1. Who we are
Bifre (https://www.bifre.com) is operated by Artjoms Lupjaks, operating as a registered self-employed business in Riga, Latvia (“Bifre”, “we”, “us”).
Bifre is a tool for businesses. A business creates an account, adds its services and team, and shares a review link or QR code with its customers. The customer picks what they liked, gets a draft review written by AI, can edit it, and then copies it and posts it on Google themselves.
For anything about this policy or your data, email hello@bifre.com. We answer within 30 days, usually much sooner. We have not appointed a data protection officer because we are not required to, but the same address reaches the person responsible for privacy.
2. Controller and processor
Who is responsible for your data depends on how you use Bifre:
- Business accounts and our website. For account holders, team members who log in, people who contact us and visitors to our website, Bifre is the data controller.
- The customer review flow. When a business sends its customers a review link, the business decides to collect feedback and is the data controller. Bifre acts as its data processor and only processes that data on the business’s instructions, as set out in our data processing terms.
If you are a customer and want to exercise your rights about a review draft, you can contact the business directly or email us and we will pass your request on and help the business answer it.
3. What we collect
3.1 Business account holders
- Account details: name, email address and password. Passwords are stored only as a salted one-way hash; we can never see them.
- Business details: business name, type of business, address, Google review link, list of services or products, prices if you add them, cover image, language settings, custom AI tone and facts you give us about the business.
- Team members: first names or display names you add so reviews can be attributed to the person who did the work. We do not need surnames and ask you not to add them.
- Subscription and usage: plan, subscription status, number of reviews copied per month and per location, and the country used to show prices in the right currency.
- Payment data: when paid plans are billed online, payments are handled by our payment provider. We receive the payment status, the last four digits and expiry of the card and the billing address, never the full card number.
- Communication: emails and support messages you send us and our replies.
3.2 Customers who open a review link
- We do not ask customers for their name, email, phone number, account or location, and customers do not need to sign up.
- The review draft: the business and location, the team member and services the link was sent for, the star rating and tags the customer tapped, any short comment they typed, the language, every AI-generated version, the final text including the customer’s own edits, and the time it was generated and copied.
- Anti-abuse data: to stop automated misuse we temporarily keep a count of requests per IP address in server memory. It is not written to our database and disappears within minutes.
A customer may type personal details into the free-text comment. We ask customers not to, and the AI is instructed not to repeat such details in drafts.
We cannot see whether a customer actually posted a review on Google, what they posted, or their Google account. Posting happens entirely between the customer and Google, under Google’s own privacy policy.
3.3 Website visitors
- Technical logs: our hosting provider records IP address, browser type, the page requested and the time, to deliver the site and protect it against attacks.
- Approximate location: our hosting provider tells us the visitor’s city and country based on the IP address. We use it only on the fly to show local examples and prices in the right currency. We do not store it.
We do not use advertising or analytics cookies, tracking pixels or third-party trackers. See our cookie policy.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Creating and running your account | Account, business and team details | Performance of a contract (6(1)(b)) |
| Generating review drafts and showing statistics | Review drafts, services, team names | Contract with the business (6(1)(b)); for customers, the business’s legitimate interest (6(1)(f)) |
| Billing, counting usage and accounting | Subscription, usage and payment data | Contract (6(1)(b)) and legal obligation under the Latvian Accounting Law (Grāmatvedības likums) (6(1)(c)) |
| Preventing abuse, fraud and fake reviews | Request counts, logs, review patterns | Legitimate interest (6(1)(f)) |
| Improving draft quality | Review drafts and edits, without customer identity | Legitimate interest (6(1)(f)) |
| Support and service messages | Email and messages | Contract (6(1)(b)) |
| Product news by email | Email address | Consent or soft opt-in under the Law on Information Society Services (Informācijas sabiedrības pakalpojumu likums); you can opt out in every email |
Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (see section 10).
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
5. How AI drafts are made
When a customer asks for a draft, we send the AI model only what it needs: the business name and type, the services selected, the tags and rating the customer chose, any comment they typed, the language, and sometimes a team member’s first name. We do not send any customer identity.
The AI is instructed to write only about what the customer selected, not to invent services, facts or superlatives, and to write in the customer’s language. The customer always sees the draft, can edit or regenerate it, and decides whether to post anything.
Our AI provider processes these requests only to return the text. The request never includes who the customer is.
7. Transfers outside the EEA
We store our database in the EU. Some providers are based outside the European Economic Area or may access data from there:
- USA (Vercel, Neon): we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses.
- China (DeepSeek): there is no adequacy decision for China. We rely on Standard Contractual Clauses and limit what is sent to the minimum described in section 5: no customer identity, no contact details and no account data.
You can ask us for a copy of the safeguards we use by emailing hello@bifre.com.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account, business, services and team | While the account is active, then deleted within 90 days of closing the account |
| Review drafts | While the business account exists, or until the business deletes them. Deleted with the account. |
| Invoices and accounting records | 5 years after the end of the financial year, as required by the Latvian Accounting Law (Grāmatvedības likums) |
| Support emails | Up to 2 years after the conversation ends |
| Hosting logs | According to our hosting provider’s retention, typically from a few days up to 30 days |
| Anti-abuse request counts | Minutes, in memory only |
| Backups | Overwritten on a rolling basis, at most 30 days after deletion from the live database |
9. Security
- All traffic is encrypted with HTTPS (TLS). The database is encrypted at rest.
- Passwords are stored as salted hashes, never in plain text.
- Each business can only see its own data. Access is checked on the server on every request.
- Only a small number of people at Bifre can access production data, and only when needed to run the service.
- Rate limits protect review links and AI generation from automated abuse.
No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify Datu valsts inspekcija (the Latvian Data Protection Authority) within 72 hours and tell affected businesses without undue delay, so they can inform their customers if needed.
10. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy of it.
- Rectification of data that is wrong or incomplete.
- Erasure of your data when there is no longer a reason to keep it.
- Restriction of processing while a complaint is being looked at.
- Data portability: receive data you gave us in a machine-readable format.
- Object to processing based on legitimate interest, and to direct marketing at any time.
- Withdraw consent at any time where we rely on consent.
Email hello@bifre.com to use any of these rights. We may ask you to confirm your identity. We answer within one month; if a request is complex we may extend this by two more months and will tell you why.
You can complain to Datu valsts inspekcija (DVI), the Latvian Data Protection Authority (dvi.gov.lv), or to the data protection authority where you live or work. We would appreciate the chance to sort it out with you first.
11. If you are a customer
If a business sent you a Bifre link:
- You don’t have to use it, and you don’t have to post anything.
- You don’t give us your name or contact details, and the review page sets no cookies.
- The draft is a suggestion. You can change any word, or write your own review instead.
- If you post on Google, the review is public under your Google account and Google’s terms. To change or delete it, do that in Google Maps.
- To have a draft deleted from our systems, contact the business or email hello@bifre.com with the business name and roughly when you used the link.
12. Children
Business accounts are for adults acting for a business. The review flow is not aimed at children under 13, and we do not knowingly collect data about them. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes and contact
We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will email account holders at least 30 days before it takes effect.
Artjoms Lupjaks, Riga, Latvia. Email: hello@bifre.com.