Comprehensive Privacy Policy

1. Introduction

This Comprehensive Privacy Policy explains in detail how Besto ("we," "our," or "us") collects, uses, shares, and protects your personal information. This policy applies to all users worldwide and addresses specific requirements under GDPR, CCPA, and other privacy regulations.

2. Data Controller Information

Besto acts as the data controller for personal information collected through our platform.

3. Categories of Personal Data

We collect and process the following categories of personal data:

  • Identifiers: Name, email address, phone number, IP address
  • Account Information: Username, password (hashed), profile settings
  • Commercial Information: Subscription history, payment records
  • Usage Data: Browsing history, feature usage, interactions
  • Geolocation: General location based on IP address
  • Inferences: Preferences derived from usage patterns

4. Legal Bases for Processing (GDPR)

We process personal data under the following legal bases:

  • Contract: To provide our services as agreed
  • Consent: For marketing communications and optional features
  • Legitimate Interests: For security, fraud prevention, and service improvement
  • Legal Obligation: To comply with applicable laws

5. Your Rights Under GDPR

If you are in the European Economic Area, you have the right to:

  • Access: Request copies of your personal data
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Portability: Receive your data in a structured, machine-readable format
  • Restriction: Request limitation of processing
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw consent at any time

6. Your Rights Under CCPA

If you are a California resident, you have the right to:

  • Know: What personal information we collect and how it's used
  • Delete: Request deletion of personal information
  • Opt-Out: Opt out of the sale of personal information (we do not sell data)
  • Non-Discrimination: Not be discriminated against for exercising your rights

Do Not Sell My Personal Information: Besto does not sell personal information to third parties. We do not engage in the "sale" of personal information as defined by CCPA.

7. International Data Transfers

We may transfer personal data to countries outside your country of residence. When we do, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses approved by the European Commission
  • Binding Corporate Rules where applicable
  • Transfers to countries with adequacy decisions

8. Data Retention

We retain personal data for different periods depending on the type:

  • Account Data: Until account deletion, plus 30 days
  • Campaign Data: Duration of campaign plus 2 years for audit purposes
  • Voting Records: Duration of campaign plus 1 year
  • Financial Records: 7 years for tax and legal compliance
  • Marketing Data: Until consent is withdrawn
  • Logs: 90 days for security purposes

9. Automated Decision-Making

We use automated systems for fraud detection and vote verification. These systems may automatically flag or block suspicious activity. You have the right to request human review of automated decisions that significantly affect you.

10. Third-Party Data Sharing

We share personal data with:

  • Service Providers: Hosting, payment processing, email services
  • Campaign Owners: Voter data for their campaigns
  • Analytics Providers: Aggregated usage data
  • Legal Authorities: When required by law

We require all third parties to maintain confidentiality and security of personal data.

11. Security Measures

We implement comprehensive security measures including:

  • 256-bit TLS encryption for data in transit
  • AES-256 encryption for data at rest
  • Multi-factor authentication options
  • Regular security audits and penetration testing
  • Employee access controls and training
  • Incident response procedures

12. Exercising Your Rights

To exercise any of your privacy rights:

  • Email us at privacy@bestoapp.com
  • Use the privacy controls in your account settings
  • Submit a request through our support portal

We will respond to requests within 30 days (GDPR) or 45 days (CCPA).

13. Complaints

If you believe your privacy rights have been violated, you may file a complaint with your local data protection authority. EU residents can contact their national supervisory authority. California residents can contact the California Attorney General.

14. Updates to This Policy

We will notify you of material changes to this policy via email or platform notification at least 30 days before changes take effect.

Last updated: 6/13/2026