Bastivo Privacy Policy

Last Updated: September 18, 2026

1. Scope and Overview

This Privacy Policy explains how DICEUS Inc., operating the Bastivo product and brand ("Bastivo", "we", "us"), collects, uses, discloses, and retains information in connection with the Bastivo website, marketplace, and AI Assessment tool (the "Platform"). This Policy should be read together with our Terms of Service and our Cookie & Tracking Policy.

2. Who We Are

Bastivo is operated by DICEUS Inc., a Delaware corporation with a business address at 2810 N Church St, Ste 94987, Wilmington, Delaware 19802-4447, USA. For personal information processed in connection with the ordinary operation of the marketplace, DICEUS Inc. acts as the controller (or the equivalent role under applicable law).

3. Information We Collect

3.1 Information You Provide Directly

[Account information] your name, email address, and password when you register as a Buyer or Provider User.
[LinkedIn sign-in information] if you choose to sign in with LinkedIn, the profile information associated with the permissions you grant (such as your name, email address, and basic profile identifiers).
[Buyer and Provider Organization information] information you provide progressively as you use the Platform, such as company details, role, and (for Providers) business descriptions, services, certifications, and similar profile content.
[Claim and verification evidence] documents or information you submit to claim or verify a Provider Profile.
[AI Assessment inputs] the free-text and structured answers you provide when completing an AI Assessment.
[Communications] information you submit through support requests, correction or removal requests, review submissions, or other messages to Bastivo.
[Marketing preferences] your choice to opt in, or not, to marketing communications.

3.2 Information About Provider Organizations from Public Sources

Bastivo may create a Provider Profile using information about a business obtained from legitimate public sources — such as the business's own website, its public LinkedIn or business-directory pages, regulator or government sources, public registries, industry association directories, and other legitimate publicly available business sources — before that business has registered with Bastivo. Where such information includes personal information about an identifiable individual (for example, a named executive listed on a company's own public website), Bastivo applies data-minimization practices and avoids collecting unnecessary personal information. A business, or an individual described in this way, may request correction or removal as described in Section 9.2.

3.3 Information Collected Automatically

When you use the Platform, we and our analytics providers automatically collect certain technical and usage information, such as device and browser information, IP address, pages viewed, and interactions with the Platform, using cookies and similar technologies described in our Cookie & Tracking Policy. This information does not include your password, authentication tokens, the content of your AI Assessment free-text answers, uploaded evidence documents, or other sensitive content, which are excluded from analytics collection by design.

4. How We Use Information

We use the information described above to: operate, maintain, and improve the Platform; create and administer your account; create, administer, and update Provider Profiles (including Unclaimed Profiles as described in Section 3.2); process AI Assessments and generate results; facilitate introductions between Buyers and Providers that you request; send transactional and, where you have opted in, marketing communications; moderate reviews and respond to support, correction, and removal requests; analyze usage of the Platform to improve it; detect and prevent fraud, abuse, and security incidents; and comply with our legal obligations.

5. How Bastivo Uses Artificial Intelligence

5.1 How AI Is Used

Bastivo uses artificial intelligence to help extract information from free-text answers you provide, to phrase clarifying questions, and to generate narrative explanations of your AI Assessment results, and, on Provider Profiles, to generate a labeled AI summary from structured profile data. The scoring calculations underlying your AI Assessment result are deterministic and are not performed by AI.

5.2 No Training of Bastivo's Own Models on Your Content

Bastivo does not use your AI Assessment content, or other content you submit, to train Bastivo's own foundation models.

5.3 Third-Party AI Service Providers

Bastivo's AI functionality is built on a flexible architecture that supports more than one AI service provider; only the provider or providers actually enabled to process production data at a given time act as Bastivo's AI processor for that purpose. Your Assessment or other customer content must not be used by a third-party AI provider for that provider's own model training or model improvement, unless such use has been explicitly approved under Bastivo's privacy configuration and any required separate consent or other applicable legal basis has been satisfied. This is not part of Bastivo's ordinary current use of third-party AI providers.

We share information: with service providers that perform services on our behalf, such as cloud hosting and database infrastructure, authentication services, transactional email delivery, customer-relationship-management tooling used to manage our commercial relationship with you, analytics providers, file-storage and malware-scanning services, and the AI service provider(s) actually enabled to process Assessment data, each acting under contractual data-protection obligations appropriate to the service provided; with a Provider, where you submit an introduction request or otherwise choose to share your information with that Provider; where required by law, legal process, or to protect the rights, property, or safety of Bastivo, our users, or the public; and in connection with a business transfer, such as a merger, acquisition, or sale of assets, subject to this Policy or a successor policy continuing to apply. We do not sell your personal information.

7. Public Information

7.1 Provider Profiles

Provider Profiles are public by design and are intended to be discoverable, including by search engines. Certain fields on a Claimed and Verified profile (such as a public contact email or phone number) become visible only once the profile has been claimed.

7.2 Reviews

Published reviews display certain reviewer-supplied information but, by default, do not publicly display the reviewer's name, company name, or email address unless the reviewer separately opts in to disclose that information.

8. Data Retention

We retain personal information for as long as necessary for the purposes described in this Policy, taking into account the nature of the information and our legal and operational obligations. This Policy distinguishes between retention periods that are directly required by a specific legal or contractual obligation, and retention periods that Bastivo has adopted as its own operational baseline where no specific external period applies; a period in the second category is Bastivo's own drafting and operational decision, not an independently sourced statutory requirement. Illustrative examples of our current retention approach include: anonymous AI Assessment session data, retained for 30 days; registered AI Assessments and reports, retained for 3 years after your last related account activity; claim, verification, and review evidence, and non-public reviewer identity-verification records, retained for 24 months after the related workflow or dispute closes; support requests and introduction-related support records, retained for 24 months after the request closes or the last related dispute or activity, whichever is later, unless a longer retention period is required or justified by applicable law, litigation hold, security, fraud-prevention, or another documented legal obligation; notification content, retained for 90 days, with related delivery records retained for 24 months; and financial, legal, tax, contractual, or audit records that are subject to a longer legally mandated retention period, retained for that longer period (currently treated internally as 7 years for such records). Any of these periods may be extended where necessary to comply with a legal obligation, litigation hold, or an active security or fraud investigation, or shortened by an applicable data-subject-rights request.

9. Your Privacy Choices and Rights

9.1 Individual Account Deletion

You may delete your own individual Buyer or Provider User account at any time through your account settings, or by contacting privacy@bastivo.com. Bastivo aims to complete deletion or anonymization of your personal account data within 30 days, subject to lawful retention exceptions described in Section 8. Deleting your individual account does not, by itself, delete, archive, hide, or "unclaim" any Provider Organization or Provider Profile with which you were associated. If you were the sole remaining Provider User with access to a Claimed Provider Organization, that Provider Profile remains live and Claimed and enters an access-recovery process, as described further in our Terms of Service.

9.2 Provider Organization / Provider Profile Correction, Restriction, Archiving, Merging, or Removal

A Provider Organization or its public Provider Profile is a separate record from any individual's account, and it is not deleted through the individual account-deletion process described in Section 9.1, and cannot be deleted through any other self-service action. If you wish to correct, restrict, archive, merge, or request removal of a Provider Organization or Provider Profile — including information sourced from public records as described in Section 3.2 — please use the applicable support or correction channel described on the Platform for ordinary factual or business corrections, or contact privacy@bastivo.com where your request concerns privacy or personal data. Bastivo reviews these requests manually. Submitting a request initiates Bastivo's review; it does not automatically result in removal, and Bastivo will determine the appropriate outcome (which may include correction, restriction, archiving, merging, or removal of the profile) in its discretion, consistent with applicable law.

9.3 Access, Correction, and Export

You may request access to, correction of, or export of your personal information by contacting privacy@bastivo.com. We aim to fulfill data-export requests within 5 business days for the substantial majority of requests.

9.4 Marketing Communications

You may opt out of marketing communications at any time through your account settings or the unsubscribe link in any marketing message, without affecting transactional communications related to your account.

You may manage non-essential cookies through the consent tool described in our Cookie & Tracking Policy.

9.6 U.S. State Privacy Rights

Depending on your state of residence, you may have additional rights under applicable U.S. state privacy law, which may include rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain uses of it. We aim to honor applicable rights requests consistent with the law that applies to you; you may submit such a request to privacy@bastivo.com.

10. International Users and Data Transfers

Bastivo's core production application and primary data-storage infrastructure are hosted in the United States. Certain third-party service providers may process information in other locations, as described in this Policy and, where applicable, our Subprocessor List. Bastivo is a U.S.-first platform and does not currently intentionally target individuals in the European Union or United Kingdom as a separate commercial market, although the Platform is globally accessible and includes reference content concerning international domiciles. Where applicable law requires additional rights, safeguards, or transfer mechanisms for personal information of individuals located outside the United States — including under the EU General Data Protection Regulation or UK GDPR, to the extent either applies — Bastivo intends to apply those additional requirements to the extent they apply, including an appropriate lawful transfer mechanism where personal information is transferred from the EEA or UK to the United States.

11. Children's Privacy

Bastivo is intended for business use by adults and is not directed to children. Bastivo does not knowingly collect personal information from individuals under 18. If you believe a child has provided us with personal information, please contact privacy@bastivo.com.

12. Data Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Policy from time to time. If we make a material change, we will provide notice through the Platform or by email before the change takes effect.

14. Contact Us

Questions or requests regarding this Policy, including access, correction, deletion, or Provider Profile correction/removal requests, may be directed to privacy@bastivo.com. General legal questions may be directed to legal@bastivo.com. Our business address is 2810 N Church St, Ste 94987, Wilmington, Delaware 19802-4447, USA.