Privacy policy

1. Who we are

BGrowth is an AI layer that routes each ad impression to the best ad partner. The BGrowth website, dashboard, routing tag and APIs are operated by BGROWTH EOOD, a single-member limited liability company registered in Bulgaria.

This policy explains how we collect, use and protect personal data when you visit our website, use our dashboard, contact us or apply for a job, and how our routing service handles the data of visitors to our customers’ websites.

Data controller

BGROWTH EOOD · UIC 208174485

93 Ekzarh Yosif Str., Oborishte District, Ground Floor, 1000 Sofia, Bulgaria

privacy@bgrowth.ai

When our routing service runs on a publisher’s website, the publisher decides why and how its visitors’ data is processed. In that case the publisher is the controller and BGrowth acts as its processor, under a data processing agreement.

2. Data we collect

Website visitors

Technical data: browser type, operating system, pages visited and referring page.
Approximate location derived from a truncated IP address.
Cookie data, as described in our cookie policy.

Business contacts and customers

Identity and contact details: name, work email, company, job title, website.
Account data: login email, role, password hash, workspace settings.
Billing details, contracts, support conversations and messages you send us.
Usage logs of the dashboard and APIs, kept for security and support.

Routing service on publishers’ websites

For each ad request, the routing tag reads contextual signals only: country or region, device type, operating system, browser, page URL, ad format and placement, time of day and a session depth counter.

The IP address is used in memory to derive the country, then discarded. The routing service does not set cookies, does not read device advertising identifiers and does not build profiles of individual visitors.

Job applicants

Your CV, contact details and any information you choose to share during the hiring process.

3. How we use data

Provide, maintain and secure the website, the dashboard and the routing service.
Route ad impressions and report performance to the publishers who use BGrowth.
Answer your requests, run demos and provide customer support.
Manage contracts, invoicing and payments.
Improve our models and products with aggregated data that does not identify anyone.
Send product news to customers, with an unsubscribe link in every email.
Run our recruitment processes.
Comply with our legal and tax obligations.

4. Legal bases

Under Article 6(1) of the General Data Protection Regulation (GDPR), we rely on the following legal bases:

Purpose	Legal basis
Providing the service to customers, invoicing	Performance of a contract, Art. 6(1)(b)
Answering requests, demos, B2B prospecting	Legitimate interests, Art. 6(1)(f)
Security, fraud and invalid traffic prevention	Legitimate interests, Art. 6(1)(f)
Website analytics and non-essential cookies	Consent, Art. 6(1)(a)
Accounting and tax records	Legal obligation, Art. 6(1)(c)
Recruitment	Steps prior to a contract, and consent to keep your application longer

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time, as explained in section 8.

We never sell personal data. We share it only with:

Service providers acting on our instructions: hosting in the European Union, email delivery, customer support and CRM tools, payment processors. They are bound by data processing agreements.
Ad partners chosen by the publisher: when an impression is routed, the selected partner receives the ad request from the visitor’s browser, as it would without BGrowth. Each partner is responsible for its own processing.
Authorities, when the law requires it.
A buyer or successor, in case of a merger or acquisition, under the same protections.

6. International transfers

Our data is primarily hosted in the European Union (Frankfurt, Germany). When a provider processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the Standard Contractual Clauses adopted by the Commission, with additional safeguards where needed.

7. Retention

Data	Retention
Contact and demo requests	24 months after our last exchange
Customer account data	Duration of the contract, then 5 years for legal claims
Invoices and accounting records	As required by Bulgarian accounting law, up to 10 years
Routing request logs	30 days, then only aggregated statistics
Job applications	6 months after the process, longer only with your consent
Website analytics	13 months maximum

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and receive a copy;
correct inaccurate or incomplete data;
ask us to delete your data;
restrict or object to its processing, including for direct marketing;
receive your data in a portable format;
withdraw your consent at any time, without affecting earlier processing.

To exercise these rights, write to privacy@bgrowth.ai. We answer within one month. If you are a visitor of a publisher using BGrowth, you can also contact that publisher directly.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg, or with the data protection authority of your country.

9. Security

We protect personal data with technical and organizational measures adapted to the risks:

encryption in transit (TLS 1.2 or higher) and at rest;
access on a need-to-know basis, with multi-factor authentication;
logging and monitoring of access to production systems;
regular security reviews and penetration tests;
a documented incident response process, including notification of the authority within 72 hours where required.

10. Contact

For any question about this policy or your data, contact our privacy team:

Privacy team