Privacy Policy

Last updated October 16, 2026

This document is a working draft being reviewed by counsel. Text in [square brackets] is still to be confirmed. It is not legal advice.

This policy explains what [Legal entity name, for example "BizzieBot LLC"] (BizzieBot) collects, why, who we share it with, and the choices you have. For the information a business puts into BizzieBot about its own customers, leads and staff, the business is the controller (or "business") and we act as its processor (or "service provider"); our Data Processing Addendum covers that. For information about the people who use BizzieBot themselves, we are the controller.

What we collect

Category	Examples	Why
Account	Name, email, business name, password (stored only as a salted hash), two-step sign-in secret (stored encrypted)	To create and secure your account
Customer Data you put in	Contacts, customer messages and notes, proposals, invoices, inventory, files you upload, chat with Pippy	To provide the Service to you
Security and usage logs	Sign-in events, IP address, actions that change settings, error records	To keep accounts safe, detect abuse, and fix problems
Billing	Plan and payment status (card details are held by our payment provider, never by us)	To charge for the Service
Support	What you send us when you ask for help	To help you

What we do not do

We do not sell your personal information or share it for cross-context behavioral advertising.
We do not use advertising or analytics trackers.
We do not use your Customer Data to train AI models.

How we use information

To provide, secure, support and improve the Service.
To send service messages such as password resets and security notices.
To comply with law and enforce our Terms.
In de-identified, aggregated form, to understand how features are used.

The AI assistant

When you message Pippy, your message and the facts needed to answer it (for example the contacts you are asking about) are sent to the AI provider you connected (such as Anthropic or OpenAI) or to an AI agent running on your own computer. That provider processes it under its own terms and your own account with it. We do not choose or pay for it. Do not put information into Pippy that you are not allowed to share with your provider.

Who we share with

We share information only with the service providers below, who may use it only to provide their service to us, and when the law requires it. If we are part of a merger or sale, information may transfer under the same promises.

Provider	Purpose	Data	Where
Vercel	Hosts the application and its servers	Everything sent to the app while it is used (in transit); server logs	United States
Neon	Managed Postgres database	Account records, contacts, customer messages, chat history, audit log	United States
Resend	Sends email: password reset links, notices	Recipient email address and message text	United States
Cloudflare (R2 storage)	File storage for uploaded files such as invoices and photos, when that feature is used	The files a business uploads	United States
Google (Drive)	Connects a business's own Google Drive when the business chooses to	Only the files and folders the business authorizes	As chosen by the business
An inbound email service (for example Postmark, Mailgun or SendGrid), when a business turns on email invoices	Receives invoices emailed to a business's invoice address and passes them to BizzieBot	The email, its sender and its attachments	United States
Open Food Facts (optional)	Suggests a product name when a barcode is scanned	The barcode number only	France
Stripe	Subscription billing and payments, when billing is turned on	Billing contact, plan, payment method (held by Stripe, not by us)	United States
The business's own AI provider (for example Anthropic or OpenAI), or an AI agent such as Hermes running on the business's own computer	Reads and drafts text for Pippy, the assistant. The business chooses it and supplies its own key	The messages sent to Pippy and the facts needed to answer them	As chosen by the business
A phone or messaging provider (for example Twilio), when the business connects one	Delivers calls, voicemail transcripts and texts to the Receptionist	Caller numbers, transcripts, message text	As chosen by the business
Point-of-sale and accounting integrations the business connects (for example Square)	Import sales and sync data at the business's direction	What the business authorizes	As chosen by the business

Cookies and similar storage

We use one essential cookie to keep you signed in, and your browser's local storage for display preferences such as theme and layout. We use no advertising or analytics cookies. See the Cookie Notice.

How long we keep it

Account and Customer Data: while your account is open. When you delete your account (Settings, Delete account) it is deleted promptly and removed from backups within [35] days.
Security logs: [12] months.
Records we must keep for legal, tax or fraud reasons: as long as the law requires.

How we protect it

Data is encrypted in transit and at rest by our hosting and database providers. Passwords are hashed, saved API keys are encrypted, sign-in is rate-limited with account lockout, owners can use two-step sign-in, and security events are logged. No system is perfectly secure; see our Security page for details and how to report a problem.

Your rights

Depending on where you live (for example under GDPR or the California Consumer Privacy Act) you may have the right to access, correct, delete, export or restrict the use of your personal information, and to object to some uses. Account owners can export and delete their data in Settings. For anything else, or if you are a customer or contact of one of our business customers, contact that business first; we will help them respond. You can also email us. We will not discriminate against you for using your rights. You may complain to your local data protection authority.

International transfers

We are based in the United States and our providers are mainly in the United States. Where personal information moves from the EEA, UK or Switzerland, we rely on the Data Processing Addendum and Standard Contractual Clauses. [Counsel to confirm.]

Children

BizzieBot is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

Changes

We will tell account owners about material changes before they take effect.

Contact

[privacy email address]. Mail: [Legal entity name, for example "BizzieBot LLC"], [Mailing address].