Privacy policy

1. Controller

Buzz Dealer (Cyprus) Ltd, registration HE440718, Agias Filaxeos 122A, Limassol 3087, Cyprus, is the controller of the personal data described here. Contact: [email protected]. We have not appointed a data protection officer, as the law does not require one for our activities. Privacy questions go to [email protected].

2. Data we collect

• Account data: name, email address, sign-in details (email link or Google sign-in), the account and brands you manage.
• Billing data: billing name, address, VAT number and payment records. Card details go to Stripe; we do not receive card numbers.
• Order data: what you order, the content and contact details you submit for publication, approvals and reports.
• Connection data: connected agents and API keys (stored as hashes), and which agent did what.
• Technical data: IP address, request logs and security logs.
• Usage statistics: events such as "a scan was started", recorded in our own database. We use no cookies and no third-party trackers for them.
• Analytics data on our public website, buzzdealer.ai: pages visited, how you arrived, device and browser type, and approximate location, collected through Google Analytics as described in section 7.

Reputation Agent data

The Reputation Agent checks only the person who is signed in, and only a company whose website domain that person's account has verified. For them we keep:

• the profile: name, roles, organizations, awards, talks, links, how you want to be described, topics, namesakes you tell us about, profession, SelfBadge handle and Wikidata ID;
• the results: what search engines, AI tools, news, review sites and company and professional profiles show for that name;
• your answers to our questions, the gaps, the fixes and your progress.

The results are collected by our own internal data service, run by the same company, Buzz Dealer (Cyprus) Ltd, which is the one controller of this data. It uses outside data providers in these categories: search data, AI engines, news, review sites, company and professional profile data.

Other people who appear in results

Results about you or your company can name other people, for example someone with the same name, or a company's founders and staff. We keep what the results show only inside your own results, to tell you how you are described. We never build a profile of those people, and we never show you a negative item about someone else.

We do not contact these people, and we could not reasonably identify or reach them. Telling each of them would take disproportionate effort, so, as Article 14(5)(b) of the GDPR allows, we describe this processing here instead.

Public Radar scans

Until 13 October 2026, anyone could run the Radar on our website. For those scans we stored the name typed, whether it was a person or a brand, the details given so we knew which person was meant (or a brand's domain and category), and the results. Each scan is deleted 24 hours after it was made, unless the person scanned created an account and kept it as their own. Scans now need a signed-in account.

Sensitive watch terms

These are words you ask us to watch for in results about your own name, for example words about health, religion or criminal matters. We use them only with your explicit consent, and only about yourself.

• They are encrypted.
• Only you can see them in the dashboard.
• They never appear in reports, exports, emails, logs or anything shared.
• When one appears, we tell you that a watched term appeared, never which.

You can delete them at any time, which withdraws your consent.

Pro: review watch and competitors

• Review watch: we read new public reviews of your own company every 6 hours, and keep the review text for 12 months, visible only to you. We do not keep reviewers' names.
• Competitors: we show you the public search results and ratings of up to 3 competitors you name. We never contact them and never publish anything about them.

3. Why we use it, and the legal basis

• To provide the service and fulfil orders (contract).
• To take payments, issue invoices and keep accounting records (legal obligation).
• To check content and keep the service secure (legitimate interests).
• To send service emails such as sign-in links, approvals, order updates and low balance notices (contract).
• Marketing emails: only if you agree to receive them (consent). You can unsubscribe at any time from any marketing email.
• To run the Reputation Agent for your own name or your verified company (contract).
• To keep data about other people that appears in your results, only inside your results (legitimate interests).
• To read and keep public reviews of your company, and to show your competitors' public results and ratings, on Pro (legitimate interests).
• To watch the sensitive terms you choose for your own name (your explicit consent, which you can withdraw by deleting them).
• To keep usage statistics in our own database, without cookies, so we can improve the service (legitimate interests).
• To understand how visitors use our public website, through Google Analytics: in the European Union, the European Economic Area, the United Kingdom and Switzerland, and when we cannot tell your country, only after you accept analytics cookies (consent); elsewhere, legitimate interests. Everyone can turn it off through "Cookie settings" in the footer.

4. Who processes it for us

The Reputation Agent's data providers are listed by category in section 2. Content you submit for publication is shared with the outlets and wire services that publish it. Some processors may handle data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, where the processor is certified) or by the European Commission's standard contractual clauses.

5. How long we keep it

• Order records and invoices: for the period Cyprus tax and accounting law requires, currently 6 years after the end of the tax year.
• Account data: while the account is open, then up to 12 months after it is closed, except what we must keep as accounting records.
• Submitted content: while the item is published and for the life of the order record. Content for items that were never published is deleted 12 months after the item failed or was refused.
• Logs: up to 90 days, longer only when needed to investigate a security incident.
• Usage statistics in our own database: 14 months.
• Analytics data: 14 months in Google Analytics.
• Reputation Agent results: while the profile exists, then deleted 12 months after it is closed or the account is closed.
• Reviews read by review watch (Pro): 12 months.
• Staff test scans: 7 days.
• Sensitive watch terms: until you delete them, or when the profile is closed (deleted at once).
• Public Radar scans made before 13 October 2026: 24 hours, unless kept by the person scanned as their own.

6. Your rights

Under the GDPR you can ask us to:

• give you access to your personal data;
• correct it;
• delete it;
• give it to you in a portable format;
• stop using it, where you object to our use based on legitimate interests.

Write to [email protected]. We answer within one month. For complex or many requests, we may extend this by up to two more months and will tell you why within the first month. You can also complain to the Commissioner for Personal Data Protection in Cyprus.

7. Cookies

We use a cookie to keep you signed in to the dashboard. It is needed for the service to work, so it does not need consent.

On our public website, buzzdealer.ai, we use Google Analytics cookies (named _ga and _ga_ followed by an id) to understand how visitors use the site. If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, or we cannot tell your country, we set them only if you click Accept in the cookie banner; until then Google Analytics runs in a consent mode that stores no cookies. Elsewhere, Google Analytics runs by default, on the basis of our legitimate interests. Wherever you are, you can turn it off at any time through "Cookie settings" in the footer.

We do not use advertising cookies. Analytics is never used in the dashboard, the API or the connector.

8. Security

Data is sent over HTTPS. API keys and access tokens are stored as hashes. Access to production systems and data is limited to the people who need it for their work. We monitor the service for misuse, and if a personal data breach happens we notify the Commissioner and affected people when the law requires.

9. Changes

We publish changes on this page with a new date. For significant changes, we also email account holders before the change takes effect.

10. Contact

Buzz Dealer (Cyprus) Ltd, Agias Filaxeos 122A, Limassol 3087, Cyprus. [email protected]