Privacy policy.
Effective from 11 October 2026. The Slovak version prevails.
In short
- We process only what smallbuss needs to work and stay secure. We do not sell data or use it for advertising.
- All data is stored in Microsoft Azure data centres in Western Europe (the Netherlands).
- Data about your business's customers belongs to your business. We process it only on its behalf.
- This website uses no cookies and no analytics. The app uses only the cookies needed for signing in and your language.
1. Who we are
The provider of smallbuss and the controller of personal data is Softverse, spol. s r. o., registered office Stránske 506, 013 13 Stránske, Slovakia, company ID 54 059 623, registered in the Commercial Register of the District Court Žilina, section Sro, file No. 91289/L ("we").
Contact for personal data: privacy@smallbuss.online. We have not appointed a data protection officer because the law does not require us to.
2. Two roles: controller and processor
As a controller we process data about smallbuss users: your account, sign-ins, security records, feedback and the e-mails we send you.
As a processor we process the data your business (organisation) puts into smallbuss: customers, orders, invoices, payments, costs and attachments. Your business is the controller of that data and decides why and how it is processed. The terms of this processing are in the terms of service. If you are a customer of a business that uses smallbuss, please exercise your rights with that business directly.
3. What we process and why
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Account: name, e-mail, password (only as a secure hash), language, organisation memberships | Creating and running your account, signing in, working in an organisation | Contract, Art. 6(1)(b) GDPR | While the account exists; 30 days after the account is closed we anonymise its name and e-mail |
| Two-factor authentication: authenticator key and recovery codes, encrypted | Protecting your account | Contract | While two-factor authentication is on |
| Security records: time and type of event (sign-in, refusal, password change, member management), e-mail, IP address | Account security, detecting attacks, resolving disputes | Legitimate interest, Art. 6(1)(f) GDPR | 12 months |
| AI assistant keys: name, validity, last use (the key itself only as a hash) | Connecting an AI assistant on your behalf | Contract | Until the key is revoked or expires |
| Invitations: invitee's e-mail, inviter's name | Inviting a colleague to an organisation | Legitimate interest of the organisation and the invitee | 7 days of validity |
| E-mails from smallbuss: address, subject, message content (encrypted) and delivery result | Address confirmation, password reset, invitations, notifications | Contract | 30 days after delivery or the last attempt |
| Feedback: text, page, app version, browser type, author's name and e-mail | Answering and improving the service | Legitimate interest | Until the organisation is deleted |
| Server operation logs (errors, requests) | Operation and troubleshooting | Legitimate interest | 30 days |
| Database backups | Recovery after a failure or mistake | Legitimate interest | Continuous backup 14 days, backup before each new version 30 days |
We do not use personal data for automated decision-making or profiling, and we do not sell it.
4. Where data is stored and who can access it
The app, database, files, backups and operation logs run on Microsoft Azure in the West Europe region (the Netherlands). Connections are encrypted (HTTPS) and secrets such as keys and e-mail account passwords are encrypted in the database. Data of different organisations is separated down to the database level.
These processors help us provide the service:
| Processor | For what | Where |
|---|---|---|
| Microsoft Ireland Operations Ltd. (Microsoft Azure) | Hosting the app, database and backups; delivering this website | EU (the Netherlands); the website is delivered from the nearest node of the Microsoft network |
| Hostinger (UAB Hostinger) | Sending e-mails from smallbuss | EU (Lithuania) |
Microsoft belongs to a group based in the USA. Where it processes data outside the EEA to a limited extent, it does so under the standard contractual clauses and the EU-U.S. Data Privacy Framework.
Other services take part only when your organisation switches them on itself:
- KROS Fakturácia (KROS a.s., Slovakia): once connected, it receives invoice data including the customer's details.
- The organisation's own e-mail account: messages to customers are then sent through the provider the organisation sets up.
- AI assistant: when you connect your own AI assistant, the data you ask it for passes to its provider under that provider's terms. You decide which assistant you use.
Our platform administrator sees only basic data about organisations (name, members, status). They have no access to an organisation's content such as orders or customers.
5. Cookies
This website uses no cookies, no analytics and no third-party tools. Fonts and images are hosted by us.
The smallbuss app uses only cookies it cannot work without, so it needs no consent for them:
| Cookie | Purpose | Lifetime |
|---|---|---|
| Sign-in cookie | Keeps you signed in | Until the browser closes or after 60 minutes of inactivity; 30 days with "Stay signed in" |
.AspNetCore.Culture | Remembers your language | 1 year |
| Form protection cookie | Protects forms against forgery | Until the browser closes |
6. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object to processing based on legitimate interest. You change your name, language, password and two-factor authentication yourself in your profile, where you can also download a copy of your data (Download my data) and close your account. Send other requests to privacy@smallbuss.online; we handle them within one month at the latest.
If you believe we handle your data incorrectly, you can lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.
7. Changes
We update this policy when the way we process data changes. We will tell you about a significant change in advance by e-mail or in the app.