Privacy is built into every part of the Freshvista AI analysis platform.
Effective: November, 2025 • Last updated: November, 2025
Contact us any time at info@freshvista.ai. We handle a range of personal information—including protected health information (PHI), financial data, and biometric data—and we design our Services with privacy-safe defaults. When we process PHI for healthcare customers, we do so under HIPAA and a signed Business Associate Agreement (BAA). For EU/EEA personal data we follow GDPR, and when we act as a processor for business customers we operate under a signed Data Processing Addendum (DPA).
Industry note: our Services are not intended for military or defense uses. Please review our Terms of Service for other prohibited uses.
Plan-specific safeguards: every plan includes encryption in transit and at rest, role-based access with least privilege, and continuous monitoring. Enhanced contractual protections—such as HIPAA BAAs or GDPR DPAs—are available only on eligible Business/Enterprise plans. Lower tiers are not designed or permitted for PHI or other regulated data.
People who sign up directly, upload their own content, and manage their data within a personal workspace.
Companies—such as healthcare providers, financial institutions, research teams, specialized data teams, and other organizations of every size—that provision user access, connect data sources, and manage shared workspaces across their teams.
We are the Controller of your personal data. We determine how it is processed to deliver the Services you requested, and we respond directly to your privacy requests.
Your organization is the Controller (or “Business” under certain U.S. laws). We act as their Processor/Service Provider under a DPA (and, where required, a BAA). Please route privacy requests through your organization; we assist them under contract.
PHI may be uploaded only on HIPAA-enabled plans after a BAA is executed. EU/EEA personal data processed on behalf of an organization requires a signed DPA before data enters Business/Enterprise workspaces. If no BAA/DPA is in place (as applicable), do not upload PHI, special-category data, or other regulated data; such content may be removed.
By using the Services you acknowledge this Privacy Policy and our Terms of Service. When the law requires consent (for example, certain cookies or sensitive data uses), we will request it explicitly. This Policy covers what we collect, how we use and share it, and the choices and rights available to you.
Name, email, organization, authentication data, payment method, and billing contact details.
Inferred location, device/session metadata, authentication events, feature usage, queries submitted, results generated, timestamps, and diagnostic events needed to run and secure the Services.
Files or data sources you or your organization upload (e.g., .xlsx, .csv, .parquet, documents, IDs, education records, or sensitive data).
AI-generated summaries, transformations, or other outputs stored in your workspace until you delete them.
See Cookies & Similar Technologies below for more detail on what we place and how you can control it.
Legal bases (EU/EEA): contract necessity (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), consent (including explicit consent where required for special-category processing in B2C), and legal obligation (Art. 6(1)(c)). Special-category data (Art. 9) is processed under the customer’s legal basis (B2B) or in B2C with explicit consent or another permitted ground.
For Covered Entity/Business Associate customers we act as a Business Associate: we sign a BAA, use/disclose PHI only to provide the Services, implement HIPAA-aligned safeguards, support required HIPAA rights, and notify the Covered Entity of incidents on contractual timelines.
Treated as sensitive and used only to provide the Services. When serving GLBA-regulated customers we act as a service provider under contract limits. Payment cards are processed by PCI-validated processors; we do not store full card numbers.
The Services are not intended to collect or create biometric identifiers. If a customer uploads them, that customer must obtain all required notices/consents (e.g., GDPR, Illinois BIPA) and provide retention/deletion instructions. We never sell biometric identifiers and process them only as a processor under the DPA, and never on the Free plan.
For school customers we act as a school official/service provider under contract; there is no secondary use of student data.
PHI or other regulated data is only permitted on HIPAA/GDPR-enabled plans with a signed BAA/DPA. Do not upload such data on lower tiers.
We do not sell personal data or share it for cross-context behavioral advertising.
We may use and share de-identified or aggregated information for analytics, security, or product improvement. We will not attempt to re-identify it and prohibit our processors from doing so.
Send requests for access/portability, correction, deletion, objection/restriction, or marketing opt-out to info@freshvista.ai.
Contact your organization (the Controller) first. We assist them under our DPA/BAA.
We verify identity, respond within 30 days for EU/EEA requests (with one extension if necessary), and may retain limited data required for legal or security obligations. We honor applicable U.S. state rights (access, correction, deletion, opt-out of sale/sharing/targeted advertising—we do not sell/share) and honor Global Privacy Control (GPC) signals. Appeals: reply to our decision and we will review.
We use strictly necessary cookies (login, security, session, performance) plus consent-based analytics (e.g., GA4) and configurable preferences elsewhere. Manage cookies via the in-product banner or Cookie Settings in the site footer. We configure analytics to minimize data collection and never allow advertising personalization.
We honor GPC signals where required, disabling analytics/marketing cookies automatically when detected. See our Cookie Notice for categories, purposes, retention, and vendors.
We are established in the EU/EEA. Data may be accessed from or transferred to countries where we or our providers operate. For EU/EEA transfers to countries without an adequacy decision we rely on EU Standard Contractual Clauses plus supplementary measures (encryption, access controls, vendor diligence, transfer assessments). Enterprise plans can offer EU-only processing options by contract when available.
No method of transmission or storage is 100% secure; we continually improve our controls.
The Services are not directed to children under 16 (or 13 where applicable), and we do not knowingly collect personal data from children. If you believe a child provided data, contact us and we will delete it unless we have a lawful basis and verifiable consent.
Organizations that upload data about minors are responsible for obtaining required notices/consents (e.g., under GDPR, COPPA, FERPA) and for giving correct retention/deletion instructions. We act as a Processor/Service Provider and will process such data only on documented instructions (and on HIPAA-enabled plans with a BAA where PHI is included).
We maintain an incident response plan and promptly investigate, mitigate, and document any personal data breach.
If we are the Controller (e.g., self-serve accounts), we notify the supervisory authority without undue delay and within 72 hours when required, and inform affected individuals if the breach is likely to result in a high risk. When acting as a Processor, we notify the Customer without undue delay (providing facts, impact, and remedial steps for their GDPR Articles 33–34 obligations) and do not notify authorities or individuals unless instructed or legally required. Under HIPAA we notify Covered Entities without unreasonable delay and within contractual/statutory deadlines. We may share information in phases as investigations progress.
We may update this Policy periodically. Material changes will appear here with a new effective date, and we will provide additional notice (such as in-product or email) for significant updates. Continued use of the Services after the effective date constitutes acceptance.
Privacy & security inquiries: info@freshvista.ai
Postal: Freshvista / LyzeData Privacy Team, Čakovec 40000, Croatia
EU/EEA (including Croatia) and United States. HIPAA applies only on HIPAA-enabled tiers with a signed BAA; lower tiers must not accept PHI.
United Kingdom (until a UK Representative is appointed) and Canada (until a Privacy Officer and Law 25 measures are in place).
Brazil (LGPD), South Africa (POPIA), Singapore (PDPA), and Australia once localized notices and contacts are added.
© 2025 LyzeData. All rights reserved.