Privacy Policy

Last updated: November 5, 2026

Business Diver is operated by ResourceHub Cph (CVR DK46200462), a Danish enkeltmandsvirksomhed (sole proprietorship) based in Copenhagen, Denmark. This privacy policy explains what data we collect, why we collect it, and how we protect it.

1. Data We Collect

Account data

When you create an account, we collect:

• Email address - used for authentication, account recovery, and service communications.
• Password hash - if you sign up with email and password, your password is hashed using bcrypt before storage. We never store your plain-text password.
• OAuth reference - if you sign up with Google, we store a reference to your Google account. We do not receive or store your Google password.
• Display name - optional, set by you in your account settings.
• Plan - the plan your account is on (Free; paid plans are not available yet).

Automatically collected data

Our web server automatically logs standard access data including IP addresses, request timestamps, and HTTP methods. These logs are used for security monitoring, debugging, and abuse prevention. Server logs are retained for a limited period and are not linked to your user account.

Report history

When you generate a research report, your browser keeps it in its own storage (localStorage), together with the company name, the AI provider used, the research mode (fast or deep) and a timestamp, so you can reopen it on that device. Up to 20 reports are kept, one per company. They are not stored on our servers and do not sync between devices; clearing your browser's site data for businessdiver.com removes them. Reports can name people who hold public roles in the researched company; see section 5.

What we do NOT collect

We do NOT store your API keys. If you use Bring Your Own Key (BYOK) mode, your API key is stored exclusively in your browser's localStorage. It is sent to our backend only during active research requests, held in memory for the duration of one API call, and then discarded. It is never logged, written to disk, or stored in any database. Read our full security details.

2. Legal Basis for Processing

We process your personal data on the basis of contractual necessity (GDPR Art. 6(1)(b)). The data we collect is necessary to provide the Business Diver service: authenticating your account and enforcing usage limits.

For the information about third parties that appears inside reports (section 5), we rely on legitimate interests (GDPR Art. 6(1)(f)).

3. Data Processors and Sub-processors

We use the following third-party services to operate Business Diver. Each processes data on our behalf under their respective data processing agreements:

• Supabase Inc. - Authentication and database hosting. Stores account data. Based in the US. Your data is hosted in the EU (Ireland, eu-west-1). DPA
• Google LLC - OAuth authentication (Google Sign-In), which receives your Google account reference during login, and Google Analytics 4 (section 7).
• Vercel Inc. - Website hosting. Serves businessdiver.com, including the public sample reports, and provides the aggregate analytics described in section 7. Based in the US.
• Railway Corp. - Backend hosting. Our research engine runs on Railway servers. Research data passes through Railway infrastructure during processing.
• Plausible Insights OÜ - Cookieless website analytics (section 7). Based in Estonia; visitor data is processed and stored in the EU.
• AI providers (Google LLC, OpenAI, Anthropic PBC) - the provider you choose receives the collected research text and the prompt, under your own agreement with that provider.

4. Data Retention

Your data is retained for as long as your account is active. When you delete your account, your account and profile are deleted. Your report history is kept only in your browser (section 1) and stays there until you clear it.

Public sample reports are not linked to any account and are not affected by account deletion. They are reviewed at least every six months and corrected on request (section 5).

5. People Who Appear in Our Reports

Our reports describe companies. In doing so they can mention people who hold public roles in those companies, such as founders, executives and board members. If you are one of those people, this section is for you.

What we process

Your name, your role, and facts about your professional activity that appear in public sources, such as company websites, official registries, stock-exchange announcements and press coverage. We do not deliberately collect information about your private life, health, beliefs or any other special category of data.

Where it comes from

Publicly accessible sources, gathered automatically when a report is requested: web pages such as company websites, press releases and news coverage, collected by our crawler BusinessDiverBot (see businessdiver.com/bot); official registries and exchange feeds; and the results of search tools.

Why we are allowed to

We rely on legitimate interests (GDPR Article 6(1)(f)): our users' interest in researching companies they may work with, sell to, or invest in, and our interest in providing that service. We have assessed that, for information about your public professional role, these interests are not overridden by your rights and interests. You can ask us for a summary of that assessment.

Who sees it

The user who requested the report; the AI provider that user chose (Google LLC, OpenAI or Anthropic PBC); our hosting providers (Supabase in the EU, Railway); and, for the sample reports published on this website, anyone who visits them. Some of these providers are in the United States and process data under the EU-US Data Privacy Framework or standard contractual clauses.

How long

A report stays in the history kept in the requesting user's own browser until they clear it; we do not store a copy on our servers. Public sample reports are reviewed at least every six months and corrected on request. We keep no copy of the raw web pages.

Accuracy

AI-written text can be wrong. If a report says something inaccurate about you, tell us and we will correct it, usually within a few days and always within one month. We cannot change copies that users have already downloaded or saved in their own browser.

We cannot contact every person named in a report individually, because reports are created on demand from public sources that do not give us contact details. This notice is how we inform you, as GDPR Article 14(5)(b) allows.

6. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right to access (Art. 15) - You can export the account data we hold about you as a JSON file from your account page.
• Right to erasure (Art. 17) - You can delete your account at any time from your account page. This deletes your account and profile.
• Right to data portability (Art. 20) - The JSON export provides your data in a structured, machine-readable format that you can take to another service.
• Right to rectification (Art. 16) - You can ask us to correct inaccurate information about you, including information about you inside a report (section 5). You can update your profile information (display name, email) from your account page.
• Right to object (Art. 21) - You can object to processing based on our legitimate interests, including information about you in our reports (section 5).

To exercise any of these rights, use the controls on your account page, contact us at info@businessdiver.com, or use our privacy request page.

7. Cookies and Local Storage

Authentication cookies

We use authentication cookies issued by Supabase to maintain your login session. These are strictly necessary for the service to function and do not require consent under the ePrivacy Directive. They contain no tracking data and are used solely to verify that you are logged in.

Analytics

We use Vercel Analytics and Speed Insights for aggregate performance monitoring, and Plausible Analytics, which sets no cookies, to count visits. We also use Google Analytics 4 (GA4) in Google's consent mode: GA4 sets its cookies only after you accept them in our cookie banner, and until then it sends Google measurements without cookies. We run no advertising: no advertising pixels, no advertising cookies and no cross-site tracking.

Local storage

If you use BYOK mode, your API key is stored in your browser's localStorage with a 24-hour auto-expiry. This data never leaves your browser except during active research requests. You can clear it at any time using the "Delete Key" button in the research tool or by clearing your browser storage. Your report history (section 1) is also kept in localStorage; it never leaves your browser and stays until you clear it.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• HTTPS-only transmission (HSTS enforced)
• Content Security Policy headers on all pages
• Row Level Security on all database tables (users can only access their own data)
• Passwords hashed with bcrypt
• API keys scrubbed from all error messages
• Rate limits on every research, key-check and account request

For more details, see our security page.

9. International Data Transfers

Some of our data processors (Supabase, Google, Vercel, Railway) are based in the United States. Transfers to the US are covered by the EU-US Data Privacy Framework or Standard Contractual Clauses as applicable. By using Business Diver, you acknowledge that your data may be processed outside the EEA under these safeguards.

10. Children

Business Diver is not intended for use by individuals under the age of 16. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete the account promptly.

11. Contact

For privacy-related questions, data subject requests, or complaints, contact us at:

ResourceHub Cph
CVR DK46200462
Email: info@businessdiver.com

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

12. Changes to This Policy

We will update this policy as our service evolves. Material changes will be communicated via email to registered users. The "Last updated" date at the top of this page reflects when the most recent changes were made.