Privacy policy and cookies
bizbees.ai is run by BizBees AI sp. z o.o. This policy also covers bizbees.events, bizbees.finance and the BizBees Events and BizBees Finance demos, all run by BizBees Studio. This policy explains what data we collect through the contact form, consultation booking, private client area and visit statistics, why we do it, who processes it for us and what your rights are. This English version is a translation; the Polish version prevails.
Last updated: 30 October 2026
Who controls your data
The controller of your personal data is BizBees AI spółka z ograniczoną odpowiedzialnością, ul. Rajska 14/B, 32-086 Dziekanowice, Poland, KRS 0000868311, NIP 5130268413.
We have not appointed a data protection officer. For anything about your data, write to contact@bizbees.ai.
When we process data
bizbees.ai includes an information site and a private client area. We process your data only when you:
- send a message through the contact form,
- book a free consultation,
- confirm your attendance from the link in the reminder,
- open materials shared with you in the client area,
- visit the public site, unless you decline statistics in the cookie bar (see “Visit statistics (PostHog)”).
Independently of that, the hosting keeps technical logs; see “Hosting and security”.
Contact form
The form has these fields: name, e-mail, company (optional), topic, message and “How did you hear about us?” (optional). We use them to answer your inquiry and to prepare a proposal. We use your answer about the source, and the campaign parameters if you accept statistics, to assess our campaigns (see “Ads and where inquiries come from”).
Legal basis: Art. 6(1)(b) GDPR (steps at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling correspondence).
How it works: the site's server function stores the submission in our Supabase database (European Union region, Frankfurt) and sends two e-mails through Resend: a notification to our Google Workspace mailbox and an automatic confirmation to your address (at most one a day, with the topic and text of your message). Before storing it, we check a hidden bot-trap field, Vercel BotID protection and the number of submissions from one IP address; the IP address is kept for 10 minutes in the function's memory only.
Consultation booking and attendance confirmation
You book the free consultation in a window on our site. We collect your name, e-mail, chosen time, time zone and language, and optionally your company, topic, a note and your answer to “How did you hear about us?”. If you accept statistics, we also store the campaign parameters and the path of the page the booking came from (see “Ads and where inquiries come from”). We store the booking in our Supabase database (EU region, Frankfurt) and the meeting with a Google Meet link in our Google Calendar, which sends you the invitation. We e-mail the booking confirmation through Resend.
The day before the meeting we send a reminder with a personal link. Links in our e-mails let you confirm attendance, reschedule or cancel; every change needs a click on our page and updates the booking and the calendar. We e-mail you about every change.
Legal basis: Art. 6(1)(b) GDPR (organising the meeting you asked for).
Private client materials
When we invite you to a private proposal or project materials, we store your email address and permission to the entire project space and its pages. A person with access can use Share to invite other email addresses to that space. We record the recipient address and inviter identifier to handle the invitation and control access. Supabase Auth verifies control of your inbox using a code sent through Resend. We store materials and permissions in Supabase; knowing the link alone does not grant access.
We use essential session cookies, inaccessible to page scripts, to maintain access. Choosing to remember the browser keeps access for at most 30 days from verification. Otherwise the cookie lasts for the browser session and server access for at most 8 hours. Permission can expire sooner or be revoked. The private area does not load PostHog or session recording.
We limit login attempts using keyed hashes of email and IP addresses. We automatically delete login attempts and limit counters 24 hours after expiry, session records 7 days after expiry, and publication and revocation events after 90 days; deletion occurs in the next daily maintenance job. Retention of project materials is agreed as part of the engagement. We do not store access codes in our notification queue.
Client space opening statistics
When you open materials shared with you in the client space, we record the date of that opening and the document version against your e-mail address, the one you use to access the space. We already know that address; it's what verified your access. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing whether materials reached you, so we can follow up).
We do not record:
- your IP address,
- a browser fingerprint,
- how you read the document itself: scrolling, selections or time spent on the page.
We automatically delete individual opening records, meaning the date and the document version, after 90 days. The summary attached to your access to the space, meaning the date of the first and the last opening and the total number of days on which the materials were opened (several openings on the same day count as one day), has no separate deletion deadline and stays for as long as you have access to the space. We delete it on request, together with archiving the space.
The first time materials in a given space are opened, we may get an automatic e-mail notification with the space's title, your address and the opening date, without the document's content; we can turn this notification off for a chosen space. Send an objection to this processing to contact@bizbees.ai (see “Your rights” below).
Visit statistics (PostHog)
We collect visit statistics with PostHog (PostHog, Inc.; data stored in the European Union region, Frankfurt). How we collect them depends on your choice in the cookie bar.
- From your first visit, PostHog stores an identifier in your browser and records statistics, session recordings and heatmaps, until you choose “Decline”.
- “Accept” confirms this and also lets us store, with an inquiry, the campaign that brought you here.
- If you choose “Decline”, PostHog stops: we remove its data from your browser, and on later visits the script is not loaded.
What we record:
- the full address of the page you visit, including the parameters in it (campaign parameters, ad click identifiers); the data in booking management links is removed before an event leaves your browser,
- pages visited and sections viewed,
- clicks on buttons and links, and form events (sent, error) without the field contents,
- device and browser type, and an approximate location derived from the IP address,
- session recordings and heatmaps, that is cursor movement, scrolling and clicks; form field contents are masked; pages for managing a booking are not recorded.
The visitor identifier is stored in a cookie and in localStorage (ph_…_posthog) for up to 12 months. We do not pass PostHog data to advertising services or use it to target ads. We do not track you on other sites.
Legal basis: statistics, session recordings and heatmaps are based on our legitimate interest in knowing how visitors use the site and where they come from (Art. 6(1)(f) GDPR). You can object at any time by choosing “Decline” in the cookie bar or in “Cookie settings” in the footer.
Ads and where inquiries come from
When we advertise BizBees Studio on Meta (Facebook, Instagram) or in Google Search, the ad leads to this site. We do not install a Meta pixel or a Google advertising tag on the site, and we do not pass form or booking data to advertising services. A click on an ad is processed by the service where you see it, under its own rules.
The address in an ad or in one of our links may contain campaign parameters: utm_source, utm_medium, utm_campaign, utm_content and utm_term. They describe the campaign, for example the service, its name and the ad. We store your answer to “How did you hear about us?” with your inquiry, if you give one. If you accept statistics, when you send the form or book a consultation we also store these parameters with your inquiry, together with the path of the page the inquiry came from (the current page or the previous one on our site, for example /en/integrations-and-workflow-automation); we store none of this in your browser. We store them with your inquiry only if you accept statistics in the cookie bar.
We do not store the click identifiers that advertising services add to the address (gclid, fbclid) in our inquiry database. The full page address, including them, may be recorded in the hosting logs (see “Hosting and security”) and in PostHog statistics unless you decline them (see “Visit statistics (PostHog)”).
We use this data to see which campaigns and channels bring inquiries and to decide on the ad budget. Our reports use only aggregate numbers. Legal basis: we read the campaign parameters and the page path based on your consent to statistics (Article 399 of the Polish Electronic Communications Law), and we store them with your inquiry, together with your answer to “How did you hear about us?”, based on our legitimate interest in assessing our marketing (Art. 6(1)(f) GDPR). We keep this data together with the submission or booking. You can withdraw consent through “Cookie settings” in the footer and object as described in “Your rights”.
Hosting and security
The site and its server functions (contact form, booking, attendance confirmation, sending notifications) are hosted by Vercel, Inc. (USA); the functions run in the EU region (Frankfurt). The hosting keeps access logs: IP address, time and the requested address. We use them to keep the site secure and stable.
The form and the booking are protected by Vercel BotID, which checks technical signals in the browser to tell people from automated traffic. The functions also count requests from one IP address for a short time in the function's memory to limit abuse.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in the security of the service).
Who processes data for us
These service providers process data on our behalf:
| Provider | Role | Location of the company and the data |
|---|---|---|
| Supabase, Inc. | database of submissions, bookings and notifications; authentication and private client materials | USA; data in the EU region (Frankfurt) |
| Resend, Inc. | sending e-mails: confirmations, reminders, notifications, invitations and access codes | USA; sending from the EU region (Ireland) |
| Google (Google Ireland Ltd / Google LLC) | mailbox, calendar and Google Meet | Ireland / USA |
| PostHog, Inc. | visit statistics and session recordings (cookies) | USA; data in the EU region (Frankfurt) |
| Vercel, Inc. | hosting of the site and its server functions, bot protection (BotID) | USA; functions in the EU region (Frankfurt) |
Some providers are based in the USA. Transfers outside the European Economic Area rely on standard contractual clauses approved by the European Commission or on an adequacy decision (EU-US Data Privacy Framework), according to these providers' data processing agreements; details are in their privacy policies. We do not sell data and do not pass it to other parties unless the law requires it.
How long we keep data
- form submissions: 12 months from sending, bookings: 12 months from the meeting date, in both cases together with the source of the inquiry and the campaign parameters; then we delete them automatically, and if we start working together, we keep the correspondence for the term of the contract and the limitation period for claims,
- log of sent notifications (address, type of message, delivery status): 90 days; addresses that bounce or reported our messages as spam are kept for as long as needed to stop sending to them,
- analytics data: the cookie identifier for up to 12 months or until you choose “Decline”, events according to the retention settings of our PostHog project,
- hosting logs: according to Vercel's retention (a short technical period).
Your rights
You have the right to:
- access your data and receive a copy,
- rectify your data,
- erase your data,
- restrict processing,
- data portability,
- object to processing based on our legitimate interest,
- withdraw consent at any time.
Send requests to contact@bizbees.ai; we reply within a month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).
Providing data is voluntary. Without it we cannot answer your inquiry or arrange a meeting.
We do not make automated decisions about you and do not profile you within the meaning of the GDPR.
Changes to this policy
We may update this policy when our tools or the law change. The date of the last update is at the top of the page; we will announce material changes on the site.