Privacy Policy

1. Dictionary:

1.1. Data Controller - DBB Software Sp. z o.o. with its registered office in Cracow (address: aleja Powstania Warszawskiego 15, 31-539 Cracow, Poland) listed in the register of entrepreneurs of the National Court Register (KRS) under KRS number 0000926192, REGON 520168317, NIP 6772469438, tel. +15592380003 (US) and +447915980003 (UK), email: in@dbbsoftware.com.

1.2. Personal Data - information about a natural person, already identified or identifiable through one or several specific factors determining physical, physiological, genetic, psychological, economic, cultural, or social identity, including image, voice record, contact details, localization data, information included in correspondence, and information gathered with recording or other similar technology.

1.3. Policy – this Policy of processing private data.

1.4. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

1.5. Data Subject - a natural person to whom personal data processed by the Administrator applies, e.g., a person who uses the Administrator’s services or who sends inquiries to them via email.

2. Processing of Personal Data by Data Controller:

2.1. The Data Controller, due to running economic activity, gathers and processes Personal Data in accordance with relevant legal regulations, including GDPR, and follows the principles outlined in these regulations.

2.2. The Data Controller:

2.3. While processing data, the Data Controller ensures its safety and confidentiality and provides data subjects access to information about the processing. If, despite security measures, a personal data protection breach occurs (e.g., “data leak” or loss), and such a breach could pose a high risk of violating legal or individual rights, the Data Controller will inform affected data subjects in accordance with legal regulations.

3. Contact with Data Controller and Data Protection Officer:

3.1. Contact with the Data Controller is possible via email: in@dbbsoftware.com or by mail at: DBB Software Sp. z o.o., al. Powstania Warszawskiego 15, 31-539 Cracow.

3.2. The Data Controller is not required to appoint a Data Protection Officer but has conducted an analysis on this matter.

4. Personal Data Safety:

4.1. To ensure data integrity and confidentiality, the Data Controller has implemented procedures that allow access to personal data only for authorized individuals and only to the extent necessary for their tasks. The Data Controller employs organizational and technical solutions to ensure all operations on personal data are logged and performed only by authorized individuals.

4.2. The Data Controller takes all necessary measures to ensure subcontractors and other cooperating entities also implement appropriate security measures when processing personal data on behalf of the Data Controller.

4.3. The Data Controller conducts regular risk assessments and monitors the adequacy of data protection measures. If necessary, additional security measures are implemented.

5. Purposes and Legal Grounds for Data Processing:

6. Data Recipients:

7. Data Transmission Outside the EEA:

Personal data is transferred outside the European Economic Area (EEA) only when necessary and with appropriate protection measures. Data subjects are informed at the time of data collection. Where a recipient is located outside the EEA, we rely on an adequacy decision of the European Commission - including, where the recipient is certified under it, the EU-US Data Privacy Framework - or on Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where these are required.

8. Data Retention Period:

The data retention period depends on the nature of the service and the purpose of processing. If processing is based on legitimate interest, data is retained until the interest is fulfilled or an objection is raised. If based on consent, data is processed until consent is revoked.

Where you have consented to receive marketing communications, we process your contact details for that purpose until you withdraw your consent. We separately retain a record that consent was given, and of any withdrawal, for as long as we need it to demonstrate compliance under Article 7(1) of GDPR and for the period during which related claims may be brought.

9. Data Subject Rights:

Data subjects have the right to:

10. Requesting Data Subject Rights Execution:

Requests can be submitted via:

Responses are provided within one month. If additional information is needed for identification, processing may be delayed.

11. Changes to the Privacy Policy:

This Policy is regularly reviewed and updated as needed. The current version has been in force since November 2, 2026.

12. AI Assistant Integrations (ChatGPT App, Claude Connector, MCP):

12.1. DBB Software offers integrations that let AI assistants interact with our services: the "DBBS Project Scope Generator" (available to MCP-compatible assistants at https://dbbsoftware.com/mcp/scope and, once approved, as a plugin in the OpenAI Plugins Directory for ChatGPT and Codex and as a connector in the Claude Connectors Directory) and a read-only content connector (available to MCP-compatible assistants at https://dbbsoftware.com/.well-known/mcp and, once approved, in the Claude Connectors Directory). This section describes what data these integrations process; subsections 12.2 to 12.6 also cover the same Scope Generator on our website, on its tool pages and in our website chat. No account is created and no authentication is required to use either integration.

12.2. Scope Generator - data we collect: the project description you provide in order to generate a Scope Document, with the industry and type of project if you give them; in our website chat, also the stage, team, timeline and budget of your project if you mention them; on our website, the page you request the document from and how you reached our site (the campaign tags in the link you followed and the website that sent you); and - only if you choose to have the finished document emailed to you - your name and email address, collected with your explicit consent at the delivery step. We do not collect your conversation history with ChatGPT, Claude or any other external assistant. A document you request in our website chat is also drafted from your recent messages in that chat.

12.3. Scope Generator - purposes: generating your Scope Document; delivering it to the email address you provide, as a secure download link; for a document emailed through ChatGPT, Claude or another AI assistant connected at https://dbbsoftware.com/mcp/scope, a possible one-time email from our sales team about your project, which is disclosed at the point of collection; and, on our website, only if you tick the optional box when you request the document, up to two follow-up emails about it and the DBB Software insights newsletter. An internal notification to our sales team is part of handling each request.

12.4. Scope Generator - recipients and processors: Vercel (hosting, file storage and the AI Gateway); Upstash (encrypted storage of generation requests, job records, documents and scheduled follow-up emails); the AI model providers that process your project description (currently Anthropic and OpenAI, which draft and check the document, through the Vercel AI Gateway, and Google, which writes the preview on our generator page and answers you in our website chat, through Google AI Studio); Langfuse (monitoring of these AI calls, which records the project description and the generated text); Sentry (error monitoring); our email delivery provider; Mailchimp (our newsletter service, only if you tick the optional box on our website: your name and email address, a tag for the box and the time you ticked it); and Slack (internal sales notification). These providers process data on our behalf, in line with Section 6 of this Policy. Three public services also receive data derived from your description, but not the contact details you give us for delivery: Kroki and mermaid.ink receive the source of the document's diagrams, and Wikidata's lookup service receives the industry and a few keywords taken from the description (and, for a document requested in our website chat, from your recent messages there). These can include names or other details you wrote in the description or the chat.

12.5. Scope Generator - retention: a request waiting to be generated, with its project description, is held in encrypted storage for up to 6 hours and deleted once the document is made. A generated document that is not emailed is held, with its job record, for about 1 hour; once a document is emailed, the document, its job record and its download link are kept for about 7 days so the link keeps working. Documents requested on our website or through ChatGPT, Claude or another AI assistant connected at dbbsoftware.com/mcp/scope are also kept as a private copy for 90 days, so we can review what the generator produced, investigate errors and improve it, and are then deleted automatically. Copies of documents generated before 3 November 2026 are kept in a separate store for the same purposes; we delete them on request at in@dbbsoftware.com. On our website, a preview is held for up to 24 hours (a preview you share stays viewable through its link for 7 days), and a request also updates your visitor profile, which is kept for 90 days after its last update. If you tick the optional box, the follow-up emails scheduled for you are kept until they are sent, for at most 30 days, and so is the excerpt of your document the second one quotes, which is deleted once the second is sent or skipped; a record of the documents you download is kept for 30 days after the last download. Your newsletter subscription lasts until you unsubscribe or ask us to remove it. If you unsubscribe from the follow-ups, we keep that choice for a year, stored as a hash of your address. Langfuse keeps the project description and the generated text of each AI call for up to 30 days. Email correspondence is retained as described in Section 8 of this Policy.

12.6. Scope Generator - your controls: on our website, you can ask our AI assistant to delete your data. If it holds data for the address you give, it emails that address a link, and once you confirm, it deletes your visitor profile, scheduled follow-ups, the Scope Documents requested on our website and their private copies, and the chat the request came from. It does not remove the address from our mailing list or delete copies of documents generated before 3 November 2026: write to in@dbbsoftware.com to have those removed. If you used the Scope Generator through ChatGPT, Claude or another AI assistant connected at dbbsoftware.com/mcp/scope, the assistant there cannot delete your documents: write to in@dbbsoftware.com and we will delete them. You can also exercise your rights under Sections 9-10 of this Policy via in@dbbsoftware.com. Each follow-up email you get after ticking the optional box on our website includes an unsubscribe link and supports your email app's one-click unsubscribe. The service is not directed at children under 13. You can also ask our AI assistant to email you a copy of the data it holds for your address.

12.7. Content connector: the read-only connector at https://dbbsoftware.com/.well-known/mcp lets AI assistants such as Claude retrieve our published website content (services, case studies, insights, client reviews). It collects no personal data: no name, email address, or conversation content is stored. Search queries sent to the connector are processed only to return matching published content and are not linked to your identity. Standard short-lived technical logs (IP-based rate limiting and error logs) apply as described in Section 4 of this Policy.