Privacy Policy

Effective date: 2 April 2026

1. Who We Are

Deep Dive BV, Ruddershovestraat 9, 9620 Zottegem, Belgium, VAT BE1009966374, is the controller responsible for processing your personal data under this policy. Contact: via the support widget.

2. What Data We Collect

We collect only the data needed to operate the Service:

• Full name and email address (account registration)
• Company name, VAT number, and billing address (required for B2B onboarding)
• Inventory and product data you upload (product names, quantities, expiry dates)
• Alert rule configurations and notification preferences
• Subscription and billing information
• Support communications submitted via the support widget
• Any information you provide when booking a meeting via Microsoft Bookings

Technical data (e.g. IP address, session identifiers) may be collected for security and platform performance purposes. Our CDN and security edge (Cloudflare, when used for DNS, proxying, or bot protection such as Turnstile) may process connection metadata as part of delivering the site; this application does not inject a separate Cloudflare Web Analytics beacon.

Inventory and product data uploaded to the Service generally does not constitute personal data unless it contains identifiable information relating to an individual.

3. Legal Basis for Processing

We process your data on the following legal bases (GDPR Article 6):

• Performance of a contract (Art. 6(1)(b)): processing required to deliver the subscription service you signed up for, including account management, notification delivery, and billing.
• Legal obligation (Art. 6(1)(c)): compliance with Belgian accounting and tax law, including invoice retention for 7 years.
• Legitimate interest (Art. 6(1)(f)): improving platform performance, ensuring security, and preventing abuse.
• Consent (Art. 6(1)(a)): optional analytics cookies only (Microsoft Clarity). Consent can be withdrawn at any time via Cookie settings in the footer.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Data Sharing and Sub-Processors

We use the following third-party services that may process data on our behalf:

• Supabase — database infrastructure, authentication, and transactional email delivery (EU region; Standard Contractual Clauses apply for any US data transfers)
• Microsoft — Bookings (meeting scheduling) and hosting services
• Microsoft Clarity — website analytics, only activated after explicit consent via the cookie banner
• Cloudflare — CDN, security, and optional bot protection (e.g. Turnstile); may process connection and security metadata
• Zoho Desk — support widget; processes data submitted through support requests

All sub-processors are bound by data processing agreements that require them to process data only on our instructions and in accordance with applicable data protection law.

Consent for analytics cookies can be given or withdrawn at any time via the “Cookie settings” link in the website footer. See the Cookie Policy for details.

5. International Data Transfers

Some sub-processors may process data outside the European Economic Area (EEA). Where this occurs, we ensure an adequate level of protection through the EU Standard Contractual Clauses (SCCs) as adopted by the European Commission, or through an adequacy decision applicable to the destination country.

6. Data Retention

• Account and profile data: retained for the duration of your subscription plus 12 months after termination, unless you request earlier deletion.
• Inventory and alert data: deleted within 30 days of account termination or upon request.
• Support communications: retained for 2 years.
• Billing records and invoices: retained for 7 years (legal obligation under Belgian accounting law).
• Analytics data: aggregated and anonymous; no individual retention period applies.

7. Your Rights

Under the GDPR, you have the following rights:

• Access your personal data (Art. 15)
• Correct inaccurate data (Art. 16)
• Request deletion (“right to be forgotten”) (Art. 17)
• Restrict processing in certain circumstances (Art. 18)
• Data portability — receive your data in a structured, machine-readable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, submit a request via the support widget. Requests are handled within 30 days (extendable to 90 days for complex requests, with notice).

You also have the right to lodge a complaint with the Belgian supervisory authority:
Gegevensbeschermingsautoriteit (GBA)
Drukpersstraat 35, 1000 Brussels — www.gegevensbeschermingsautoriteit.be

8. Security

Appropriate technical and organisational measures are in place to protect your data against unauthorised access, accidental loss, or destruction. These include encrypted connections (TLS), access controls, and regular security reviews.

9. Updates

This policy may be updated from time to time. Material changes will be communicated by email or via an in-platform notice. The latest version is always available on this page. Continued use of the Service after notification of changes constitutes acceptance.