Privacy Policy

Depending on how you use BusinessDX, the following categories of information may be collected.

Account information

When you create an account, BusinessDX may collect:

• your name;
• email address;
• profile information;
• authentication information;
• account preferences.

If you sign in through Google or another authentication provider, BusinessDX receives information that the provider makes available according to the permissions you grant.

BusinessDX does not receive your Google password.

Business information

When you add or analyse a business, BusinessDX may process information including:

• business name;
• website and domain;
• business category;
• business location;
• target market;
• search market;
• business profiles;
• competitors;
• publicly available business information;
• information required by individual diagnostic modules.

Some of this information may already be publicly available.

Connected platform information

If you choose to connect an external account or platform, BusinessDX may process information made available through the relevant integration.

Depending on the service and permissions granted, this may include information relating to:

• Google Business Profile;
• Google services;
• Facebook Pages;
• Instagram business accounts;
• social media profiles and activity;
• reviews;
• business listings;
• search performance;
• other connected business services.

BusinessDX seeks to request only permissions that are reasonably necessary to provide the functionality selected by you.

Supported integrations may be disconnected where that functionality is available.

Diagnostic and analysis information

When BusinessDX performs an analysis, information may be collected or generated such as:

• website technical information;
• website content and metadata;
• domain and DNS information;
• search visibility information;
• ranking and keyword information;
• review and reputation information;
• competitor information;
• social-media information;
• AI visibility results;
• diagnostic scores;
• recommendations;
• Action Plan items;
• analysis history.

Payment and billing information

Payments may be processed by Stripe or another authorised payment provider.

BusinessDX may receive limited payment-related information including:

• payment status;
• subscription status;
• selected plan;
• transaction identifiers;
• invoice information;
• billing country;
• limited payment-method information.

BusinessDX does not directly store your complete payment-card number or card security code.

Payment providers separately process personal data in connection with their services under their own privacy documentation.

Communications

If you contact BusinessDX, information may be processed including:

• your name;
• email address;
• the content of your message;
• related correspondence;
• information necessary to investigate and resolve your request.

Technical and usage information

When you use BusinessDX, technical information may be processed automatically, including:

• IP address;
• browser type;
• device type;
• operating system;
• pages and features used;
• timestamps;
• session information;
• diagnostic and error logs;
• security information.

Where analytics or non-essential cookies require consent, they will only be used in accordance with applicable consent requirements.

Personal data may be processed to:

• create and manage your BusinessDX account;
• authenticate users;
• provide requested analyses;
• generate diagnostic reports and recommendations;
• save business settings and analysis history;
• provide connected integrations;
• manage subscriptions;
• process payments;
• issue or manage billing information;
• provide customer support;
• maintain security;
• prevent abuse and fraud;
• troubleshoot technical issues;
• improve BusinessDX functionality;
• communicate important information about the Service;
• comply with legal obligations;
• establish, exercise or defend legal claims.

Where you separately consent to receive marketing communications, your contact information may also be processed for that purpose.

Under the GDPR, personal data is processed only where an appropriate legal basis applies.

Depending on the activity, this may include:

Performance of a contract

Information may be processed where necessary to provide BusinessDX services requested by you, including:

• account creation;
• business analyses;
• reports;
• subscriptions;
• billing;
• connected functionality;
• customer support relating to the Service.

Legitimate interests

Information may be processed where necessary for legitimate interests including:

• maintaining BusinessDX security;
• preventing fraud and abuse;
• diagnosing technical problems;
• improving the Service;
• understanding general product usage;
• protecting legal rights.

Where applicable, these interests are balanced against the rights and interests of affected individuals.

Legal obligations

Certain information may be processed or retained where necessary to comply with accounting, tax, legal, payment or regulatory obligations.

Consent

Where required, consent may be relied on for activities including:

• optional analytics cookies;
• advertising or similar non-essential technologies;
• optional marketing communications;
• third-party permissions where consent is required.

You may withdraw consent at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

Some BusinessDX functionality uses automated technologies to analyse business information and generate reports, recommendations, comparisons or suggested actions.

Certain features, including AI Visibility and AI-assisted functionality, may transmit relevant prompts, business information or other necessary input to third-party artificial intelligence providers.

BusinessDX seeks to limit the information transmitted to what is reasonably necessary to provide the requested functionality.

BusinessDX analyses are intended to assist business decision-making.

They are not intended to make decisions producing legal or similarly significant effects concerning individuals without appropriate human involvement.

Some analyses may use information obtained from publicly accessible sources including:

• business websites;
• search engines;
• business directories and listings;
• public reviews;
• social-media business pages;
• publicly available competitor information.

Where publicly available information contains personal data, such data is processed only where necessary for relevant BusinessDX functionality and in accordance with applicable data-protection law.

BusinessDX uses third-party providers to deliver and operate the Service.

Depending on the functionality you use, these may include providers of:

• cloud infrastructure and hosting;
• databases;
• authentication;
• payments;
• analytics;
• email and communications;
• search and business information;
• social-media integrations;
• artificial intelligence technology;
• security and technical infrastructure.

Providers used in connection with BusinessDX may include services from organisations such as Supabase, Stripe, Google and Meta, together with specialist business-data and artificial-intelligence providers.

Information is shared only where reasonably necessary for the relevant functionality and subject to applicable contractual and data-protection requirements.

Some service providers may process information outside Bulgaria or outside the European Economic Area.

Where personal data is transferred internationally, an appropriate transfer mechanism will be used where required, which may include:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses;
• another legally recognised safeguard.

The applicable mechanism depends on the service provider and processing activity concerned.

Personal data is retained only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods depend on the type of information.

For example:

• account information may be retained while your account remains active;
• business analyses may be retained while needed to provide account history and BusinessDX functionality;
• transaction and invoice information may be retained for periods required by accounting or tax law;
• security and technical logs may be retained for a limited period necessary for security and troubleshooting;
• support correspondence may be retained while reasonably necessary for resolving issues and maintaining appropriate records;
• Marketing consent records (described in section 10) are kept for 24 months after your last Marketing choice, whether you accepted or refused, so that we can demonstrate the choice you made. After 24 months they are deleted automatically. A Marketing acceptance also expires after 24 months: we then stop treating it as consent and ask you again, and if you do not answer, Marketing stays off;
• internal records of Meta events (described in section 10) are deleted automatically 180 days after they reach a final status (sent, not sent or failed), and at the latest 180 days after the event if they were never processed;
• the choices saved in your own browser stay there until you clear them or change them; an expired Marketing acceptance is ignored as described above.

Where information is no longer required, it may be deleted, anonymised or otherwise securely disposed of, subject to applicable legal and technical requirements.

BusinessDX uses reasonable technical and organisational safeguards designed to protect personal data from:

• unauthorised access;
• unlawful processing;
• accidental loss;
• alteration;
• disclosure;
• destruction.

However, no internet-based service can guarantee absolute security.

You are responsible for protecting access to your BusinessDX account and any third-party accounts connected to it.

BusinessDX may use cookies and similar technologies.

Essential technologies

These may be necessary for:

• authentication;
• account sessions;
• security;
• remembering preferences;
• essential website functionality.

They may be used where necessary to provide the Service.

Analytics technologies

BusinessDX uses Google Analytics 4, provided by Google Ireland Limited, only after you accept Analytics in Cookie settings. It records pages visited, the referring page, approximate location derived from your IP address, device and browser information, and actions such as starting a checkout or completing a purchase (plan, amount and currency only). BusinessDX does not send your email, name or report details to Google Analytics. Google may process this data outside the European Economic Area (see section 7). The legal basis is your consent. You can withdraw at any time in Cookie settings; withdrawal stops new measurement but does not delete data already collected.

Where consent is legally required, non-essential technologies will only be activated after appropriate consent has been obtained.

Users may be able to manage preferences through BusinessDX cookie settings or their browser.

Meta Pixel and Automatic Advanced Matching

Notice version: meta-capi-2026-10-14. Privacy Policy version: 2026-10-14.

BusinessDX uses Meta Pixel only after your explicit Marketing opt-in in Cookie settings, separately from Google Analytics consent. It measures Facebook and Instagram advertising through page views, clicks on our sign-up, diagnostic and plan buttons, successful registrations, contact form submissions, started and completed business analyses, started checkouts and confirmed purchases, and supports advertising attribution, matching and optimisation. Advertising clicks and impressions on Meta can still be counted without website tracking consent.

Automatic Advanced Matching is currently turned on in Meta Events Manager for our Pixel. After Marketing opt-in, it may detect email addresses and other supported contact fields, such as names, entered in website forms. Meta's technology may hash these identifiers in the browser and share the hashed identifiers with Meta to match website activity to Meta accounts and improve advertising measurement and optimisation. Hashing is not anonymisation: these identifiers remain personal data. BusinessDX registration, login and contact forms currently do not request a phone number, and BusinessDX does not itself add contact identifiers to Pixel initialisation or event parameters.

Meta can receive event names, a page address, timestamps, IP address, browser/device information and cookie identifiers such as _fbp and _fbc, alongside any automatically matched identifiers. BusinessDX's own events exclude report details and do not include email, phone or account identifiers in their parameters; query strings and fragments are stripped from the page address while these events are sent, and payment return pages remove the checkout reference before the Pixel loads.

The recipient is Meta Platforms Ireland Limited for users in the European Economic Area, with processing by Meta entities and service providers as described in Meta's privacy information: https://www.facebook.com/privacy/policy/ . Meta may process data outside the European Economic Area; see section 7.

You can reject Marketing without preventing registration or use of the service, and can withdraw at any time from Cookie settings by turning Marketing off and selecting Save choices, or by selecting Reject all. Withdrawal saves a refusal, clears BusinessDX-accessible Meta cookies and reloads open BusinessDX tabs where the Pixel was active to remove its form listeners. It stops new tracking but does not undo data already sent to Meta. You may also manage Meta advertising preferences at https://www.facebook.com/adpreferences/ .

Consent choices are recorded in this browser's local storage with the decision time, notice version and policy version, keeping earlier decisions when consent is withdrawn. When you accept Marketing, BusinessDX also creates a random consent identifier in this browser and records each later Marketing decision for that identifier on its servers; if that record cannot be saved at once, your browser retries until it is. These records do not contain your email, phone, name or advertising identifier. Marketing acceptance given under an earlier notice is not reused, and events blocked before consent are not replayed after acceptance.

Meta Conversions API (server-side Purchase and registration events)

BusinessDX sends two types of event to Meta directly from its servers using Meta Conversions API: Purchase and CompleteRegistration. It uses the same Marketing consent as Meta Pixel: nothing is sent from our servers if you have not accepted Marketing or have withdrawn it.

A Purchase is sent only after Stripe confirms that the first payment for a new paid subscription has succeeded. Renewals, failed or pending payments, cancellations, free plans and test payments are not reported, and purchases older than 7 days are never sent. A CompleteRegistration is sent only once per account, when you first confirm your email address or first sign in with a new Google account; later logins are never reported, and registrations older than 7 days are never sent. If you accepted Marketing on the sign-up page, your random consent identifier is saved with your account so that a confirmation link opened in another browser uses that same choice. Starting a checkout and other events are measured only by Meta Pixel in your browser.

Each server event contains: the event name; an event ID shared with the matching Pixel event so Meta can remove duplicates; the time of the purchase; the source "website" and a fixed BusinessDX page address; your browser's user-agent string; Meta's own cookie identifiers _fbp and _fbc, if present; and, for Purchase only, the amount paid and currency. For CompleteRegistration only, it also contains the IP address of the request that finished your registration, because Meta does not accept a website event identified by the user-agent string alone. It does not contain your email, name, phone, account ID, business analysed or report details, and Purchase events do not contain your IP address. The browser details, IP address and Meta cookie identifiers are saved only while Marketing is accepted, when you start a checkout or finish registering, and are deleted from our event log once the event has been sent or has finally failed.

To decide whether a server send is allowed, BusinessDX keeps a server-side consent log for your random consent identifier: each Marketing decision (accept or withdraw), whether Analytics was accepted, the notice and policy versions, where you made the choice and the time. A send is allowed only if Marketing was accepted when the purchase or registration happened and is still accepted immediately before sending; a later withdrawal blocks all further server sends for that identifier, and its saved browser details are not used.

The legal basis is your consent (Article 6(1)(a) GDPR and the applicable ePrivacy rules). The recipient is Meta Platforms Ireland Limited, as described above. Our database and payment providers process the related records on our behalf.

Subject to applicable law, you may have the right to:

• access personal data held about you;
• rectify inaccurate or incomplete data;
• request deletion of personal data in certain circumstances;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• data portability for certain information processed by automated means;
• lodge a complaint with a competent data-protection authority.

These rights may be subject to exceptions provided by applicable law.

To exercise your rights, email info@business-dx.com, ideally from the email address linked to your BusinessDX account, and tell us which right you want to exercise. We may ask you to confirm your identity before acting on a request. We will respond within one month of receiving your request; where a request is complex or we receive many requests, this may be extended by up to two further months, and we will tell you if so within the first month.

If your request concerns Marketing consent made without an account, please include the date of your choice; consent records are linked to a random browser identifier, not to your name or email, so we may not be able to find them without further information.

Identity verification may be required before certain requests are fulfilled.

If you believe your personal data has been processed contrary to applicable data-protection law, you have the right to lodge a complaint with a competent supervisory authority.

In Bulgaria, the supervisory authority is:

Commission for Personal Data Protection (CPDP)

2 Prof. Tsvetan Lazarov Blvd.

1592 Sofia

Bulgaria

You may also have the right to contact another EU or EEA supervisory authority where applicable.

Where BusinessDX sends optional marketing communications, you may unsubscribe at any time using the unsubscribe mechanism included in the communication or by contacting BusinessDX.

Necessary service communications may still be sent regarding matters such as:

• account security;
• billing;
• subscriptions;
• important changes to BusinessDX;
• legal or operational notices.

BusinessDX does not currently offer a self-service account-deletion button. To delete your account, email info@business-dx.com from the email address linked to your account. We will confirm the deletion within one month, subject to the exceptions below.

Deleting an account may permanently remove access to stored analyses, reports and other account information.

Certain information may continue to be retained where required by law or reasonably necessary for:

• accounting;
• payment records;
• fraud prevention;
• security;
• legal claims.

BusinessDX may contain links to or integrations with third-party websites and services.

Those providers process information according to their own privacy notices and practices.

Their independent processing is not governed by this Privacy Policy.

BusinessDX is intended for business and professional use and is not designed for children.

BusinessDX does not knowingly provide the Service directly to children.

This Privacy Policy may be updated to reflect:

• changes to BusinessDX functionality;
• new integrations or service providers;
• changes to the way information is processed;
• legal or regulatory requirements.

The current version will be published on this page together with the date on which it was last updated.

Where appropriate, additional notice may be provided for material changes.

For questions about this Privacy Policy, your personal data or your privacy rights:

BusinessDX is operated by Kristina Krivcheva as an individual (natural person), not through a company. Kristina Krivcheva is the data controller responsible for the personal data described in this Privacy Policy.

Data Controller: Kristina Krivcheva (individual)

Location: Sofia 1421, Lozenets, Bulgaria (city, district and postcode only; this is not a full postal address)

Email: info@business-dx.com

Please send all privacy requests and other correspondence by email to info@business-dx.com.