Privacy Policy

1. Who we are

Ärirobot is web-based business software for companies, provided by Bevira OÜ. In this policy, “Bevira”, “we” and “provider” mean Bevira OÜ. The Estonian version of this policy prevails in case of discrepancy.

Company

Bevira OÜ

Registry code

12878009 (Estonia)

Address

Tartu mnt 83-401, 10115 Tallinn, Estonia

E-mail

[email protected]

Phone

+372 512 5024

2. Two roles: your company’s data and our own data

Business data of a company using Ärirobot (customers, suppliers, employees, invoices, stock, payroll, documents etc.) belongs to that company (the Customer). For personal data in it, the Customer is the controller and Bevira is the processor: we process it only to provide the service, on the Customer’s instructions and under Ärirobot’s terms. If you want to know about your data held by a company that uses Ärirobot (e.g. you are its customer or employee), please contact that company first — it decides which data it processes and why.

Our own data — user accounts, logins, the customer relationship, billing, support requests, website visits and security logs — is processed by Bevira as controller.

3. What data we process

• User data: name, e-mail, phone, role and rights, language, login method (e-mail code, Smart-ID, Mobile-ID, ID card).
• Usage and security data: logins, activity history (who changed what), IP address, browser data, error and security logs.
• Customer relationship data: company details, contracts, packages, invoices and payments, support communication.
• Customer business data (section 2), entered by the Customer and its users or brought in through connections.
• AI usage: time of an AI request, user, a short description of the request, volume and cost.

We do not sell personal data or share it with third parties for marketing.

4. Purposes and legal bases

• Providing the service and performing the contract — accounts, login, Ärirobot features, support, billing.
• Legal obligations — accounting, taxation, lawful requests of authorities.
• Legitimate interest — service security, preventing abuse and fraud, finding errors, improving the service from aggregated, non-identifying usage statistics, protecting our rights.
• Consent — website measurement and marketing cookies (section 11). You can withdraw consent at any time.

5. Artificial intelligence in Ärirobot

• AI support and the AI colleague are off by default. The Customer’s administrator switches them on and chooses what the AI may see: structure only, totals and names without personal data, or rows within the user’s rights (sensitive values masked).
• The AI sees only what the user is entitled to see. Personal identification codes, bank accounts, e-mail addresses and phone numbers are not sent to the AI (except masked at the chosen level). From personnel registers (employees, payroll, absences) the AI receives only the number of rows.
• When pseudonyms are switched on for a company (default for new companies), Ärirobot does not send names or contact details from its own data to the AI — the AI sees tokens (e.g. “Firma #16”); the name behind a token is visible only in Ärirobot. Pseudonymised data is still personal data.
• What a user types into a question is sent to the AI as typed.
• The AI does not change data on its own: it prepares a proposal that the user confirms.
• Bevira does not use Customer data to train AI models. Data sent to an AI provider is processed under that provider’s commercial terms; the Customer decides what and how much is shared with the AI (data level, pseudonyms, AI on or off). Every request is logged (time, user, volume, cost).

6. External AI connections (Claude, ChatGPT etc.)

A user may connect Ärirobot to their own AI tool (e.g. Claude, ChatGPT) over an MCP connection. The user does this on their own decision and with their own account:

• the connection sees and does only what the user is allowed to in Ärirobot; changes require the user’s confirmation;
• data that Ärirobot returns to the connection goes to the AI service chosen by the user and is processed under that provider’s terms and privacy policy. That provider is not Bevira’s processor and Bevira is not responsible for its processing;
• the user can disconnect at any time in the AI tool’s settings and in Ärirobot.

The Customer’s administrator decides whether external AI connections may be used in the company, and the user is responsible for which service they grant access to.

7. Processors

We use trusted partners who process data only on our instructions and are bound by confidentiality:

Some partners are located outside the European Economic Area. Such transfers use safeguards permitted by the GDPR (e.g. the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework). The current list is available at [email protected]; Customers are notified of material changes in advance.

8. Retention

• Customer business data is kept while the contract is in force. When it ends, the Customer can export its data; the data is then deleted or anonymised within a reasonable time, except to the extent the law requires it to be kept.
• Data may remain in backups until the backups are replaced in the normal cycle.
• User and customer relationship data is kept during the contract and afterwards as long as the law requires (e.g. accounting records) or as needed to establish, exercise or defend legal claims.
• Security logs are kept as long as needed for security and incident investigation.

9. Security

We use technical and organisational measures: encrypted connections, server-side rights checks on every request, personal accounts and strong authentication, activity logging, encrypted backups, restricted and logged system access. No measure gives an absolute guarantee, and we keep improving them. We notify the Customer and, where required, the Estonian Data Protection Inspectorate of personal data breaches as required by law.

10. Your rights

You have the right to request access to your data, rectification, erasure (unless the law requires retention), restriction of processing, data portability, and to object to processing based on legitimate interest. Write to [email protected]; we reply within a reasonable time and at the latest within the statutory deadline. We may ask for additional information to identify you.

Where the Customer is the controller (section 2), we forward the request to the Customer and help it respond.

You have the right to lodge a complaint with the Estonian Data Protection Inspectorate.

11. Cookies and measurement

The website and Ärirobot use technically necessary cookies (login, security, preferences). Measurement — for example remembering which campaign brought you here — and advertising tools (e.g. Google Analytics, Meta pixel), when in use, are used only with your consent. You can change your choice from the “Küpsised” (cookies) link in the website footer.

12. Changes

We may update this policy when the service, partners or laws change. The current version is always on this page; Customers are notified of material changes in advance. Use of Ärirobot is also governed by the Terms of Use.