Privacy policy

1. Who we are

Buyerbase is operated by Bogdan Alexandru Demeter, Amsterdam, the Netherlands, trading as Buyerbase. Registration of the operating company with the Dutch Chamber of Commerce (KVK) is in progress; the registration number will be added here once it is issued. For anything about this policy write to hello@buyerbase.app.

2. This website

Visiting buyerbase.app creates the usual server logs (IP address, user agent, requested page, time) kept by our hosting provider for security and abuse prevention. We use PostHog in cookieless mode for aggregate analytics: no cookies, no cross-site identifiers, and events carry no names or email addresses. See the cookie notice.

The contact page embeds a cal.com booking calendar. When you book, cal.com processes the details you enter under its own privacy policy; we receive the booking (name, email, chosen time) to run the demo.

3. The lead and contact forms

When you submit the contact form or a demo request we store your name, agency, email address and message, the time of submission and a salted hash of your IP address used only for rate limiting. The legal basis is our legitimate interest in answering your request (Art. 6(1)(f) GDPR) and, once you become a customer, the contract with your agency.

Leads that do not lead to a conversation are deleted after 12 months.

4. Inside the product

Agencies use Buyerbase to manage their buyers. For that data the agency is the controller and Buyerbase is the processor: we process buyer names, contact details, search criteria, documents, viewings and activity only on the instructions of the agency, under a data processing agreement.

The data processing agreement forms part of the agreement with each agency. It is published in full and a countersigned copy is available on request from hello@buyerbase.app. Buyers who use the portal can direct questions about their data to their agency; we help the agency answer them.

For agency staff accounts (owners, admins, agents) Buyerbase is the controller of the account data: name, email, role, login events and audit entries kept for security.

5. Where data lives and who processes it

Production data is stored in the EU. The processors below help us run the service; each is bound by a processor agreement and, where data leaves the EU, by standard contractual clauses.

6. Retention

• Agency and buyer data: for the life of the subscription, then deleted 30 days after cancellation unless the agency exports first.
• Audit log entries: 24 months.
• Error reports: 90 days.
• Analytics: aggregated, without personal identifiers.

7. Your rights

You can ask for access, correction, deletion, restriction, portability or object to processing by writing to hello@buyerbase.app. If you are a buyer using the portal of an agency, that agency is the first point of contact. You can complain to the Autoriteit Persoonsgegevens.

8. Security

Data is encrypted in transit and at rest, access is scoped per agency with row-level security, staff access is logged, and document links expire. Report a vulnerability to hello@buyerbase.app.

9. Changes

We update this page when the service or the processors change and note the date at the top.