Legal
Privacy Policy
Last updated: October 1, 2026
At Buena.ai, we are committed to protecting your privacy and ensuring transparency about how we handle your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use and share it, and what rights you have regarding your data. This policy applies to all personal data processed through our website (buena.ai), our AI-powered sales intelligence platform, and any related services. It is designed to comply with the EU General Data Protection Regulation (GDPR), applicable U.S. privacy laws, and ISO 42001 standards for AI management systems.
1. Data Controller
Who We Are
Buena AI, Inc. ("Buena.ai", "we", "us", "our") is the data controller responsible for your personal data. We are committed to protecting and respecting your privacy in accordance with the General Data Protection Regulation (GDPR), applicable U.S. privacy laws, and ISO 42001 standards for responsible AI governance.
Contact Information
For any questions about this policy or your personal data, contact our Data Protection team at [email protected]. Our registered address is available upon request.
2. Categories of Personal Data We Collect
Identity & Contact Data
Full name, email address, phone number, company name, and job title — collected when you fill out forms, request demos, sign up for newsletters, or contact us.
Prospect and Lead Data
When customers use Buena to find and contact potential business contacts, we process information about those people (prospects): names, job titles, employers and company details, professional profile URLs such as LinkedIn profiles, business contact details including work email addresses, and, only when a customer specifically requests it, personal email addresses. To personalize outreach, we also process publicly available professional information such as recent posts and company news. This data comes from publicly available professional sources through our people-search providers, from data-enrichment providers, and from lists our customers upload. We process it on the basis of our and our customers' legitimate interests in business-to-business prospecting, share it with the customer who requested it and with the providers that help us find and verify it, and keep it for 24 months from the last interaction, as described in Data Retention. If you are a prospect, you can object to this processing or ask us to delete your data at any time through our data request form at buena.ai/data-deletion-request.
Technical & Device Data
IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, click patterns, and timestamps of your visits — collected automatically through server logs and cookies.
Usage & Analytics Data
With your analytics consent, we use Google Analytics to measure visits and our self-hosted OpenReplay service at rp.buena.ai to record website interactions, including pages viewed, clicks, scrolling, navigation, and session duration. OpenReplay records a reconstruction of the website, not your camera, microphone, or other applications. Form contents and editable fields are excluded, email addresses in page text are masked, and network request bodies, headers, and console messages are not recorded. Page URL query strings and fragments are removed from recorded navigation events.
Marketing & Communications Data
Your preferences for receiving marketing communications, newsletter subscription status, UTM campaign parameters, and your communication history with us.
Whop Pixel Data
With marketing consent, the Whop Pixel collects page addresses and titles, referring pages, visit times, campaign and advertising-click identifiers, IP address and browser/device information, cookie and local-storage identifiers, and a device fingerprint derived from browser and device characteristics. It records successful demo requests and founding applications using a unique event identifier. Our pixel integration disables automatic contact-field collection and does not add names, email addresses, phone numbers, application answers, prospect records, messages, or payment-card details to these events. Pages containing invitation or authentication tokens and private workspace pages are excluded from pixel measurement.
Transaction Data
Details of services you have subscribed to, payment information (processed by third-party payment processors — we do not store full payment card details), and billing history.
3. Lawful Bases for Processing
Consent (Article 6(1)(a) GDPR)
We process your data based on your explicit consent for: marketing communications and newsletters, non-essential cookies and analytics tracking, and optional data sharing with partners. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Contractual Necessity (Article 6(1)(b) GDPR)
We process your data where necessary to perform a contract with you or to take steps at your request before entering into a contract, including: providing our AI-powered sales intelligence platform, managing your account and delivering requested services, processing demo requests and responding to inquiries.
Legitimate Interest (Article 6(1)(f) GDPR)
We process your data based on our legitimate interests, balanced against your rights, for: improving and optimizing our website and services, detecting and preventing fraud or spam, internal analytics and business intelligence, including cookieless aggregate traffic measurement with Cloudflare Web Analytics, ensuring network and information security. You have the right to object to processing based on legitimate interests.
Legal Obligation (Article 6(1)(c) GDPR)
We process your data where required to comply with legal obligations, including: tax and accounting requirements, responding to lawful requests from regulators or law enforcement, maintaining records as required by applicable law.
4. How We Use Your Data
Service Delivery & Support
To provide, maintain, and improve our AI-powered B2B sales intelligence platform; to process your requests, demos, and inquiries; to manage your account; and to provide technical support.
Communications
To send transactional emails related to your account or requests; to send marketing communications where you have opted in; to respond to your inquiries. You can unsubscribe from marketing emails at any time via the link in each email.
Analytics & Improvement
To analyze usage patterns and improve our website and services; to conduct A/B testing and feature development; to generate aggregated insights. We use Google Analytics with Google Consent Mode. Analytics cookies and cookie-based measurement remain disabled unless you consent to analytics cookies. Before consent, Google may receive limited, cookieless consent and measurement signals. You can withdraw consent at any time through Cookie preferences in the footer.
Cookieless Traffic Measurement
Cloudflare Web Analytics measures aggregate visits and page loads on buena.ai and its subdomains, for visitors in every country, including the European Union, the European Economic Area and the United Kingdom. It does not use cookies or local storage and does not fingerprint your device. It processes the page address, referring page, browser, operating system and device type, and page-load performance, and uses your IP address only to determine your country. We see only aggregate counts, not individual visitors, and use them under our legitimate interest in understanding how our website is used, so it runs regardless of your cookie choices. You can object by contacting us, or prevent it by blocking static.cloudflareinsights.com in your browser.
Session Recordings
OpenReplay helps us understand navigation and usability problems on buena.ai. Its recorder is loaded only after you accept analytics and sends recordings to our self-hosted service at rp.buena.ai. It respects the browser's Do Not Track setting. Declining or withdrawing analytics consent stops recording. Withdrawing consent does not automatically delete recordings already received; you can request deletion using the contact details or Data Request Form below.
Business Visitor Identification
After you accept analytics, we use RB2B to help identify business visitors and understand interest in our services. RB2B and its identity partners may process IP addresses, browser and cookie identifiers, page URLs, referrers, and visit information, and match them with their networks to return professional profiles or company information where available. Person-level identification is limited to eligible US visitors and is not available for every visit. Our integration does not load when Do Not Track or Global Privacy Control is enabled. You can withdraw consent through Cookie preferences; this stops future tracking and removes RB2B storage accessible to this website. Withdrawal does not automatically delete previously collected data. See https://www.rb2b.com/privacy-policy for RB2B's practices and opt-out information, or use our Data Request Form below.
Whop Conversion Measurement
We use Whop Pixel data to understand which pages and campaigns lead to applications and purchases, measure advertising performance, and improve our marketing. Whop can connect visits across buena.ai and engage.buena.ai and associate them with payments it processes. Whop may share conversion information with advertising platforms involved in attribution. The pixel is loaded only after a separate marketing opt-in, and stays off when Global Privacy Control or Do Not Track is enabled. Consent is optional and can be withdrawn through Cookie preferences on either site. Declining marketing does not prevent payment processing or the transaction records needed to provide your membership.
Security & Fraud Prevention
To detect, prevent, and respond to security incidents, fraud, spam, and abuse; to maintain audit logs for compliance; to enforce our terms of service.
5. How We Share Your Data
Service Providers (Data Processors)
We use service providers for website and application hosting, databases, email delivery, analytics, and payment processing. Buena's marketing website and Engage application are hosted on our Hetzner VPS. Cloudflare provides content delivery, security filtering, and cookieless traffic measurement for buena.ai. Google Analytics receives website measurement information, and RB2B and its identity partners receive business visitor information with analytics consent, as described above. Whop receives information needed to process payments and provide its services, and receives pixel data only with marketing consent. Whop's handling of information, international transfers, retention, and privacy choices are explained in its privacy policy, linked below.
AI Assistant Connections (MCP)
If you connect an AI assistant such as Claude, ChatGPT, Claude Code, or Codex to Buena through the Buena MCP or a Buena plugin, you sign in with your Buena account and authorize that assistant to act within your Buena permissions. Buena then sends the results of the actions you request, which can include your workspace data and prospect data, to the AI service you connected, where they are processed under that provider's own terms and privacy policy. Buena receives only the requests your assistant sends to Buena's tools, not the rest of your conversation. Access tokens expire after a few minutes, and you can disconnect the assistant at any time in its settings.
Legal Requirements
We may disclose your data if required by law, regulation, legal process, or enforceable governmental request, or to protect the rights, privacy, safety, or property of Buena.ai, our users, or the public.
Business Transfers
In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred. We will notify you via email and/or prominent notice on our website of any change in ownership and your choices regarding your data.
Advertising Sharing and Your Choices
We do not sell personal information for money. Disclosing identifiers and conversion information to advertising partners may be treated as a sale or sharing under some US state privacy laws. You can opt out of Whop Pixel sharing by declining marketing in Cookie preferences; we also respect Global Privacy Control and Do Not Track for this integration. To exercise applicable rights over information already collected, use the Data Request Form or contact our privacy team.
6. Data Retention
Retention Periods
Lead and contact data: retained for 24 months from last interaction, then anonymized or deleted. Account data: retained for the duration of your account plus 12 months after closure. Analytics data: aggregated and anonymized after 26 months. Marketing consent records: retained for 5 years for compliance documentation. Transaction records: retained for 7 years as required by tax law.
Deletion & Anonymization
When data reaches the end of its retention period, it is either securely deleted or irreversibly anonymized so it can no longer be linked to you. You may request earlier deletion at any time (see Your Rights below).
Whop Identifiers and Consent Choices
Whop's first-party visitor cookies may last up to two years and may be refreshed on later consented visits. Its local-storage identifiers remain until removed, for example by clearing browser storage or withdrawing consent on that site. We save your marketing choice in a necessary consent-preference cookie for six months, shared between buena.ai and engage.buena.ai. Withdrawal stops future pixel tracking and clears Whop identifier storage accessible on the current site, including shared-domain identifier cookies. Other Buena tabs recheck the shared choice. Withdrawal does not erase information previously received by Whop; its retention practices and rights process are described in its privacy policy. You can also ask Buena for assistance through the Data Request Form.
7. Your Rights as a Data Subject
Right of Access (Article 15 GDPR)
You have the right to obtain confirmation of whether we process your personal data, and to request a copy of the data we hold about you, free of charge.
Right to Rectification (Article 16 GDPR)
You have the right to request correction of inaccurate personal data or completion of incomplete data we hold about you.
Right to Erasure / Right to Be Forgotten (Article 17 GDPR)
You have the right to request deletion of your personal data where: it is no longer necessary for the purposes it was collected, you withdraw consent (where consent was the basis for processing), you object to processing and there are no overriding legitimate grounds, or the data has been unlawfully processed. Use the Data Request Form below to submit a deletion request.
Right to Restrict Processing (Article 18 GDPR)
You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.
Right to Data Portability (Article 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance.
Right to Object (Article 21 GDPR)
You have the right to object to processing based on legitimate interests or direct marketing at any time. Where you object to direct marketing, we will stop processing your data for that purpose immediately.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. You may also contact us first and we will endeavor to resolve your concern.
How to Exercise Your Rights
To exercise any of these rights, use the Data Request Form at the bottom of this page, or email [email protected]. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.
8. Cookies and Tracking Technologies
Cookie Categories
Necessary cookies support site functionality, security, sign-in, payments, and consent preferences. On buena.ai, optional analytics covers Google Analytics, OpenReplay and RB2B. Optional marketing covers the Whop Pixel on buena.ai and the application and checkout flow on engage.buena.ai. Analytics and marketing have separate choices and are not required to apply or purchase.
Cookie Consent
Our cookie controls offer separate analytics and marketing choices, with optional categories off until you select them. Google Analytics loads with analytics, advertising, and personalization consent denied by default, so it may send limited cookieless signals before analytics acceptance. OpenReplay and RB2B on buena.ai load after analytics acceptance; Whop Pixel loads only after marketing acceptance. Cloudflare Web Analytics runs regardless of these choices, for visitors in every country, because it does not use cookies or local storage. Existing analytics consent does not authorize Whop marketing tracking. Use Cookie preferences to decline or withdraw consent at any time. Withdrawing Whop consent stops future pixel activity and reloads the page to stop the loaded vendor script. Marketing choices are shared across buena.ai and engage.buena.ai; analytics choices remain local to buena.ai.
9. International Data Transfers
Transfer Mechanisms
Your data may be transferred to and processed in the United States or other countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including: Standard Contractual Clauses (SCCs) approved by the European Commission, data processing agreements with all service providers, and adequacy decisions where applicable.
10. Data Security
Technical Measures
We implement encryption in transit (TLS/SSL) and at rest, access controls and authentication, regular security assessments, and secure development practices. Our infrastructure providers maintain SOC 2 certifications.
Organizational Measures
Access to personal data is restricted to authorized personnel on a need-to-know basis. All staff with access to personal data are bound by confidentiality obligations. We maintain incident response procedures and will notify affected individuals and authorities of any data breach within 72 hours as required by GDPR.
11. Children's Privacy
Age Restrictions
Our services are B2B enterprise tools not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will delete it promptly.
12. Stakeholder Rights & Obligations (ISO 42001)
Customers
As a customer, you have the right to transparent information about how our AI systems process your data, the ability to request human review of automated decisions, clear documentation of our AI capabilities and limitations, and access to support channels for privacy concerns.
Regulators
We maintain compliance documentation, conduct regular impact assessments, and cooperate with supervisory authorities. We proactively monitor changes in privacy and AI regulation to ensure ongoing compliance.
Society & Public Interest
We are committed to responsible AI development and deployment. We assess the broader impact of our AI systems on society, maintain transparency about our AI practices, and ensure our systems do not produce discriminatory outcomes. Our AI governance framework aligns with ISO 42001 standards for AI management systems.
Employees & Partners
Our employees and partners are trained in data protection practices, bound by confidentiality agreements, and required to report any potential data protection issues. We maintain clear policies and procedures for handling personal data throughout our organization and supply chain.
13. Changes to This Policy
Updates
We will update this Privacy Policy when our practices change or when required by law. Material changes will be communicated via email to registered users and through a prominent notice on our website at least 30 days before they take effect. The 'Last Updated' date at the top of this page indicates when the policy was most recently revised. Previous versions are available upon request.
Whop privacy information and tracking choices
Read Whop’s Privacy Policy for its practices and rights process. You can change Buena’s optional tracking choices here:
Data Subject Request Form
Use this form to exercise your data rights under GDPR, including data deletion, access, rectification, portability, or restriction of processing. All requests are logged, tracked, and processed within 30 days.