Your data deserves clarity.

Bienzoli is operated by VINCEDOTCODE LTD, registered in Mauritius under BRN/TAN C25220943 and ERN 04390814, with its address at Avenue des Pingos, Medine Camp de Masque, Medine, Mauritius. For privacy matters, contact vince@vincedotcode.com.

We are a data controller for account, security, support and service-administration data because we decide why and how that information is used.

When a business enters information about its customers, suppliers or staff into Bienzoli, that business is normally the controller and we act as its data processor. Our Data Processing Terms apply to that information.

Account and business information

Name, work email, encrypted authentication credentials, business name and type, account identifiers, service preferences and support messages.

Business records you add

Customer names and contact details, notes, products, barcodes, stock movements, invoices, sales, payment methods and payment references. Bienzoli does not process subscription-card details because the service is free.

Technical and marketing information

Essential session cookies, IP address and limited request, security and error logs produced by our hosting and authentication providers. On public marketing pages, Vercel Web Analytics records anonymous aggregate page views, referrer, country, device, browser and operating-system information without third-party cookies. Bienzoli removes query strings and excludes authenticated, invoice and account-recovery routes from this analytics feed. If a signup link contains campaign parameters, we store the source, campaign and link placement with the business workspace so we can understand which outreach produced an activated account. We do not use advertising cookies or sell personal data.

• Provide, authenticate, secure and support Bienzoli.
• Create the invoices, sales and stock records requested by users.
• Understand which public pages and outreach help businesses find and activate Bienzoli.
• Prevent abuse, diagnose failures and protect accounts.
• Meet legal obligations and respond to lawful requests.
• Communicate essential service and security information.

Our lawful grounds include performing our agreement with a user, complying with law and our legitimate interests in operating a secure service. Where consent is legally required, it can be withdrawn without affecting earlier lawful processing.

We share only what is necessary with service providers acting under contract: Supabase for authentication and the PostgreSQL database, Vercel for application hosting, delivery and anonymous public-page analytics, and Resend for transactional email. Product-code lookups send a barcode, not account or customer details, to public catalogue providers.

Where you choose to use an AI feature, we send the necessary content to OpenRouter, which routes it to a model provider. This happens only when you ask for it — when you photograph a product, and when a weekly summary is generated for your dashboard. Two limits apply and we hold ourselves to them: we route only to providers that do not retain or train on what we send, and we never send your customer records — no names, phone numbers or email addresses — to any AI provider. A product photo contains whatever you point the camera at. A weekly summary contains figures we have already calculated, plus your product names.

Some processing occurs outside Mauritius, including in Singapore and other infrastructure locations. We use contractual and technical safeguards and review our providers. Details are maintained in the provider register.

We keep active account and business records while the account is used. After a verified deletion request or account closure, we aim to remove active data within 30 days. Residual encrypted backups may remain for up to a further 30 days before expiry, unless law requires longer retention.

A business remains responsible for retaining or exporting invoices and accounting records for any period required by Mauritian tax, company or other law.

Subject to the Data Protection Act 2017, you may request access, a copy, correction, erasure or restriction of your personal data, and may object to certain processing or withdraw consent. You may also ask about recipients, retention and overseas safeguards.

Send a request from your registered email to vince@vincedotcode.com. We may ask for information to verify identity and will respond without excessive delay, normally within 30 days.

We use HTTPS, restricted server credentials, tenant-scoped application access, database access controls, dependency monitoring and security headers. No online system can promise absolute security; users must protect passwords and devices and tell us promptly about suspected misuse.

Bienzoli uses cookies and similar storage only where required for sign-in, session continuity and security. Public-page analytics is aggregated by Vercel without third-party cookies, and Bienzoli does not send authenticated routes, invoice links, query strings or form values to it. We use no advertising pixels, cross-site tracking or behavioural advertising profiles.

Email our data-protection contact at vince@vincedotcode.com. You also have the right to complain to the Mauritius Data Protection Office.

We may update this notice as Bienzoli changes. Material changes will be communicated through the service or by email, and the updated date will appear above.