyVault, account management, support, billing.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, service improvement, aggregated analytics.
• Legal obligation (Art. 6(1)(c)): tax, accounting, and regulatory requirements where applicable.
• Consent (Art. 6(1)(a)): optional marketing communications and non-essential cookies where required.

Storage & EEA residency

Cloud data is stored in infrastructure designed for European customers.

Primary cloud storage and processing for BusyVault SaaS is hosted in the European Economic Area (EEA) or with providers that offer EU/EEA data residency. File objects may be stored via Cloudflare R2 in EEA regions. Enterprise customers can deploy entirely on their own infrastructure.

Cookies & similar tech

We use cookies and local storage for essential functionality and preferences.

• Strictly necessary: session authentication, CSRF protection, load balancing.
• Functional: language preference, theme (light/dark), dismissed UI notices.
• Analytics (if enabled): aggregated usage metrics to improve reliability — no cross-site ad tracking.

You can control non-essential cookies via browser settings. Blocking essential cookies may prevent login.

Subprocessors

Trusted providers process data on our behalf under contractual safeguards.

• Stripe — subscription billing and payment processing.
• Apple — The iPhone and iPad app is coming soon, so Apple does not bill BusyVault plans yet. Google Play bills purchases in the Android app.
• Cloudflare R2 — object storage for files and attachments (EEA regions).
• Email delivery — transactional email (verification, password reset, billing notices).
• Firebase Cloud Messaging / Apple Push Notification service — mobile push delivery.
• Hosting providers — application servers and databases in the EEA.

A current subprocessor list is available on request. Material changes are communicated to workspace owners where required.

Retention

We keep data only as long as needed for the purposes above.

• Active accounts: account and workspace content retained while your subscription or Free trial is active.
• Free trial: if you do not upgrade within 3 days, Free accounts and associated data are automatically deleted.
• After cancellation: data is deleted or anonymized within a reasonable technical window, subject to backups and legal holds.
• Security logs: typically up to 90 days, longer if needed for incident investigation or legal claims.
• Billing records: retained as required by tax and accounting law (often 5–7 years in Poland/EU context).

Your rights

Depending on your location, you may have rights to access, correct, delete, or export your data.

EU/EEA users have rights under GDPR including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with your supervisory authority (in Poland: UODO — uodo.gov.pl).

To exercise rights, email contact@busyvault.com or follow the process on GDPR / RODO. We respond within statutory timeframes (typically 30 days).

Security

We apply industry-standard measures to protect your data.

• Encryption in transit: TLS 1.3, HSTS on public endpoints.
• Encryption at rest: provider-level encryption for databases and object storage.
• Access controls: role-based permissions at workspace and channel level.
• Monitoring: security logging, abuse detection, and incident response procedures.

Changes

We may update this policy to reflect product or legal changes. Material updates are announced in the app or by email. The current version is always at busyvault.com/privacy.html.

Contact

Privacy: contact@busyvault.com
General support: contact@busyvault.com · Support page