Privacy policy

Privacy policyLast updated: 19 October 2026Byna takes the protection of your personal data seriously. This privacy policy explains which data we collect, why we collect it, how we protect it and what rights you have. This policy applies to all users and visitors of the Byna platform.1. Data controllerByna is offered by Byna IT (sole proprietorship), established at Walborg 2A, 1082 AM Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 94203431, VAT ID NL003708448B92, reachable via info@byna.io. Byna IT is the data controller for the data of visitors and account holders. Each business owner (user) who creates an account is themselves the data controller for the data they enter about their own contacts; for that data Byna acts as a data processor on behalf of these users.2. Data we collectWe collect and process the following categories of personal data:Account dataName, email address, password (encrypted), company details (name, address, KVK number, BTW number), bank account details and company logo.Contact dataName, email address, phone number, address, company name, VAT number and KVK number of contacts entered by users.Booking dataName, email address and IP address of people who book appointments via public booking pages.Form submission dataName, email address, IP address, browser information (user agent) and uploaded files from people who submit public forms.Driving school dataStudent details, lesson locations (GPS coordinates), exam results and attendance records.Financial dataInvoice amounts, payment methods, subscription payments and transaction details processed via Stripe.Contract dataParty details, contract content, digital signatures and IP addresses at the time of signing.Communication dataEmail addresses, subjects and preview text of emails sent through the platform.Technical dataIP addresses, browser information (user agent), login events and activity logs for security purposes.AI featuresMessages you send to the AI assistant and documents you upload to the document scanner. Documents are processed on our own secure servers by default; when the cloud engine is used, our AI provider (Anthropic) processes the full document in order to extract its data. Assistant messages are processed by Scaleway within the EU, with Anthropic as a fallback when Scaleway is unavailable. In chat messages we mask personal data where possible before they reach an AI provider.3. Legal basisWe process personal data on the following legal bases under the GDPR:

Performance of a contract — to provide and maintain your Byna account and the services you use.

Legal obligation — to comply with tax and accounting regulations.

Legitimate interest — to ensure the security of the platform, prevent fraud and improve our services.

Consent — when you voluntarily provide data through public forms or booking pages.

4. Third partiesWe share personal data with the following third parties, only to the extent necessary:

Stripe Payments Europe, Ltd. (Ireland): processes the payment of your Byna subscription. If you activate online payments for your invoices, Byna also creates a payment account for you at Stripe. The verification data you provide during that setup (such as name, date of birth, address, KvK number, bank account and, where required, an identity document) is entered directly with Stripe. Stripe processes this data as an independent data controller for its own legal obligations, such as customer identification, as described in the Stripe privacy policy (stripe.com/privacy). Payments from your clients are processed on your own payment account and paid out directly to your own bank account; Byna never holds these funds.

Mollie B.V. (Amsterdam) processes online payments when an account owner connects their own Mollie account. Mollie receives the payment amount, the reference and the payer details needed for the payment.

Our email provider: sends emails such as invoices, quotes, reminders and login codes on our behalf and receives the recipient's email address and the message content for that purpose.

Scaleway SAS (France): processes messages sent to the AI assistant in Scaleway's data centres in the Paris region (EU). The AI model runs entirely on Scaleway's own servers, so no data goes to the developer of the model. By default Scaleway does not store prompts or answers (zero data retention) and does not use them to train AI models. Only on suspected misuse or a server error may Scaleway keep a request for up to 2 weeks, with personal data in it replaced by placeholders where possible. The data stays within the EEA.

Anthropic (United States): processes text and documents for AI features such as the document scanner, and serves as a fallback for the AI assistant when Scaleway is unavailable. Your data is not used to train AI models. This transfer outside the EEA is covered by the European Commission's Standard Contractual Clauses.

Google Ireland Limited: only when you activate the Google Calendar connection yourself. See the chapter on the Google Calendar integration below.

We do not sell personal data to third parties. All third-party processors are bound by data processing agreements. The application, the database and your files are hosted on Byna's own servers within the EU/EEA; our document processing server (scanner and OCR) is also self-managed.5. Google Calendar integrationByna offers an optional two-way synchronisation with Google Calendar. This integration is only active if you choose to connect your Google account in your agenda settings. If you never connect Google Calendar, none of the data below is accessed.Data we access from GoogleWhen you connect your Google account, we request access to the following through the Google Calendar API:

Your Google Calendar events, including their title, description, date and time, location, recurrence and reminders. We use the "calendar.events" scope, which does not give us access to your calendar settings or sharing permissions.

The email address of the connected Google account (via the openid and email scopes), shown in your settings so you can see which account is linked.

How we use this dataGoogle Calendar data is used solely to keep your agenda and your Google Calendar in sync: events you create in Byna are sent to Google, and events from Google appear in your Byna agenda, according to the sync direction you choose. We do not use this data for advertising, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models.How we store this dataYour Google access and refresh tokens are stored encrypted and are never shared with third parties or shown to other users. Synchronised events are stored in your agenda. When you disconnect Google Calendar in your settings, we revoke the access at Google and delete the stored tokens; synchronisation then stops.Limited Use disclosureByna uses and transfers information received from Google APIs in accordance with the Google API Services User Data Policy, including the Limited Use requirements.Revoking accessYou can revoke access at any time by disconnecting Google Calendar in your agenda settings, or via your Google Account permissions.6. Retention periodsWe retain personal data for as long as necessary for the purposes for which it was collected:

Data type	Retention period
Account data	Until 30 days after account deletion
Financial data (invoices, payments)	7 years (Dutch tax obligation)
Activity and security logs	6 months
Booking data	Until the user deletes the booking
Form submissions	Until the user deletes the submission

7. SecurityWe take appropriate technical and organisational measures to protect your data, including encryption of passwords and sensitive data, two-factor authentication, trusted device management, CSRF protection, rate limiting and periodic review of our security measures.8. Your rightsUnder the GDPR you have the following rights:

Right of access: you can request a copy of the personal data we hold about you.

Right to rectification: you can request correction of inaccurate data.

Right to erasure: you can request deletion of your personal data.

Right to restriction: you can request limitation of the processing of your data.

Right to data portability: you can request to receive your data in a structured, machine-readable format.

Right to object: you can object to the processing of your data based on legitimate interest.

Right to withdraw consent: where processing is based on your consent, you can withdraw that consent at any time.

You can export your data and delete your account yourself via Settings, privacy in the application. For other requests, please contact us using the details below; we will respond within 30 days.You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) if you believe we process your personal data incorrectly.9. ChangesWe may update this privacy policy from time to time, for example when we add new features or change how we process data. The most current version is always available on this page. In case of significant changes, we will inform you via the application.10. ContactDo you have questions about this privacy policy or about how Byna handles your data? Please contact Byna IT via info@byna.io.