Privacy Policy

This policy explains how BusFactor handles personal data. Our contractual data-protection commitments are set out in the Data Processing Agreement, which controls in the event of any conflict with this policy.

Roles: who controls the data

Your organization (the "Customer") is the data controller and decides why and how its data is analyzed. BusFactor acts as the data processor, handling data only on the Customer's documented instructions. This policy also covers the limited account data we hold for the individuals who log in to use the product ("Authorized Users").

What we process

By default BusFactor analyzes communication metadata: the structure of collaboration, not its content:

• Directory data: name, title, department, work email.
• Communication metadata: sender, recipients, channel, timestamp, thread structure, and @-mentions. No message bodies unless you opt a source in.
• Optional documents you choose to provide (e.g., org charts, key-person lists) for ownership and structure.
• Authorized-User account data: sign-in identity and role, used to secure and operate your account.

We do not ask for customer records or special-category (sensitive) personal data, and you should not provide them.

BusFactor's analysis works on communication metadata. It never stores the text of a message or the contents of a file, and never sends either to an AI model, on any setting. A test checks this on every build. Where a platform returns message text alongside the metadata, the analysis reads it in memory only to compute yes-or-no signals, such as whether a message is a question, and drops it in the same step.

Content depth is your choice, per source. Each connected source carries the scope you agreed with us before it was connected. An administrator in your organization can enable deeper analysis on specific sources (for example, Confluence but not Slack). Switching on deeper analysis for a source lets those checks read up to 500 characters of each message for the length of the run. That changes how well the checks work, not where the text goes. A file import that includes a chat export (a Slack export, for example) does contain message text: the uploaded file is held only while it is read, the text is read in memory for the same checks, and none of it is stored or sent to an AI model. Hybrid-broker deployments carry no message text at all.

Coding before analysis

Every name, email, and channel is replaced with a code (pseudonymized) before any analysis or AI processing. The re-identification mapping is used only to label the report we return to you, and is held separately under access controls.

How we use data & legal basis

We use the data to produce the knowledge-risk analysis you request, mapping collaboration, identifying single points of failure, and modeling departure or integration impact. Metadata is reduced to numerical metrics (for example, centrality, sole-responder rates, documentation coverage) that drive the Output. Processing relies on the Customer's legitimate interest in organizational continuity and risk management, not on employee consent. The Customer is responsible for notifying its staff and completing any works-council, DPIA, or similar steps required in its jurisdiction; a template notice is provided in the DPA. We do not use your data to train foundation models, and we do not use it for advertising.

AI processing

The pre-computed, coded metrics are sent to Anthropic's Claude for interpretation. Claude receives a structured object of statistics and ratios, for example soleResponderRate: 0.76, and never real identities. No message text is sent, including from sources you have enabled for deeper analysis: those produce more precise counts, and only the counts are sent. Anthropic does not train its models on data submitted through its API.

Deployment models & where data is processed

• Managed cloud: processed in our hosted environment using the subprocessors listed below.
• Hybrid broker: data is collected and reduced inside your environment; only coded metrics leave it.
• On-premise: the entire pipeline runs within your infrastructure; no data leaves it and no subprocessor receives it.
• File-import: you provide metadata exports, processed in an isolated workspace with no third-party subprocessor receiving your data.

Your Order specifies which model applies to you.

Subprocessors (managed-cloud only)

For the managed-cloud model, we use the following subprocessors, each bound by confidentiality and data-protection obligations:

• Anthropic: the analysis model (receives coded metrics only).
• Supabase: database and authentication.
• Vercel: application hosting.
• Stripe: billing (payment details go directly to Stripe; we do not store card data).
• Resend: transactional email (e.g., notifications and verification).

We will give notice of new subprocessors as provided in the DPA. For the on-premise and file-import models, no subprocessor receives your data.

Data sharing

We do not sell, rent, or trade your data. We share it only with the subprocessors above (managed-cloud only) to operate the Service, or where required by law, in which case we will give notice unless legally prohibited.

International transfers

Where personal data is transferred across borders in the managed-cloud model, we rely on appropriate safeguards such as the Standard Contractual Clauses. The on-premise and file-import models keep data within your chosen environment.

Retention & deletion

For a one-time assessment, Customer Data is deleted within 30 days of report delivery (or earlier on request), including backups, and a Certificate of Data Deletion is issued. For an ongoing subscription, data is retained for the term and deleted on termination. OAuth access tokens are stored encrypted and deleted immediately when you disconnect a source. Aggregated, de-identified statistics that do not identify you or any individual may be retained to operate and improve the Service.

Background analysis on connected sources. When an analysis runs in the background for a connected-source deployment, the communication metadata fetched for that run is held encrypted for the length of the run and at most 24 hours: a ceiling enforced by the database itself, not by application code, then deleted, whether the run completes, fails, or is abandoned. An hourly sweep removes any expired copy and verifies it is gone, and an expired copy is never analyzed. This is strictly less than a file-import deployment keeps, where your uploaded export is stored encrypted with no fixed end date. Sources you have opted into deeper content analysis are excluded from background runs entirely, so no message text is ever held this way.

Security

We apply technical and organizational measures appropriate to the data, including: encryption in transit (TLS) and encryption of stored access tokens; access controls on a least-privilege basis; processing in isolated, access-logged workspaces; and separation of the re-identification mapping from analysis data. No system is perfectly secure, but we design the pipeline to minimize the personal data exposed at every step.

Your rights

Individuals whose data is processed may have rights to access, correct, or delete their data, or to object to or restrict processing, depending on their jurisdiction. Because the Customer is the controller, these requests are directed to and handled by the Customer; we assist the Customer in responding as required by the DPA. As a Customer or Authorized User, you can at any time:

• Disconnect any data source (tokens are deleted immediately);
• Request a copy of the data we hold for you;
• Request deletion of your data;
• Adjust roles and permissions for your Authorized Users.

Cookies & sign-in

We use strictly necessary cookies to keep you signed in and to secure your session. We do not use advertising or cross-site tracking cookies.

Changes

We may update this policy and will note the effective date above. We will notify you of material changes by email or in-app.

Contact

For privacy questions or to exercise a right, email privacy@getbusfactor.com.