Privacy Policy

LBD S.r.l., Via Maso della Pieve 4C, 39100 Bolzano (BZ), Italy — VAT 03305620217, REA BZ-249001.

For anything concerning personal data: [email protected], or +39 0471 362875 (Monday to Friday, 09:00–13:00 CET). We have not appointed a Data Protection Officer, as the conditions in Art. 37 GDPR do not apply; requests sent to that address are handled by the controller.

This policy covers: (a) browsing b-comm.io; (b) the contact you send us by email or telephone; (c) managing the contractual relationship with our customers.

It does not cover the processing a customer company carries out through the product on its own contacts’ data: for that, the controller is the company you are talking to, and it must give you its own privacy notice. The section "When we are a processor, not a controller" explains what we do in that case.

This policy also explains how LBD handles Google account identity data and data from the optional Google Calendar and YouTube integrations. When we process this data for a Customer’s workspace, the Customer remains the controller and LBD acts on its instructions under the DPA.

Browsing data

The systems serving the site automatically record some technical data needed for operation and security: IP address, date and time of the request, page requested, response status, browser and operating system type, preferred language. This data is not used to identify you or to profile you, and is not combined with other sources.

Data you give us

There is no contact form on this site: if you want to write to us you do it from your own mailbox, at [email protected]. In that case we process the data you chose to include in the message — typically name, email address, company and the content of the enquiry. The same goes for phone calls: we record any notes taken during the call, not the call itself.

Cookies and similar technologies

The site uses technical cookies only, described in detail in the Cookie Policy. There are no profiling cookies and no third-party analytics; should we introduce any in future, they will be activated only with your prior consent collected through the banner.

Providing data is voluntary. Without the minimum necessary data, however, we cannot answer an enquiry or manage an agreement: the only consequence of declining is that we cannot deliver what was asked for.

Data may be accessed by LBD’s authorised staff, instructed under Art. 29 GDPR, and disclosed to suppliers acting as processors appointed under Art. 28 GDPR. We do not sell personal data and do not disclose it to third parties for their own marketing purposes.

Data may also be disclosed to tax and legal advisers, to banks for collection, and to authorities where required by law or by an order.

The suppliers currently used to run the site and the product are listed below. Some are involved only if the customer activates the corresponding feature.

The list is current as at the date of this policy. Customers who have signed the DPA receive advance notice of changes to sub-processors and may object within the terms set out there.

The main infrastructure and the product data reside in the European Union. Some of the suppliers listed above are based in the United States: transfers to them rely on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and, where applicable, on the supplier’s certification under the EU–US Data Privacy Framework, together with supplementary measures such as encryption in transit and minimisation of the data transmitted.

Artificial intelligence providers receive only the content strictly necessary to generate the reply. That content is not used to train their models.

Retention periods are set out in the purposes table. At the end of the period, data is deleted or irreversibly anonymised, unless a legal provision requires longer retention or the data is needed to establish, exercise or defend a legal claim.

You may exercise the rights under Articles 15–22 GDPR at any time:

• access: find out whether we process your data and obtain a copy of it;
• rectification: correct inaccurate data or complete incomplete data;
• erasure: have data deleted, in the cases provided by law;
• restriction: ask that data be stored but not further processed;
• portability: receive data in a structured, machine-readable format, or have it transmitted to another controller;
• objection: object to processing based on legitimate interest, including direct marketing, at any time and without giving reasons;
• withdrawal of consent: where processing is based on consent, withdraw it, without affecting the lawfulness of processing already carried out.

To exercise them, write to [email protected]. We reply without undue delay and in any case within one month, extendable by two months for complex requests, in which case we explain why. Exercising your rights is free, except for manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or with the supervisory authority of the Member State where you live.

We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect people, within the meaning of Art. 22 GDPR.

The product includes an artificial intelligence agent that drafts automated replies to incoming messages. That agent does not take decisions about people: when a request falls outside the configured perimeter, the conversation is handed to a human agent. The hand-off rules are configured by the customer company, which remains the controller.

If you wrote to a company that uses LBD Business Communicator — on its website, on WhatsApp, by email or from its app — your data is in that company’s workspace. That company decides why and how it is processed, and it is the one to approach to exercise your rights. We process it only on its instructions, to make the service work for it.

If you write to us anyway, since we cannot dispose of that data ourselves, we will forward your request to the controlling company where we are able to identify it, and tell you that we have done so.

With our customers we apply a Data Processing Agreement compliant with Art. 28 GDPR, covering instructions, confidentiality, security measures, use of sub-processors, assistance with data subject requests, breach notification, audits, and return or deletion of data at the end of the relationship.

Social integrations are optional. An authorised Customer user connects the profiles, Pages, Pinterest accounts or YouTube channels they want to use through OAuth and selects the identities intended for the current workspace. Each connection’s permissions and data are stored in its own workspace: connecting an account does not make it available to other workspaces.

To perform the features enabled by the Customer, we process account and content identifiers, profile or channel names, usernames, profile images, public addresses, granted permissions and encrypted OAuth tokens. We can read content and its metadata only within the permissions actually granted and the available APIs. We send providers the text, files and metadata that authorised users choose to publish, including through workspace scheduling or approval.

Where we process this data on the Customer’s behalf, the Customer remains the controller and LBD follows its instructions and the DPA. Providers also process data under their own notices and terms; connecting a channel does not automatically make its provider an LBD sub-processor. The LinkedIn and Pinterest privacy notices are available here:

• LinkedIn Privacy Policy
• Pinterest Privacy Policy

Connecting Google Calendar is optional and applies to the teammate and workspace in which it is confirmed. We receive the Google account email address and account identifier to identify the connected account. We store the granted permissions, encrypted OAuth tokens and connection status and, when available, the primary calendar’s time zone and whether Google Meet is available. We do not receive the Google account password.

The integration creates, updates and cancels events for appointments booked through LBD on the connected account’s primary calendar and, when enabled, creates a Google Meet link. We send Google the appointment title, start and end times, time zone and description; the description can include the guest’s name, email address and an appointment note. We read the relevant event’s synchronization and conference information and retain its event identifier, version identifier (ETag), Meet link and synchronization status to update the booking and provide its join link. The current feature does not import the user’s calendar as a contact list or knowledge source. Appointment confirmations and join links are sent by LBD to the selected participants; the integration does not add them as Google event attendees.

Connection identity, permissions and tokens are retained while the connection is kept. Disconnecting Google Calendar deletes that connection and its stored tokens from LBD and attempts to revoke the Google authorization. This revocation may also affect other connections that use the same Google authorization. Disconnecting does not delete events already created in Google or the Customer’s appointment history: event references, synchronization information and existing Meet links remain associated with the bookings for as long as the Customer retains that history. To request erasure of data held by LBD, contact the Customer that controls the workspace or [email protected], identifying the workspace and account without sending passwords or tokens. Such requests are handled under the rights and processor sections of this policy and applicable legal obligations. Events held in Google can also be managed directly in Google Calendar.

LBD Business Communicator’s use and transfer of data received from Google Workspace APIs, including raw, aggregated and derived data, comply with the Google API Services User Data Policy and its Limited Use requirements.

Our Google Calendar and YouTube integrations are separate from the application’s AI features. Data obtained through these integrations are not sent to AI/ML services or used as inputs for AI features.

We do not use, transfer or sell data received from Google APIs, including raw, aggregated or derived data, to create, train or improve foundational or general-purpose AI/ML models.

Google integration data is used only to provide the features authorised by the user. Access by workspace users is limited to those authorised by the Customer. LBD personnel may read Google integration data only with the user’s specific affirmative permission for support, when necessary for security purposes such as investigating bugs or abuse, or to comply with applicable law. Data is transferred to Google to carry out the requested operations and, as necessary, to the hosting, storage, security and email delivery providers that operate the service on our instructions; selected meeting participants receive the appointment details and join links needed for their meeting. OAuth tokens are encrypted at rest, public connections use HTTPS, and workspace access controls and database isolation restrict access. We do not sell Google user data or use or transfer it for advertising, marketing profiling, creditworthiness assessments or lending decisions. As stated above, data obtained through the Google integrations is not sent to AI/ML services or used as input for AI features.

• Google API Services User Data Policy
• Google Workspace API User Data and Developer Policy

The YouTube feature uses YouTube API Services. With OAuth permission, we can access identifiers and metadata for authorised channels and videos, such as the channel name, title, description, thumbnails, video address, publication status and visibility. To publish, we send Google the selected video and the details chosen by the user, such as title, description, tags, category, visibility and audience or synthetic-content declarations. We do not receive your Google account password. We also read aggregate engagement counts, such as the numbers of likes and comments, to display them alongside the authorised channel’s videos in the workspace.

We refresh or delete stored copies of data obtained from the YouTube APIs within 30 days. This rule concerns data returned by the APIs, rather than content the Customer has independently written or uploaded. You can request deletion of API data held by LBD: we delete it as soon as possible and no later than 7 calendar days after the request.

A workspace administrator can use Settings → Channels → Social publishing → YouTube → Delete stored YouTube API data, with explicit confirmation. This action covers all YouTube connections in the current workspace only: it removes account and post API data and the connected channels’ OAuth authorisation tokens, including API fields on historical posts, and disconnects the channels. If an upload is active, the request remains recorded as pending while it finishes; new YouTube connections and publishing in that workspace are paused. Workspace application settings, including a BYO client ID and client secret, are not removed by this action. You can also write to [email protected] identifying the workspace and channel, without sending passwords or tokens.

Local API-data deletion does not delete videos published on YouTube. Files uploaded by the Customer, captions and other user-authored text, drafts and workspace history remain, with the deleted API fields removed. This content remains subject to the Customer’s instructions and other applicable retention rules. Simply removing one channel from the workspace is separate from requesting API-data deletion.

Revoking Google consent is a separate action on your personal Google permissions page. Revocation may also affect Google Calendar and connections in other workspaces that depend on the same authorisation. Local deletion does not automatically perform that revocation. Google processes data under its own Privacy Policy, and use of YouTube is subject to its Terms of Service.

• Open the workspace Social publishing settings
• Request deletion at [email protected]
• Manage or revoke your Google account permissions
• Google Privacy Policy
• YouTube Terms of Service

We adopt technical and organisational measures appropriate to the risk, including:

• encryption of traffic in transit on all public channels;
• separation of data between customer companies enforced by the database itself, as well as by the application;
• separation of content between the different audiences each customer configures;
• agent authentication through a dedicated identity system, with granular roles and permissions;
• audit logs of the operations agents perform;
• system access limited to authorised staff, on a least-privilege basis;
• periodic backups and restore procedures;
• regular updating of software components and monitoring of known vulnerabilities.

In the event of a personal data breach we notify the supervisory authority within 72 hours of becoming aware of it, where the legal conditions are met, and inform data subjects where the breach is likely to result in a high risk to their rights and freedoms. Where we act as processor, we inform the controlling customer without undue delay so that it can meet its own obligations.

The site and the product are aimed at professionals and businesses and are not intended for children under 16. We do not knowingly collect children’s data. If you believe a child has given us personal data, write to us and we will delete it.

We may update this policy to reflect changes in the service, in our suppliers or in the law. The version in force is always the one published on this page, with its last-updated date. We inform customers by email of material changes.