Privacy Policy

1. Information we collect

Information you provide to us:

• Account information — your name, email address, password (stored by our authentication provider in hashed form; we never see or store your plain-text password), avatar image, and whether your email is verified.
• Sign-in provider information — if you sign in with a provider such as Google, we receive basic profile details the provider shares (such as your name, email, and profile photo).
• Content you submit — such as profile details and uploaded images and, once AI tools are integrated, the prompts and other inputs you send to those tools and the outputs generated for you.
• Communications — anything you send us directly, such as support emails.

Information created when you use the Services:

• Token records — a ledger of token grants, adjustments, and simulated purchases (package, token amount, simulated price, and time). Because purchases are currently simulated, we do not collect or store any payment card details. If real payments launch, they will be handled by a dedicated payment processor and we will not store full card numbers.
• Usage and log data — actions like signing in, launching a tool, or updating your profile, along with timestamps, IP address, browser and device type, and similar technical data used for security and troubleshooting.
• Administrative records — actions taken on your account by platform administrators (for example a role change or token grant) are recorded in an audit log for accountability.

2. How we use information

• To provide and operate the Services — creating your account, signing you in, showing the tool catalog, and maintaining your token balance.
• To keep the platform safe and lawful — preventing abuse and fraud, enforcing our Terms and Usage Policies, moderating content, detecting and acting on prohibited material (including automated screening for child sexual abuse material), debugging problems, and auditing sensitive administrative actions.
• To communicate with you — service announcements, security notices, and replies to your messages.
• To improve the Services — understanding aggregate usage so we can fix problems and build better features.
• To comply with legal obligations and protect rights, safety, and property.

We do not use your private content to train AI models. When AI tools are integrated into the platform, your inputs to a tool will be sent to the AI provider that powers it in order to generate results for you; we will identify which providers power which tools, and their processing is governed by their own policies.

We do not sell your personal information, and we do not show third-party advertising on the platform.

3. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal information on these legal bases: to perform our contract with you (creating your account and providing the Services); our legitimate interests (securing the platform, preventing and detecting abuse, moderating content, and improving the Services), balanced against your rights and freedoms; your consent, where we ask for it; and compliance with legal obligations. Where we rely on your consent, you may withdraw it at any time by contacting us.

4. How we share information

We share personal information only in these circumstances:

• Service providers — we run on Google Firebase (authentication, database, file storage, and hosting on Google Cloud). Your account data and content are processed and stored by Google on our behalf under their terms and safeguards.
• AI providers — when you use a connected AI tool, the input needed to fulfill your request is sent to the provider that powers that tool.
• Platform administrators — authorized administrators can view account records (such as your profile, status, role, and token ledger) to operate the platform. Administrators cannot see your password.
• Legal reasons and safety — if required by law or legal process, or to protect the rights, safety, or property of users, the public, or the Operator. This includes reporting child sexual abuse material to NCMEC and/or law enforcement.
• Business transfers — if the platform is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this Policy.
• With your consent — for anything else, we will ask first.

5. Cookies and sessions

We use a single essential session cookie (an httpOnly cookie named "bizwax_session") to keep you signed in securely. It is required for the Services to function. We do not use advertising or cross-site tracking cookies.

6. Data retention

• Account data is kept while your account is active.
• If your account is deleted, we remove or de-identify personal information within a reasonable period, except where we need to keep records to comply with law, resolve disputes, enforce agreements, or maintain the integrity of financial and audit records.
• Audit logs and token ledger entries may be retained longer in de-identified or minimized form because they document platform integrity.
• During the development phase, test data (including token balances) may be reset.

7. Security

We take reasonable technical and organizational measures to protect your information: encrypted connections (HTTPS), hashed passwords handled by our authentication provider, database security rules that restrict who can read what, role-based access control for administrative features, and audit logging of sensitive actions. No system is perfectly secure, so we cannot guarantee absolute security — please use a strong, unique password.

8. Your rights and choices

• Access and update — you can view and edit your profile (name, avatar) from your Account page.
• Deletion — you can permanently delete your account and personal data yourself from the Account page ("Your data & privacy"), or by contacting us. Deletion is immediate and cannot be undone.
• Copy of your data — you can download a machine-readable copy of your personal data yourself from the Account page ("Your data & privacy"), or request one by contacting us.
• Sign-in providers — you can manage what a provider like Google shares through your settings with that provider.
• Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA (for example objection, restriction, portability, or non-discrimination for exercising rights). We honor valid requests as required by applicable law.

To exercise any of these rights, contact us at lucaswarner111@gmail.com. We may need to verify your identity before acting on a request.

9. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

10. International data

Our infrastructure provider (Google Cloud / Firebase) may process and store information on servers located in other countries, including the United States. Where required, transfers rely on appropriate safeguards provided by our infrastructure providers.

11. Changes to this Policy

We may update this Privacy Policy as the platform evolves — for example when real payments or new AI integrations launch. If we make material changes, we will take reasonable steps to notify you, such as a notice on the platform or an email. The date at the top shows when this Policy was last updated.

12. Contact

Questions or requests about privacy can be sent to lucaswarner111@gmail.com.