Privacy Policy

Who we are

Spyingbee is a remote-first competitor monitoring platform. When this policy says "we", "us", or "our", it means Spyingbee as the data controller responsible for your personal data. Contact: support@spyingbee.com.

What we collect

• Account: name and email when you sign up
• Service data: competitors you track, your preferences, and AI-generated signal reports
• Technical: IP address, browser type, and session identifiers (for security)
• Payment: billing info processed by Paddle, our merchant of record. We never see or store your card number.

Why we process it

Under the GDPR, we need a legal basis for each type of processing:

• To run the service (contract): monitoring competitors, sending notifications, managing your subscription
• To keep things secure (legitimate interest): abuse prevention, session management, service improvements
• Product analytics (legitimate interest): PostHog, on EU infrastructure, to understand how the product is used and where it fails. We honour Do Not Track, and we never sell this data or share it with advertisers.
• Marketing analytics and advertising (consent): Google Analytics and the LinkedIn Insight Tag, only if you accept cookies
• Legal requirements (obligation): tax records, law enforcement requests

Cookies

The session cookie is strictly necessary and does not require consent. Our own product analytics (PostHog, on EU infrastructure) run on every visit so we can see which parts of the product get used and where people get stuck; we honour Do Not Track, and that data is never sold or passed to advertisers. Google Analytics and the LinkedIn Insight Tag are different: the LinkedIn tag is an advertising tag, and neither loads unless you accept cookies.

One exception the cookie banner cannot reach: if your browser has JavaScript turned off, a single LinkedIn tracking pixel embedded in the page HTML still loads.

You can change your choice at any time from "Cookie preferences" in the site footer. Declining stops us loading these tags on later page views; it does not remove cookies already stored on your device — clear those in your browser.

Who we share data with

We never sell your data. We only share it with the services needed to run Spyingbee. The full list is on our sub-processors page.

Your data is stored in the EU (Hetzner, Helsinki, Finland). Some sub-processors are based outside the EU (Paddle is UK-based; Resend is US). For those transfers, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

• Your account: deleting your account in Settings signs you out everywhere and removes you from your workspace immediately. The account record itself, including your email address, stays in our database — we do not run an automated purge.
• Your workspace: tracked competitors, signals, briefs, saved views and assistant conversations belong to the workspace rather than to you personally, and stay with it after you leave.
• Competitor monitoring data: the pages we crawl are public web content. It is shared across every workspace tracking the same company and is kept indefinitely.
• Activity logs: 90 days, deleted automatically
• Other automatic clean-ups: raw crawled page content is stripped after 30 days, page-timing records after 30 days, AI usage records after 90 days, and read/unread state after 180 days
• Session recordings: 30 days
• Payment records: as required by tax law (typically 7 years), held by Paddle as merchant of record

Closing your account deactivates it; it does not by itself erase it. Your rights over that data, and how to exercise them, are set out below.

Your rights

Under the GDPR, you can:

• Access your data
• Correct inaccurate data
• Delete your account and data
• Export your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent for analytics cookies at any time

To exercise any of these, email support@spyingbee.com. We respond within 30 days.

Security

All connections use TLS encryption. Database connections are encrypted. Access to production systems is restricted. Our infrastructure runs in Hetzner's ISO 27001-certified data center in Helsinki, Finland.

Complaints

If you think we are handling your data incorrectly, please reach out to support@spyingbee.com first. You also have the right to file a complaint with your local data protection authority.

Changes

If we make material changes to this policy, we will notify you by email at least 30 days before they take effect.