Privacy Policy

Bivorra operates www.bivorra.com, the Bivorra business apps on the web, and the Bivorra Android app (com.bivorra.app). This policy explains what data we hold, why, and what you can do about it. Questions go to [email protected].

• Account data. Your name, email address, mobile number, and username. Your password is stored only as a bcrypt hash; we never store it in plain text. When you register, we email you a one-time code to confirm your address.
• Business data. What your organisation enters into the apps: customers, suppliers, invoices, bills, products, stock, payments, employees, attendance, photos, and similar records. Your organisation is the controller of this data. Bivorra processes it on the organisation's behalf, only to run the service.
• Usage and security logs. Which app each user opened on which day, with a count, and the last date each app was used. We use this for billing and to improve the apps. Activity and audit logs record important actions in the apps and can include the IP address of the request.
• Location. Only where your organisation uses attendance check-in or field visits, the web app asks your browser for your location at that moment. The Android app does not request location permission.

When you sign in, we set an httpOnly session cookie (scripts on the page cannot read it). It keeps you signed in and is removed when you sign out or the session times out. Administrators who switch into another account for support get a second cookie of the same kind. We do not use advertising cookies.

Our public marketing pages on www.bivorra.com use Google Analytics to count visits, which sets Google Analytics cookies. Google Analytics is not loaded inside the signed-in business apps.

The Android app opens Bivorra in a secure in-app browser and asks for these permissions:

• Camera, to scan barcodes at the till and to take photos you choose to attach (for example product images, order photos, or expense receipts). Photos are uploaded only when you save them.
• Bluetooth (connect to paired devices), to print receipts on a Bluetooth printer you have already paired. The app does not scan for nearby devices and does not use your location.
• Internet, to reach Bivorra.

On the phone, the app stores only your chosen printer (its name, address, and paper width) and your sign-in cookie. Receipts are sent straight to the printer. The app uses Google Play to check for app updates.

• To provide the apps, sign you in, and keep each organisation's data separate.
• To bill your organisation for the apps its users have access to.
• To send service emails, such as sign-up codes and emails the apps send for you.
• To keep the service secure, investigate problems, and give support.

We do not sell your data and we do not show ads.

Bivorra runs on our own servers behind Cloudflare. All traffic is encrypted in transit with HTTPS. Passwords are hashed. Each organisation's data is isolated from every other organisation, and access inside an organisation is limited by roles and permissions. We keep backups and a disaster-recovery copy so the service can be restored after a failure.

We share data only with service providers we need to run Bivorra, and only for that purpose:

• Cloudflare, which carries traffic to our servers.
• An email delivery provider, to send emails.
• A file storage provider, for some uploaded images and attachments.
• Payment processors, when your organisation pays for a subscription or takes payments online.
• Google, for Google Analytics on the marketing pages and Google Play updates in the Android app.

We also disclose data when the law requires it.

We keep account data while your account is active. You can ask us to delete your account by emailing [email protected] from the email address on the account. Your organisation's admin can also remove your access. We respond within 30 days.

When we delete an account, we delete your login and personal profile. Business records your organisation must keep by law, such as invoices kept for tax, stay with the organisation for the period the law requires. Copies in backups are removed as those backups expire. See Delete your account for the steps.

You can ask us for a copy of your personal data, to correct it, or to delete it, by emailing [email protected]. For business data your organisation controls, we pass your request to your organisation or act on its instructions.

Bivorra is a business service and is not meant for anyone under 18. We do not knowingly collect data from children.

If we change this policy, we will post the new version on this page and update the effective date. If the change is significant, we will tell organisation admins by email.

Bivorra, www.bivorra.com. Email [email protected].