Privacy policy

Last updated: 25/10/2026

How we handle personal data in Bistrova.

Controller

Milena Yanes Cangas (Bistrova), Rue de Venise 19, 1050 Ixelles (Bruxelles), Belgique. Contact: hello@bistrova.app.

Data we process

Account data: name, email, phone, job role, language and password (stored encrypted).

Business and billing data: name, address, VAT number, plan and subscription status. Card details are handled directly by Stripe; we never see them.

Data entered by the business: products, suppliers, recipes, sales, expenses and team data (name, encrypted PIN, hours and pay if it uses that part). For this data the business is the controller and we are the processor (see the terms of use).

Technical data: IP address and login attempts, for security; alerts and devices with notifications turned on, if the person turns them on.

Purposes and legal bases

Providing the service and managing the subscription (performance of the contract).

Protecting accounts and preventing abuse (legitimate interest).

Invoicing and meeting accounting and tax obligations (legal obligation).

Sending emails the service needs: welcome, password reset, billing notices and alerts the business turns on. No marketing without consent.

Who we share data with

MochaHost: hosting of the application and databases.

Stripe Payments Europe Ltd.: payments, invoices and VAT calculation.

On the bistrova.app website and only if you accept: Google Ireland Ltd. (Google Analytics, visit statistics) and tawk.to Inc. (live chat, with the messages you write in it).

If you write to us to become a sales agent, we keep your name, email, phone, city and message to reply to you and, if we work together, to pay your commissions.

Browser push services (Apple, Google, Mozilla, Microsoft) only relay the encrypted alert to the device the person turned on.

We do not sell data. If a provider processes data outside the European Economic Area, it does so with appropriate safeguards, such as the European Commission’s standard contractual clauses.

How long

While the account is active. When the subscription ends, it is kept for 90 days longer and then deleted, except invoices and data that Belgian accounting and tax law require us to keep for the legal period.

Security logs are kept for at most 12 months.

Your rights

You can ask for access, correction, deletion, restriction, portability or object to processing by writing to hello@bistrova.app. We reply within one month.

You can also lodge a complaint with the Belgian Data Protection Authority (www.dataprotectionauthority.be).

Security

Encrypted connection (HTTPS), encrypted passwords and PINs, encrypted sensitive data, protection against repeated login attempts, two-step verification for the Bistrova team and a log of important actions.