1. Who We Are (Data Controller)
Duveka GmbH is the data controller for HeyBC.
- Email: info@duveka.de
- Website: duveka.de
If you are an employee using HeyBC through your employer's subscription, your employer is the data controller for your Business Central data; Duveka GmbH acts as a data processor in that context.
2. What Data We Collect
| Data | Purpose | Stored? | Retention |
|---|---|---|---|
| Microsoft user ID (OID) and tenant ID | Identify your account and associate conversations | Yes | Until you delete your account or conversations |
| Chat messages and AI responses | Provide conversation history and continuity | Yes | Until you delete conversations; or account deletion |
| Business Central access tokens | Authenticate API requests to BC on your behalf | No — used per-request only | Not retained |
| Voice audio | Real-time transcription to text | No — processed in transit | Not retained |
| Business Central record data | Display query results in the chat interface | No — returned to client only | Not retained on our servers |
| Aggregated usage metrics | Service improvement (no personal identifiers) | Yes — anonymized | Up to 24 months |
We do not collect your name, email address, profile picture, or any other Microsoft profile data beyond the claims above.
3. How We Use Your Data
We use the data listed above exclusively to:
- Authenticate you and authorize access to the Service.
- Provide and maintain conversation history within the App.
- Execute Business Central API calls you explicitly request.
- Transcribe voice input into text (real-time, no audio storage).
- Monitor and improve the reliability and performance of the Service.
We do not:
- Sell, rent, or share your personal data with third parties for marketing.
- Use your conversation content or Business Central data to train AI models.
- Profile you for advertising purposes.
4. Microphone and Voice Data
The HeyBC mobile and web app may request access to your device microphone for voice input features. The following applies:
- Microphone access is optional. All core features work without it.
- Audio is recorded only when you actively trigger a voice input (by pressing the microphone button or activating hands-free mode).
- Audio is streamed to our transcription service (Duveka ClousAI) over an encrypted HTTPS connection and converted to text.
- Raw audio is never stored by HeyBC or our transcription service after processing.
- You can revoke microphone permission at any time through your device or browser settings.
4a. Device Notifications
If you opt in to notifications, HeyBC may show a system notification on your device when a long-running Business Central query finishes. To help you recognise the notification:
- The notification may include a short preview of your original question (up to 60 characters, truncated with an ellipsis).
- The notification never contains the AI answer, Business Central data, error details, or any other server-side content.
- Notifications are triggered by the app running on your own device — HeyBC does not push notifications from our servers and does not share device tokens with third parties.
- You can turn notifications on or off at any time from the header toggle, or revoke the browser/OS permission through your device settings.
5. Business Central Data
HeyBC accesses your Microsoft Dynamics 365 Business Central environment via the standard BC API v2.0 on your behalf. We act as a pass-through:
- Your BC access token is acquired by your browser/device and forwarded to our backend for each individual API call.
- BC data (customers, orders, etc.) is returned to your client interface and is not persisted on our servers.
- Write operations (creating orders, etc.) are executed only after your explicit in-app confirmation.
6. Google Assistant / App Actions (Android)
The Android app integrates with Google Assistant App Actions ("Ok Google, ask Hey BC…"). This integration:
- Passes only your spoken query text to the App as a URL parameter to open it — no data is shared with Google by HeyBC.
- Is subject to Google's Privacy Policy for the Assistant interaction.
- Does not share Business Central data with Google.
7. Third-Party Services
HeyBC relies on the following sub-processors, each with their own privacy practices:
- Microsoft Azure / Entra ID — authentication. Microsoft Privacy Statement
- Microsoft Dynamics 365 Business Central — ERP data access.
- Duveka ClousAI / OpenRouter — AI inference and voice transcription. Data is processed under data processing agreements.
- Google Play — app distribution (Android). Google Privacy Policy
8. Data Security
We implement appropriate technical and organisational security measures:
- All data in transit is encrypted via TLS/HTTPS.
- Conversation data at rest is stored in an encrypted database.
- Access tokens are short-lived and never written to persistent storage on our servers.
- Backend authentication validates Microsoft JWTs on every request.
No transmission over the internet is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users in the event of a breach that affects their personal data.
9. Data Retention and Deletion
You can delete individual conversations at any time within the App. Deletion removes all associated messages from our database immediately.
If you wish to request complete deletion of all data associated with your account, contact us at info@duveka.de with your Microsoft tenant ID and user OID. We will process deletion requests within 30 days.
10. Your Rights (GDPR)
If you are located in the European Economic Area (EEA) or the UK, you have the following rights under GDPR:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate data.
- Right to erasure — request deletion of your personal data.
- Right to restriction — request that we limit processing of your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests.
To exercise any of these rights, email info@duveka.de. We will respond within 30 days.
11. Children's Privacy
HeyBC is a B2B service intended for adults (18+) acting in a professional capacity. We do not knowingly collect data from children under the age of 16. If you believe a child has provided us with personal data, please contact us immediately.
12. International Data Transfers
Your data may be processed in countries outside the EEA (including the United States, where cloud infrastructure providers may operate). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or by updating the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.
14. Contact and Complaints
For privacy-related questions or requests:
- Duveka GmbH
- Email: info@duveka.de
- Website: duveka.de
If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.