Privacy Notice
What personal data bvsly processes, why and for how long.
Version v09 · Last updated: 29.10.2026
Controller: BVS DOCTORS LTD — registered in England and Wales (Company No. 16987192), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("bvsly", "we"). ICO registration number ZC163104. Contact: privacy@bvsly.com
bvsly is a service for short links, QR codes, notebooks (link boards), personal pages (bvsly.com/@name) and Transfer (time-limited file sending and file requests), with its panel and app. This notice explains what personal data we process when you click a bvsly link, view a page or notebook, open an account, pay, or write in the help window — why, on what lawful basis and for how long.
1. What we process and why
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Link or page visit: IP address, user agent, device type, country and city estimated from the IP, referring page, date and time, QR flag | Redirecting; aggregate statistics for the owner (they never see your IP or anything identifying you); preventing abuse | Legitimate interests (UK GDPR art. 6(1)(f)) | The statistics record never keeps the IP, only an irreversible hash; city and full referrer are removed after 30 days. The full record is kept in a restricted security archive for 2 years, then the IP and browser data are deleted. |
| Account: email, language, plan, last sign-in; with Google or Apple sign-in, that account's email (may be an Apple hide-my-email address) | Providing your account | Contract (art. 6(1)(b)) | While the account is open. 7 days after Delete my account, personal fields are anonymised and files deleted; short codes are never reassigned. |
| Sign-in code record: email, code hash, IP hash, attempts | Secure sign-in; preventing code guessing | Contract · legitimate interests | Codes are valid for 10 minutes; records are anonymised after 30 days. |
| Trial link without an account: destination, token derived from the IP | Applying the daily limit | Legitimate interests | The link closes after 7 days; the token is anonymised 30 days after closing. |
| Notebooks and pages: content, editor emails, the Google email of private-notebook viewers, phone number for notebook SMS sign-in | Sharing and access control | Contract | While the notebook or page exists; codes are valid for 10 minutes. |
| Personal page photo | Publishing; inappropriate-content check (see section 5) | Contract · legitimate interests | While the page exists; rejected photos are not stored. |
| Transfer: files, names, sizes, recipient emails, download record (IP hash, country, time) | Delivering files and notifications, preventing abuse | Contract · legitimate interests | Files uploaded from outside are deleted after 7 days; files sent by the account holder stop being downloadable after 30 days and are deleted on day 90; the IP hash in download records is deleted after 12 months. |
| Payments: name, email, billing address, tax ID if given, plan and amount (card details stay with Stripe) | Taking payment, invoicing, tax and accounting | Contract · legal obligation (art. 6(1)(c)) | Accounting records 6 years. |
| Help window: your messages, the assistant's replies, page address, language, a daily-changing irreversible token; your email if you pass the question to the team | Support | Legitimate interests · your request for hand-off | Deleted automatically after 30 days. Card-number-like sequences are removed before saving or sending to the model. |
| Link reports and emails you send us | Reviewing and replying | Legitimate interests | 2 years. |
Data is collected automatically through server logs while you use the service, and through the forms you fill in (sign-in, Transfer, reports, payment, help).
2. What a link owner sees
Owners of links, notebooks and pages only see aggregate counts (clicks, country, device type, referring site) — never your IP, browser data or anything identifying you.
3. Health and other special category data
bvsly does not collect special category data by itself. Files sent with Transfer (e.g. MRI images, reports) may contain health data. The send screen has a separate confirmation box: the sender confirms the data is their own or that they have the data subject's explicit consent (UK GDPR art. 9(2)(a)); sending without it is refused. We store such files only to deliver them, for the period above, and do not review their content. Please do not write health details, passwords or card numbers in the help window.
4. Who processes it
We do not sell your data or use it for advertising. We work with these providers:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Network, application, file storage (R2), Access sign-in, bot protection (Turnstile), browser libraries (cdnjs) | All traffic, files | Global network; company in the US |
| Supabase | Database | The records above | Frankfurt, Germany (EU) |
| Amazon Web Services (SES) | Sending email (codes, notifications, confirmations, agreements) | Email address, message | Frankfurt region (EU) |
| Stripe | Payments, subscriptions, invoices, tax calculation | Payment data | US / EU / UK (Stripe entities) |
| Anthropic (Claude) | Help window replies | Help conversation | US |
| Safe Browsing (only the destination of a new link), Google sign-in, Gemini (only personal page photos and demos sent to the music box) | The data concerned | US / global | |
| Apple | Sign in with Apple | Apple account email | US |
| abuse.ch (URLhaus) | Checking only the destination of a new link | Destination | Switzerland |
| Twilio · NetGSM | SMS code for notebook sign-in (+90 numbers via NetGSM, others via Twilio) | Phone number, code | Twilio US · NetGSM Turkey |
| Telegram | Internal alerts to our team (e.g. a new upload); email addresses masked | Alert text | Global |
| YouTube (Google) | Thumbnails of YouTube videos added to a notebook or page load from Google in your browser | Your IP address (to Google) | US |
Fonts are served from our own server; your browser does not contact Google for them. Some providers are outside the UK, the EU and Turkey; data is transferred only as far as the service needs and under the providers' data processing terms and security measures. We may disclose data where the law requires it.
5. Automated checks and AI
- New link destinations are checked automatically (Google Safe Browsing, URLhaus, Cloudflare DNS filtering, a block list of shorteners). A link that breaks the rules is not created or is stopped.
- Photos uploaded to a personal page are screened by AI (Google Gemini) for inappropriate content; rejected photos are not stored.
- Demos sent to the music box are listened to by AI (Google Gemini) to check that they are music and which genre.
- Help window replies are generated by AI (Anthropic Claude) and can be wrong; you can ask for your question to be passed to a person.
If one of these checks affects you (e.g. your link was stopped), you can ask for a human review at privacy@bvsly.com
6. Cookies
We only use cookies and browser storage that the service needs or that hold settings you chose; there are no advertising, tracking or analytics cookies, so no consent banner appears. List: bvsly.com/cerez?dil=en
7. Your rights
Under the UK GDPR (art. 15–22) and the Turkish KVKK (art. 11) you can ask for access and a copy, rectification, erasure, restriction, objection, portability and human review of automated checks.
- How: privacy@bvsly.com (from your account email) or in writing to our registered office.
- When: within one month, free of charge.
- Complaints: UK — Information Commissioner's Office (ico.org.uk, 0303 123 1113) · Turkey — Personal Data Protection Board.
8. Changes
We may update this notice and will email account holders about important changes. Previous versions are kept.