Privacy Policy

1. Who is responsible

The entity responsible for BusinessVisor.AI will be identified here: [FULL LEGAL NAME, REGISTRATION NUMBER AND ADDRESS TO BE ADDED]. Privacy enquiries may currently be sent to [email protected].

Depending on the context, we may act as a controller of account and service data or as a processor of business data handled on a Customer’s instructions.

2. Information we collect

The service may process the following categories of information:

• Account and identity data, such as email address, preferred language, role and authentication records.
• Profile and communication settings, including notification channel and optional AI context.
• Business data, dashboards, metrics, comments, reporting submissions and team permissions.
• Subscription, transaction and billing references supplied by a payment provider; we do not intend to store full card details.
• Technical, security and usage data, such as IP address, device or browser information, timestamps, logs and error diagnostics.
• Support messages and other information a person chooses to send to us.

3. Why we use information

We use information to authenticate users, operate dashboards and reporting flows, send requested notifications, provide support, process subscriptions, protect the service, meet legal obligations and understand how the product performs.

The final Policy will map each purpose to the verified legal basis that applies in the relevant country, such as performance of a contract, legitimate interests, consent or compliance with law.

4. Roles and customer instructions

For Customer business data, the Customer generally decides what is collected, who may access it and why it is used. In that context, the Customer is expected to act as controller and BusinessVisor.AI as its processor.

For account administration, security, billing and our own service operations, the operating entity may act as controller. The final allocation will be confirmed in the Policy and, where required, a data-processing agreement.

5. Sharing and service providers

Information may be shared with infrastructure, email, messaging, payment, support, analytics, security and AI service providers only where needed to deliver or protect the service. It may also be disclosed where required by law or during a properly safeguarded business transaction.

A verified list or categories of processors, their locations and their functions will be added before this Policy becomes final.

6. AI processing

Business and metric context may be sent to the OpenAI API to produce requested analysis. The product is designed to exclude direct contact details and internal identifiers from AI prompts where they are not needed.

OpenAI states that API data is not used to train its models by default unless the customer explicitly opts in. BusinessVisor.AI sends requests with store set to false, which disables the Responses API's ordinary storage of the response object. Unless a different OpenAI-approved data control applies, supported requests may still use encrypted prompt-cache data for up to 24 hours. Separately, standard abuse-monitoring logs may contain customer content and are generally retained for up to 30 days, or longer when required by law or reasonably necessary to protect the service or third parties.

7. International transfers

Some providers may process information outside the country in which a user is located. The final Policy will identify the applicable transfer mechanisms and safeguards after hosting and vendor locations are confirmed.

8. Retention and deletion

We intend to keep information only for as long as needed to provide the service, maintain security and records, resolve disputes and meet legal obligations. Different categories may have different retention periods.

Specific periods, backup handling and post-cancellation deletion rules are placeholders pending technical and legal verification.

9. Security

We use organisational and technical measures intended to protect information, including role-based access, one-time-code authentication, reauthentication for sensitive actions, logging and restricted service access. No system can guarantee absolute security.

10. Your choices and rights

Depending on local law, a person may have rights to access, correct, delete, restrict or object to processing, request portability, withdraw consent and complain to a supervisory authority.

Requests may be sent to [email protected]. We may need to verify identity and, for Customer-controlled business data, direct the request to the relevant Customer.

11. Cookies, changes and contact

The service may use strictly necessary browser storage or cookies for authentication, security and preferences. Any optional analytics or marketing technologies will be separately disclosed and managed as required.

The final Policy will explain how changes are announced and will include the operating entity’s complete privacy contact details.