Privacy Policy

1. Scope

This Privacy Policy explains how Baalvion handles personal data when you visit baalvion.com, create or access a Baalvion account, or communicate with us. It applies to the corporate site and to the account and identity layer shared across Baalvion subdomains.

Independent brands in the portfolio may publish their own privacy notices for product-specific processing; where they do, those notices govern that product and this policy governs the corporate and identity surface.

2. Data we collect

We collect only what we need to operate the account and the site:

• Account data you provide — your first name, last name, and email address when you create an account or request a sign-in code.
• Authentication events — the time, approximate location (derived from IP), and device or browser of sign-in and verification requests, used to secure the account.
• Communications — messages you send to our support, security, privacy, or legal channels, and our replies.
• Technical data — IP address, browser type, and pages requested, processed in server logs to keep the service available and to detect abuse.
• Cookies strictly necessary for sign-in and security. See the Cookie Policy for detail.

3. What we do not do

• We do not store account passwords. Authentication is passwordless — access is granted through one-time codes sent to your verified email.
• We do not sell personal data.
• We do not send unsolicited bulk email or marketing email to addresses that have not opted in.
• We do not use your data to build advertising profiles or to track you across unrelated third-party sites.

4. How we use data

• To create and authenticate your account and keep you signed in across Baalvion properties.
• To send transactional email — verification codes, sign-in notifications, security alerts, password/account-recovery messages, and service notices. See the Email Communications page for the full list.
• To respond to your support, security, legal, and privacy enquiries.
• To secure the platform: detect, investigate, and prevent fraud, abuse, and unauthorised access.
• To meet legal, accounting, and regulatory obligations.

5. Legal bases

Where the GDPR or equivalent law applies, we rely on: performance of a contract (operating your account); our legitimate interests (securing the platform and preventing abuse); your consent (any non-essential cookies or optional communications); and compliance with legal obligations.

6. Email and our service providers

Transactional email is delivered through reputable infrastructure providers, including Amazon Simple Email Service (Amazon SES) operated by Amazon Web Services. These providers process message metadata and delivery events strictly to send our mail and report on its delivery; they are bound by contract and do not use the content for their own purposes.

We share personal data with processors only under written agreements, only for the purposes described here, and only to the extent necessary.

7. International transfers

Baalvion operates across multiple jurisdictions. Where personal data is transferred across borders, we use recognised safeguards such as Standard Contractual Clauses and provider data-processing terms, and we apply tenant and data-residency isolation as part of the platform architecture.

8. Retention

We keep personal data only as long as necessary for the purpose it was collected, to meet legal obligations, or to resolve disputes. Account data persists while your account is active; authentication and delivery logs are retained for a limited period for security and then deleted or anonymised.

9. Your rights

Subject to applicable law, you may:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data.
• Object to or restrict certain processing.
• Request a portable copy of data you provided.
• Withdraw consent where processing is based on consent.

10. Security

We protect data with encryption in transit (TLS), passwordless authentication, signed sessions, tenant isolation, least-privilege access, and audit logging. No system is perfectly secure, but security is designed into the foundation rather than added afterward. See the Security page for more.

11. Children

Baalvion services are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes and contact

We may update this policy and will revise the effective date above. Material changes affecting your rights will be notified where appropriate.

For any privacy request or question, contact privacy@baalvion.com.