Privacy Policy

1. Who We Are

This website is operated by Belfavn ("Belfavn", "we", "us").

Legal form: Sole proprietorship (natural person). Registered office: Avenue de Calabre 33, 1200 Woluwe-Saint-Lambert, Belgium. Company/VAT number: 1035.683.549. Country of registration: Belgium.

General contact: hello@belfavn.com. Privacy contact: hello@belfavn.com.

For data protection purposes, Belfavn acts as controller for personal data processed through this website unless another role is clearly stated.

2. Current Service Scope

This website currently provides public company information, contact/intake forms, and authenticated portal areas for Belfavn's business customers and delivery team.

Belfavn also provides an AI Assistant intake widget that business customers embed on their own websites. When you chat with such a widget, you are interacting with a Belfavn-operated service on behalf of the business whose website you are visiting; that business decides what information the assistant requests and receives the resulting request summary. See section 7a and the AI Use Disclosure page.

Payment checkout and optional analytics/marketing tracking are not treated as active unless Belfavn explicitly enables them and updates this policy.

3. Personal Data We May Collect

• Contact details you provide, such as name, email, company, and message content.
• Project context and business details you choose to share in forms or email.
• AI Assistant widget conversations: the messages you exchange with the assistant, contact details and request information you provide in them, files you choose to upload, and the structured request summary generated from the conversation.
• Technical and usage data needed for website operation and security (for example IP address, browser/device info, request logs, and timestamps).
• Communication records when you contact Belfavn.

4. How Data Is Collected

• Directly from you through form submissions and email messages.
• Automatically through hosting, security, and delivery infrastructure logs.
• Through cookies or similar technologies according to your consent choices where consent is required.

5. Purposes and Legal Bases

Belfavn maps processing purposes to legal bases as follows.

• Enquiry handling and pre-project communication: steps at your request before entering a contract and legitimate interests.
• AI Assistant intake conversations and enquiry delivery to the business you contacted: steps at your request before entering a contract with that business, and performance of Belfavn's contract with the business.
• Website security, abuse prevention, and reliability logging: legitimate interests and legal obligation where applicable.
• Legal and compliance recordkeeping: legal obligation and legitimate interests.
• Optional cookies or optional measurement tools (if activated): consent.

6. Required vs Optional Data

Required fields in forms are needed to process your request. If required information is not provided, Belfavn may be unable to respond or continue the requested discussion.

Optional fields are not required for initial contact.

7. Service Providers and Processing Roles

Belfavn uses third-party providers to run and support website operations and communications. Provider roles can vary by context and should be verified in contracts and provider terms.

• Cloudflare (DNS, proxy/CDN, SSL, security controls).
• Render (hosting and deployment infrastructure).
• GitHub (source and deployment workflow).
• Auth0 (authentication for portal accounts).
• Google (Gemini AI models for AI-enabled features, including the AI Assistant widget and document processing; Gmail where email handling or forwarding is configured).
• Cloudflare R2 (object storage for uploaded files).
• If activated later: Stripe for payments.

7a. AI Assistant Widget Roles

When you use an AI Assistant widget on a business's website, that business decides what the assistant asks for, why it asks, and what happens to your request afterwards. That business is therefore the controller for those conversations, uploaded files, and the resulting enquiry summary. Belfavn provides the software and stores the data on that business's behalf, acting as its processor under a data processing agreement, and does not use widget data for its own separate purposes.

AI processing for the widget uses Google's Gemini models as described on the AI Use Disclosure page. Belfavn does not use widget conversations to train AI models.

This distinction matters when you want your data corrected or deleted. Rights over widget data are exercised against the business you contacted, and Belfavn acts on that business's instructions. If you contact Belfavn instead, Belfavn will pass your request on to that business without undue delay and assist it in responding, but Belfavn does not decide the outcome in that business's place. See section 10a.

8. International Transfers

Some providers may process data outside the EEA, including in countries where Belfavn or its vendors operate infrastructure.

Where relevant, Belfavn relies on an appropriate GDPR transfer mechanism such as an adequacy decision or Standard Contractual Clauses, with supplementary measures where needed.

9. Retention

Belfavn keeps personal data only as long as needed for the original purpose, legal obligations, dispute handling, and security controls.

Indicative retention placeholders: enquiry and contact records up to 24 months after the last meaningful contact, unless a longer retention period is required for legal, contractual, or dispute-related reasons; core security/request logs up to 12 months, unless a longer retention period is required for security investigations, abuse prevention, or legal obligations.

AI Assistant conversations, enquiries, and uploaded files are retained while they remain relevant to the business you contacted and its use of the service, subject to the same principle of keeping data no longer than needed. The business that received your enquiry can delete it, its conversation, and its uploaded files at any time, and Belfavn provides that capability in the product — see section 10a.

Belfavn does not currently run automatic deletion of AI Assistant data after a fixed period. Data is deleted when a business deletes it, when Belfavn no longer needs it for the purpose it was collected for, or when a valid erasure request is acted on.

Some retention periods are set by law rather than chosen. Belgian tax and accounting rules require businesses to keep invoices, books, and supporting records for a period fixed by legislation, and that period has changed more than once in recent years. Where such a rule applies to a record, it is kept for as long as the applicable law requires, even if erasure is requested — this is the exception in Article 17(3)(b) GDPR.

10. Your Rights

Under the GDPR and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, you have the following rights.

• Access to your data (Article 15 GDPR).
• Rectification of inaccurate or incomplete data (Article 16 GDPR).
• Erasure of your data, also called the right to be forgotten (Article 17 GDPR). Section 10a explains what this means in practice for AI Assistant enquiries, conversations, and uploaded files, and what is kept.
• Restriction of processing (Article 18 GDPR).
• Objection to processing based on legitimate interests (Article 21 GDPR).
• Data portability where applicable (Article 20 GDPR).
• Withdrawal of consent at any time for consent-based processing, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).
• Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22 GDPR). See section 11.

10a. Deleting AI Assistant Enquiries, Conversations, and Files

Belfavn sets this out in detail because vague wording about erasure is of no use to someone who actually wants their data removed.

The business that operates the assistant can permanently delete an enquiry you sent it. Doing so removes the enquiry record — including the name, email address, phone number, location, and request details you provided, any notes recorded on it, and any price indication you were shown — together with the full conversation transcript and every file you uploaded. Uploaded files are erased from Belfavn's object storage as well as from its database. Your name is also removed from the entries the deletion leaves behind in the business's own activity history. This is a real deletion and not a hidden flag: after it, the enquiry and its transcript can no longer be retrieved through the service.

Because the business is the controller for widget data (section 7a), the way to have your data deleted is to ask that business. You may also contact Belfavn using the details in section 13; Belfavn will forward your request to the business without undue delay and assist it in acting on the request, as it is required to do as a processor under Article 28(3)(e) GDPR.

Belfavn keeps an internal record that a deletion took place, so that it can demonstrate the request was honoured. That record contains internal identifiers, counts, which account carried out the deletion, and when. It does not contain your name, your messages, or the content of your files.

Where an uploaded file cannot be removed from storage at the moment of deletion — for example because the storage service is temporarily unreachable — the database records are still deleted, and the storage locations that could not be cleared are recorded internally so the files can be found and removed manually afterwards. A storage location can include the original file name. This is the only circumstance in which such an identifier is retained after a deletion, it applies only to files that demonstrably still exist, and it exists so that those files can actually be erased rather than left behind untraceably. The business is told on screen when this happens.

10b. What Is Kept After a Deletion, and Why

Deleting an enquiry does not erase every trace of it, and Belfavn states the exceptions rather than leaving them to be discovered. Each is limited to what is necessary, in line with Article 17(3) GDPR.

• If the business had already turned your enquiry into a job or order it is carrying out, the contact and service details copied into that job when it was created are kept. This allows the business to complete work you asked for and to meet the record-keeping obligations imposed on it by Belgian tax and accounting law (Articles 6(1)(b) and 6(1)(c), and Article 17(3)(b) GDPR). The job then also shows that the originating enquiry was deleted, and on what date. If you want those details removed as well, ask the business directly; whether that is possible depends on whether the work is complete and on the retention periods the law imposes on that business.
• The business's own activity history continues to show that an enquiry was received, and what the business did about it, on the dates concerned. It is the business's record of its own operations. Your name is removed from those entries when the enquiry is deleted, and the description you gave is removed with it, so what remains records the event without identifying you. Following such an entry after deletion leads nowhere, because the enquiry it points to no longer exists.
• Technical records that an AI request was made — the time and approximate size of the request, used for billing, capacity, and abuse prevention — are kept. They contain no conversation content and do not identify you.
• Security and request logs are kept for the period stated in section 9, for the purposes described there.
• Any record Belfavn or the business is required by law to keep, for as long as that law requires.

10c. Limits of the Current Deletion Features

So that expectations are accurate, these are things the service does not currently do.

• There is no self-service page on which you can delete your own data. Deletion is carried out by the business you contacted, or by Belfavn on that business's instructions, following a request from you.
• There is no automatic deletion of AI Assistant data after a fixed period. See section 9.
• A conversation that never became an enquiry — for example if you asked a question and left without leaving contact details — cannot currently be deleted as an individual item. It remains subject to section 9, and Belfavn will act on a valid request that identifies it.
• Deleting a business customer's entire Belfavn account and all data within it is handled by contacting Belfavn, not through the portal.

11. Automated Decision-Making

Belfavn does not currently state that it makes solely automated decisions with legal or similarly significant effects through this website.

12. Security

Belfavn applies reasonable technical and organizational measures to reduce risk and protect personal data. No system can guarantee absolute security.

13. Privacy Requests and Complaints

To exercise your rights, contact hello@belfavn.com. You may also write to Avenue de Calabre 33, 1200 Woluwe-Saint-Lambert, Belgium. Belfavn may request proportionate identity verification before completing a request.

Belfavn responds without undue delay and in any event within one month of receiving a request. Where a request is complex, or where several requests have been made, that period may be extended by up to two further months; Belfavn will tell you within the first month if that happens, and why (Article 12(3) GDPR). Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Where a request concerns an AI Assistant conversation, the business you contacted is the controller and the one-month period runs for that business. Belfavn will forward your request to it promptly and assist it in responding (section 7a).

You also have the right to lodge a complaint with your supervisory authority. In Belgium, this is the Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels: https://www.dataprotectionauthority.be/. You may also seek a judicial remedy.

14. Changes to This Policy

Belfavn may update this Privacy Policy when processing activities, legal requirements, or service providers change. The latest version is always published on this page.

Feature Activation Notice

If Belfavn activates Stripe payments, analytics, or other new processing activities, this policy will be updated before or at launch to reflect them.