Privacy Policy

Introduction

BizPilot LLC ("BizPilot," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

Information We Collect

Personal Information

When you register for an account, we collect:

• Name and email address
• Business name, address, and phone number
• Payment information (processed securely via Stripe)
• Profile information and preferences

Client Data

To provide our services, we collect and store information about your clients:

• Client names, email addresses, and phone numbers
• Appointment history and preferences
• Communications between you and your clients
• Any notes or additional information you add to client profiles

Usage Data

We automatically collect certain information when you use the Service:

• Device information (browser type, operating system)
• IP address and approximate location
• Pages visited and features used
• Time spent on the Service

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send appointment reminders and marketing communications (with consent)
• Respond to comments, questions, and customer service requests
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations

Third-Party Services

We use trusted third-party services to operate BizPilot:

Stripe (Payment Processing)

Payment information is processed securely by Stripe. We do not store complete credit card numbers on our servers. Stripe's privacy policy applies to their handling of your payment data.

Twilio (SMS/Phone Services)

We use Twilio to send SMS messages and process phone communications. Message content and phone numbers are transmitted through Twilio's secure infrastructure.

Resend (Email Services)

Transactional and marketing emails are sent through Resend. Email addresses and message content are processed according to Resend's privacy practices.

Social Media Integrations (Facebook, Instagram, X/Twitter)

If you connect your social media accounts, we access those accounts to post content on your behalf, read analytics and engagement data, and manage your social media presence. We only access what you authorize and do not share your social media credentials with third parties.

AI/LLM Providers

We use AI language model providers — including Anthropic (Claude), OpenAI, and Google (Gemini) — to power BizPilot's AI agent features. Your business data may be sent to these providers for processing. Data is handled per each provider's privacy policy. We do not use your data to train AI models, and we have agreements with these providers to ensure your data is not used for their model training.

Google Business Profile

If you connect your Google Business Profile, we access your business listing to manage reviews, business information, Q&A, and other profile data on your behalf. We follow Google's API Services User Data Policy.

Authentication Providers (Google, Apple, Facebook)

You may sign in using Google, Apple Sign In, or Facebook. When you do, we receive your name, email address, and profile picture from the provider. We do not receive or store your password from these services.

Google Calendar

If you connect Google Calendar, we access your calendar data only to sync appointments. We follow Google's API Services User Data Policy.

Data Processing

When you use BizPilot to manage your clients' information, we act as a data processor on your behalf. You remain the data controller for your client data. We process this data only as necessary to provide the Service and in accordance with your instructions. We maintain appropriate technical and organizational measures to protect client data.

Data Export

You can export all of your data at any time from your account settings. Exports include your user profile, tenant information, clients, bookings, invoices, social posts, integrations, services, campaigns, and all other data associated with your account. Data is provided in JSON format for portability (GDPR Article 20).

Account Deletion

You can permanently delete your account and all associated data at any time from your account settings. When you delete your account, we immediately and permanently remove all of your data, including tenant information, client records, bookings, integrations, and all other associated data. A confirmation email will be sent to your registered email address. Some data may be retained in audit logs as required by law.

Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data is encrypted in transit using TLS 1.3
• Data at rest is encrypted using AES-256
• Regular security audits and penetration testing
• Access controls and authentication requirements
• Secure cloud infrastructure with redundancy

Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account termination, we retain data for 30 days before permanent deletion. Certain information may be retained longer as required by law or for legitimate business purposes.

Your Rights

Access and Portability

You can access and export your data at any time from your account settings. We provide data in common, machine-readable formats.

Correction

You can update your personal information directly in your account or by contacting us.

Deletion

You can request deletion of your account and associated data. Some information may be retained as required by law.

Opt-Out

You can opt out of marketing communications at any time via the unsubscribe link in emails or by contacting us.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories of personal information we collect, use, and disclose.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Do Not Sell: We do not sell personal information. We do not engage in the sale of personal information as defined by the CCPA.

To exercise these rights, contact us at privacy@bizpilot.dev.

European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

Our legal bases for processing include: performance of contract, legitimate interests, compliance with legal obligations, and consent where applicable.

Cookies and Tracking

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Analyze how the Service is used
• Improve our Service

You can control cookies through your browser settings. Disabling cookies may affect some Service functionality.

Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: