Privacy Policy

bi2MEDIA LLC, 30 N Gould St, Ste N, Sheridan, Wyoming 82801, United States of America.

Contact: through our contact form at bi2media.com/contact or by post to the address above.

This policy applies to the bi2MEDIA platform, including the media directory, user accounts and organisations, booking requests, project workspaces and chat, the BI² Concept Studio, the media assistant, paid memberships and our contact form. The website of our film production studio BI² FILMWORKS (bi2filmworks.com) has its own privacy policy.

We process personal data only where a legal basis exists: to perform a contract or to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR) or to protect our legitimate interests (Art. 6(1)(f) GDPR). Our platform is used by companies; where we process data of their employees and contact persons, we rely on our legitimate interest and that of the companies concerned in arranging and implementing bookings (Art. 6(1)(f) GDPR).

The platform is built and hosted on the Lovable platform. Lovable uses Cloudflare for content delivery and hosting and a cloud backend based on Supabase for our database, user authentication and file storage. When you access the platform, technically necessary log data (including IP address, time of access, requested resource, referrer and browser type) is processed in order to deliver the platform and to detect misuse (Art. 6(1)(f) GDPR). Log data is deleted or anonymised after a short period unless it is needed to investigate a security incident.

To register, you need a business email address and a password. We store your email address, a securely hashed version of your password (we never see your password in plain text), whether you have confirmed your email address, which version of our Terms of Service you have accepted, and technical information about your logins and sessions. We use this data to provide your account and to protect it against misuse (Art. 6(1)(b) and (f) GDPR).

We send emails that are necessary for your account, for example to confirm your email address, to reset your password or to confirm a change of your email address.

On the platform you act on behalf of an organisation. We process the information about the organisation that you provide — such as company name, website, industry or editorial focus, countries, languages and description — as well as its members and their roles.

For media houses, we additionally process their titles and offers, including prices, reach figures with source and date, examples and screenshots of placements, and the details of a contact person for the implementation of bookings (name, email address, telephone number and role). Approved offers are shown publicly in the directory together with the name of the media house. The contact person's details are only passed on to an advertiser once a booking has been accepted.

We process this data to operate the directory and to arrange bookings (Art. 6(1)(b) and (f) GDPR).

The offers you collect are kept in the local storage of your browser until you send a booking request. When you send a booking request, we process the booking summary and the request, including the products, quantities, schedules and prices concerned and your briefing notes, and forward it to the media house concerned. Media houses record the progress of a booking (for example scheduled, live or completed), together with evidence of the placement such as a link.

Once a media house has accepted a booking, the advertiser receives the details of the media house's implementation contact, and the media house receives the email address of the owner of the advertiser's organisation, so that the parties can implement the booking directly. If a booking shows no activity for seven days, we may send a reminder to the media house's contact.

The legal basis is the performance of the contracts with our users (Art. 6(1)(b) GDPR) and the legitimate interest of the companies involved in implementing their bookings (Art. 6(1)(f) GDPR).

For each booking, the advertiser and the media house can exchange messages and files in a shared project workspace. Messages, attachments and uploaded files (for example images, audio files and PDF documents) are stored in non-public storage. They can be accessed by the advertiser and the media house of the respective booking and by bi2MEDIA administrators, who need access to provide support, to ensure security and to handle reports (Art. 6(1)(b) and (f) GDPR). A media house can only access the files that the advertiser has attached to its booking.

Please do not share special categories of personal data, such as health data, in the workspace.

Media houses can choose how they receive booking notifications: by email, through Slack, Asana or HubSpot, or through their own webhook (for example an n8n workflow). At the media house's instruction, we transmit the booking details required for the implementation — order, product, quantity, schedule, briefing note and a link to the platform, but no prices — to the service chosen by the media house (Art. 6(1)(b) and (f) GDPR). The media house is responsible for the data it receives through these services. Access credentials for these connections are stored in encrypted form.

The BI² Concept Studio on bi2media.com helps you develop advertising concepts. If you use it, the information you enter — such as briefing texts, details about your company, product and audience, the chat history, prompts and any voice recordings you choose to make — is processed to create concept plans, texts, images, transcriptions, speech and concept videos. For this we use AI models of Google (Gemini and Veo), to which your input is transmitted. Generated images and videos are stored in non-public storage assigned to your organisation.

The media assistant answers questions about media planning. Your questions and the most recent messages of the conversation are processed by an AI model of OpenAI, which we access through Lovable's AI gateway. You can use the media assistant without an account; in that case your conversation is stored only in your browser's local storage, and we limit the number of requests per IP address. If you are logged in, your conversation history is stored in our database so that you can continue it later.

Media houses can import price lists. The uploaded file (for example PDF or CSV) is processed by an AI model of OpenAI, accessed through Lovable's AI gateway, to extract the offer data.

For voice input, the platform first uses the speech recognition built into your browser; depending on your browser, its provider processes the audio (Google Chrome, for example, sends it to Google). If this is not available, your recording is transcribed through our own transcription function using Google's AI models. Microphone access always requires your permission in the browser.

If you send a production request to BI² FILMWORKS from the platform, we process the request and the related concept to prepare an offer (Art. 6(1)(b) GDPR). BI² FILMWORKS is a brand of bi2MEDIA LLC; the data therefore remains within the same company.

The legal basis is the provision of the feature you have requested (Art. 6(1)(b) GDPR). We do not use your input to train AI models of our own. The AI providers process the data in accordance with their terms for business customers and may retain it for a limited period, for example to detect misuse. Please do not enter special categories of personal data or confidential information that you are not permitted to share, and obtain the consent of any person whose voice you record.

If you purchase a paid membership, the payment is processed by our payment provider Stripe. Stripe processes your payment details itself; we do not receive your full card or bank details. We receive and store the information required for billing, such as your customer number at Stripe, the plan, the billing period, the subscription and payment status, invoices and the related payment notifications. We also keep records of the use of credits for AI features. Stripe also processes certain data as an independent controller, for example to prevent fraud and to comply with financial regulations.

To invoice service fees and commissions, we process the booking value, the invoice amount and date and the billing details of the organisation concerned.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our statutory accounting obligations (Art. 6(1)(c) GDPR).

When you send us a message through our contact form, we process your name, your email address, the topic, your company (optional) and your message. We store the message in our database, where our team reads it and replies to you by email. The legal basis is Art. 6(1)(b) GDPR where your message relates to the use of the platform or a possible contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). To prevent spam and misuse, we store a hashed form of your IP address and your browser type with the message and limit the number of messages per hour (see "Security and abuse prevention"). Messages are deleted, together with this information, no later than six months after the matter has been dealt with, unless statutory retention obligations apply.

We share personal data with other users as described in this policy, in particular between the advertiser and the media house of a booking. In addition, we use the following service providers, who process data on our behalf: Lovable as hosting and development platform (with its infrastructure providers Cloudflare and Supabase and its AI gateway), Google (Gemini and Veo AI models; Google Workspace for our email mailboxes), OpenAI (AI model of the media assistant and the price list import, accessed through Lovable's AI gateway), Stripe (payments) and our email delivery providers. Booking details are also transmitted to the services that a media house has connected for its notifications (see "Delivery connections of media houses").

bi2MEDIA LLC is established in the United States; data you provide to us is therefore processed in the United States. Some of our providers also process data in the United States or in other countries outside the European Economic Area. Where the GDPR applies, we base such transfers on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework where a provider is certified) or on the EU Standard Contractual Clauses. You can request a copy of these safeguards through our contact form.

We only use cookies and comparable storage that are technically necessary to provide the platform: a cookie that remembers your language selection (stored for up to one year); the storage of your login session in your browser; a temporary cookie while a media house connects an external service; and browser storage for the offers you have collected and, if you are not logged in, for your media assistant conversation and your Concept Studio drafts and files. We do not use analytics or marketing cookies. Our hosting platform provides us with aggregated visitor statistics that do not identify individual visitors and do not create user profiles.

The fonts used on the platform are hosted on our own servers. No connection to external font providers is established when you use the platform.

We protect personal data with appropriate technical and organisational measures, including encrypted transmission (TLS), access rules at database level, role-based permissions, non-public file storage and encryption of access credentials. To protect the platform against misuse and excessive costs, we limit the number of certain requests; for this purpose we store your IP address (for IPv6 addresses only the network part) or your user ID for no longer than 48 hours (Art. 6(1)(f) GDPR).

If a technical error occurs, error information (error message, page, browser type, time) may be transmitted to our hosting and development platform Lovable so that we can fix the problem. It is kept only as long as needed to resolve the error (Art. 6(1)(f) GDPR).

We keep your account data until you delete your account. When you delete your account, we delete your login, your profile, your memberships in organisations and your media assistant history. Organisation profiles remain on the platform without being marked as verified; their published offers are paused. If an organisation no longer has any members, we delete the details of its implementation contact and its Concept Studio projects and generated files six months later.

Booking records, messages and files that you have exchanged with other users are not deleted when you delete your account, because the other party and we still need them; your user reference is removed. We keep them as long as one of the organisations involved still has members, and in any case no longer than three years after the booking has been completed, unless statutory retention periods for business records require longer. If none of the organisations involved has members any more, we delete them after six months. Billing records are kept for the statutory commercial and tax retention periods. IP addresses used for rate limiting are deleted after no more than 48 hours, and contact messages no later than six months after the matter has been dealt with.

You are not obliged by law or contract to provide personal data. Without the information marked as mandatory, however, we cannot open an account for you, process bookings, answer your enquiry or provide the feature you have requested. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

You have the right to access the personal data we hold about you, and to rectification, erasure, restriction of processing and data portability. Where processing is based on your consent, you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence or place of work.

Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR).

In your account settings you can export the key data of your account, change your email address and delete your account. For all other requests, please use our contact form or write to us at the postal address above. We may ask you to verify your identity before we respond.

The platform is intended exclusively for businesses and their employees. It is not directed at persons under 18 years of age, and we do not knowingly collect their personal data.

We update this policy when the platform, our providers or the legal framework change. The version published on this page applies. We inform registered users of material changes by email or on the platform.