Privacy Policy

1. Information we collect

Information you provide to us:

• Account information — your name, email address, password (stored by our authentication provider in hashed form; we never see or store your plain-text password), avatar image, and whether your email is verified.
• Sign-in provider information — if you sign in with a provider such as Google, we receive basic profile details the provider shares (such as your name, email, and profile photo).
• Content you submit — such as profile details and uploaded images and, once AI tools are integrated, the prompts and other inputs you send to those tools and the outputs generated for you.
• Communications — anything you send us directly, such as support emails.
• Newsletter sign-ups: if you sign up for our email tips, your email address, the page you signed up from, your language, the time, and the wording you agreed to.

Information created when you use the Services:

• Token records — a ledger of token grants, adjustments, and top-ups (package, token amount, price, and time). Token top-ups are currently simulated: no card is charged and no payment details are collected for them.
• Subscription and billing records — if you subscribe, we store an identifier for you at our payment processor (Stripe) and your subscription's status, plan, interval, and renewal date. Your card details are entered on Stripe's own checkout and are handled by Stripe; we never receive or store your full card number.
• Usage and log data — actions like signing in, launching a tool, or updating your profile, along with timestamps, IP address, browser and device type, and similar technical data used for security and troubleshooting.
• Administrative records — actions taken on your account by platform administrators (for example a role change or token grant) are recorded in an audit log for accountability.

2. How we use information

• To provide and operate the Services — creating your account, signing you in, showing the tool catalog, and maintaining your token balance.
• To keep the platform safe and lawful — preventing abuse and fraud, enforcing our Terms and Usage Policies, moderating content, detecting and acting on prohibited material (including automated screening for child sexual abuse material), debugging problems, and auditing sensitive administrative actions.
• To communicate with you — service announcements, security notices, and replies to your messages.
• To send the email tips you signed up for, if you did. Every such email will let you unsubscribe, and you can also ask us to remove you at any time.
• To improve the Services — understanding aggregate usage so we can fix problems and build better features.
• To comply with legal obligations and protect rights, safety, and property.

We do not use your private content to train AI models. When AI tools are integrated into the platform, your inputs to a tool will be sent to the AI provider that powers it in order to generate results for you; we will identify which providers power which tools, and their processing is governed by their own policies.

We do not sell your personal information, and we do not show third-party advertising on the platform.

3. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal information on these legal bases: to perform our contract with you (creating your account and providing the Services); our legitimate interests (securing the platform, preventing and detecting abuse, moderating content, and improving the Services), balanced against your rights and freedoms; your consent, where we ask for it; and compliance with legal obligations. Where we rely on your consent, you may withdraw it at any time by contacting us.

4. How we share information

We share personal information only in these circumstances:

• Service providers — we run on Google Firebase (authentication, database, file storage, and hosting on Google Cloud). Your account data and content are processed and stored by Google on our behalf under their terms and safeguards.
• Payment processor — subscription payments are processed by Stripe. We share what Stripe needs to bill you (such as your email, name, and an account identifier); your card details go directly to Stripe and are never shared with us. Stripe processes this under its own terms and privacy policy.
• AI providers — when you use a connected AI tool, the input needed to fulfill your request is sent to the provider that powers that tool.
• Platform administrators — authorized administrators can view account records (such as your profile, status, role, and token ledger) to operate the platform. Administrators cannot see your password.
• Legal reasons and safety — if required by law or legal process, or to protect the rights, safety, or property of users, the public, or the Operator. This includes reporting child sexual abuse material to NCMEC and/or law enforcement.
• Business transfers — if the platform is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this Policy.
• With your consent — for anything else, we will ask first.

5. Cookies and sessions

We use cookies and similar browser storage that the Services need to work, such as the session cookie that keeps you signed in, and one optional cookie that remembers which partner referred you, which we set only if you accept it. We do not use advertising or cross-site tracking cookies. Our Cookie Policy lists every cookie and storage item, what it does and how long it lasts, and you can change your choice at any time through the "Cookie settings" link at the foot of every page.

We count visits to our public pages without cookies or any identifier: the page viewed, the site that referred you, any campaign tag in the link, your language, and clicks on the sign-up button, added to daily totals. We do not store your IP address or anything that links one visit to another, and we skip counting when your browser sends a Do Not Track or Global Privacy Control signal.

6. Data retention

• Account data is kept while your account is active.
• If your account is deleted, we remove or de-identify personal information within a reasonable period, except where we need to keep records to comply with law, resolve disputes, enforce agreements, or maintain the integrity of financial and audit records.
• Audit logs and token ledger entries may be retained longer in de-identified or minimized form because they document platform integrity.
• Billing records held by our payment processor (Stripe) are retained as needed to run billing and to meet financial, tax, and dispute-resolution obligations, and may persist at Stripe after your BizWax account is deleted.
• During the development phase, test data (including token balances) may be reset.
• Newsletter sign-ups are kept until you unsubscribe or ask us to delete them.
• Visit statistics are kept as daily totals that contain no personal information.

7. Security

We take reasonable technical and organizational measures to protect your information: encrypted connections (HTTPS), hashed passwords handled by our authentication provider, database security rules that restrict who can read what, role-based access control for administrative features, and audit logging of sensitive actions. No system is perfectly secure, so we cannot guarantee absolute security — please use a strong, unique password.

8. Your rights and choices

• Access and update — you can view and edit your profile (name, avatar) from your Account page.
• Deletion — you can permanently delete your account and personal data yourself from the Account page ("Your data & privacy"), or by contacting us. Deletion is immediate and cannot be undone.
• Copy of your data — you can download a machine-readable copy of your personal data yourself from the Account page ("Your data & privacy"), or request one by contacting us.
• Sign-in providers — you can manage what a provider like Google shares through your settings with that provider.
• Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA (for example objection, restriction, portability, or non-discrimination for exercising rights). We honor valid requests as required by applicable law.

To exercise any of these rights, contact us at support@bizwax.ai. We may need to verify your identity before acting on a request.

9. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

10. International data

Our infrastructure provider (Google Cloud / Firebase) may process and store information on servers located in other countries, including the United States. Where required, transfers rely on appropriate safeguards provided by our infrastructure providers.

11. Changes to this Policy

We may update this Privacy Policy as the platform evolves — for example when real payments or new AI integrations launch. If we make material changes, we will take reasonable steps to notify you, such as a notice on the platform or an email. The date at the top shows when this Policy was last updated.

12. Contact

Questions or requests about privacy can be sent to support@bizwax.ai.