Privacy Notice

1. Controller

The controller of personal data is Prism Sebastian Szczepański, a sole proprietorship registered in Poland, NIP 9271980179, REGON 545531735. Privacy contact: support@busloom.com.

2. Data processed by the desktop application

Projects, connection profiles, register values, traffic captures, automation definitions, local preferences and the recorded legal-document acknowledgement are stored on the user’s device. Busloom does not receive them merely because the application is running. An update check sends an ordinary HTTPS request containing technical network data and the information necessary to select the current platform release.

License activation uses a one-way hashed device fingerprint, platform, architecture, Busloom version and random request identifier. The raw operating-system machine identifier does not leave the device. Online activation additionally uses a short-lived device code and token. Offline activation moves the same bounded request as a file chosen by the user.

3. My Busloom account and licensing

We process the email address used to sign in, account identifiers and roles, one-time authentication challenges, hashed session tokens, session timestamps, purchased license records, optional license names, activation requests, pseudonymous device fingerprints, platform and application version, issued certificate metadata and audit events. We use this data to create and secure the account, deliver authentication codes, assign licenses, prevent duplicate or fraudulent activation, provide offline certificates and handle support.

The legal basis is performance of a contract or steps requested before a contract (Article 6(1)(b) GDPR), compliance with legal obligations where applicable (Article 6(1)(c)), and our legitimate interests in service security, fraud prevention, troubleshooting and the establishment or defence of claims (Article 6(1)(f)).

4. Contact form and correspondence

The contact form processes name, email address, optional company, selected topic, message, request identifier and the technical data needed to prevent abuse. The message is delivered to our support mailbox and is not copied into the My Busloom database. We process it to answer the request and manage subsequent correspondence under Article 6(1)(b) or 6(1)(f) GDPR. Tax or accounting records, if created later, are processed under Article 6(1)(c).

5. Cookies and similar storage

busloom.com does not use advertising or analytics cookies. My Busloom uses one strictly necessary, secure, HttpOnly session cookie after sign-in. Cloudflare Turnstile may use technical storage and network signals required to distinguish legitimate sign-in attempts from abuse. These mechanisms are necessary to provide and secure the service; they are not used by Busloom for advertising or cross-site profiling.

6. Recipients and processors

Cloudflare provides DNS, security controls, Turnstile, Workers hosting, request handling, rate limiting, logs and the D1 database. Resend delivers sign-in and contact email. Our email provider receives correspondence delivered to the support address. Providers process data under their contractual data-protection terms and only to the extent necessary for their service. Data may also be disclosed where required by law or needed to establish, exercise or defend legal claims.

7. Transfers outside the EEA

Cloud service providers may process data outside the European Economic Area. Where this occurs, the transfer relies on an applicable adequacy decision, the EU–US Data Privacy Framework where valid for the recipient, or European Commission standard contractual clauses together with supplementary safeguards as required. Provider details and current safeguards are available on request.

8. Retention

• Unconsumed one-time sign-in challenges expire after 10 minutes and are removed from active use; expired challenge records are cleaned after 24 hours.
• Sessions expire after 30 days and revoked or expired session records are cleaned after a further 30 days.
• License, device assignment and audit records are retained for the life of the permanent license and afterwards only as long as necessary for legal obligations, fraud prevention and claims, normally no longer than six years.
• Contact correspondence is retained while the matter is open and normally for up to three years after the last exchange, unless a longer period is required for a contract, accounting obligation or claim.
• Security and delivery logs are retained according to the configured provider period and are not deliberately retained longer than needed for diagnosis and abuse prevention.

9. Your rights

Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction, portability or objection to processing based on legitimate interests. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). To exercise a right, write to support@busloom.com. We may need to verify that the request concerns your account.

10. Required data and automated decisions

An email address is required for a My Busloom account. License and device-request data is required to issue a device-bound certificate. Contact-form data marked as required is needed to answer the request. Without it, the relevant service cannot be provided. We do not make decisions producing legal or similarly significant effects solely by automated processing, and we do not profile users for advertising.

11. Security and changes

We use encrypted transport, one-time codes, hashed session tokens, restricted cookies, rate limits, Turnstile, service bindings, signed license artifacts and access controls. No system is risk-free. If this notice changes materially, we will publish a new version and, where appropriate, ask the desktop application user to acknowledge it.