Privacy Policy
This Privacy Policy describes how BizPilot AI collects, uses, stores, and protects your personal and business data across our platform, services, and integrations.
Summary & Key Takeaways
- BizPilot AI is an AI-powered business management SaaS designed for commercial enterprises to manage inventory, sales, expenses, invoices, and automated communications.
- We collect only the data necessary to provide and secure our services, including business records and connected WhatsApp interactions.
- We never sell your personal or business data. We use enterprise-grade subprocessors (Vercel, Neon, OpenAI, Meta, Paystack, Resend).
- You retain full control of your data and can request complete deletion at any time via our Data Deletion instructions.
1. Introduction & Scope
BizPilot AI ("BizPilot", "we", "us", or "our") provides an intelligent, multi-tenant cloud-based business operating system and software-as-a-service (SaaS) platform. Our services include inventory intelligence, Point of Sale (POS) tools, invoice generation, expense tracking, autonomous AI copilot analytics, and automated messaging integrations.
This Privacy Policy applies to all users of the BizPilot AI web application, APIs, dashboard, and connected messaging channels (including the Meta WhatsApp Cloud API integration). By accessing or using BizPilot AI, you acknowledge that you have read and understood this Privacy Policy.
2. Information We Collect
To operate the BizPilot AI platform effectively, we collect information across several categories:
A. Account & Profile Information
When you register for BizPilot, we collect your full name, email address, encrypted password credentials, optional profile picture, and workspace membership roles (e.g., OWNER, ADMIN, STAFF, MEMBER).
B. Business & Workspace Configuration
Business legal and trade name, URL slug, industry category (e.g., Retail, Restaurant, Pharmacy, Fashion, Electronics, Supermarket), default reporting currency (e.g., NGN, USD), and tax/VAT preferences.
C. Operational & Commercial Data
Information you enter regarding products (names, SKUs, barcodes, cost and selling prices, stock quantities), customer profiles (names, phone numbers, email addresses, delivery addresses), sales records, payment methods, credit/debtor balances, expense logs, and invoices.
D. Connected Services & WhatsApp Communications
When you connect a WhatsApp Business number or interact with our WhatsApp AI Assistant, we process sender phone numbers, incoming message text, interactive button selections, action confirmation tokens, message timestamps, and delivery statuses necessary to execute requested operations.
E. Usage, Telemetry & Device Information
Browser type, IP address, device telemetry, request timestamps, AI token usage metrics, rate limit metrics, and subscription status to maintain security, optimize platform performance, and enforce quota entitlements.
3. Customer Data & Merchant Responsibility
4. How We Use Your Information
We process your data strictly for legitimate business and operational purposes, including:
- Delivering Core SaaS Services: Maintaining real-time inventory tracking, processing point-of-sale checkout, calculating debtor balances, and generating official PDF invoices.
- Powering AI Business Intelligence: Generating natural language financial summaries, sales analytics, low-stock forecasts, and autonomous daily morning briefs.
- Executing Interactive Actions: Processing natural-language WhatsApp commands (e.g., "Record sale 3 Power Banks") through our secure two-step preview and confirmation pipeline.
- Transactional Communications: Sending automated debtor reminders, low-stock email notifications, subscription billing receipts, and security verification codes (OTP).
- Security & Abuse Prevention: Verifying webhook signatures via HMAC SHA-256, deduplicating incoming messages, mitigating denial-of-service threats via sliding-window rate limiting, and safeguarding multi-tenant isolation.
- Billing & Subscription Management: Managing paid plan tiers (Starter, Pro, Business) and recording payment transaction references.
5. Third-Party Service Providers & Subprocessors
We partner with vetted, industry-leading third-party service providers to host, secure, and deliver BizPilot AI. These providers only process data as necessary to perform specific infrastructural tasks:
Vercel Inc.
Cloud application hosting, Next.js edge runtime, and global CDN content delivery.
Neon / PostgreSQL
Serverless encrypted relational database for secure, multi-tenant persistence.
OpenAI, LLC
AI natural-language processing. Prompts are processed strictly to generate responses and are not used to train foundation models.
Meta Platforms, Inc.
WhatsApp Business Cloud API infrastructure for receiving webhooks and transmitting authorized customer messages.
Paystack Payments Limited
PCI-DSS compliant payment processing for recurring subscriptions and billing. We do not store full payment card numbers.
Resend, Inc.
Transactional email delivery for account verification, password resets, and critical business alert notifications.
6. Data Security & Multi-Tenant Isolation
We employ robust technical and organizational security safeguards designed to protect your data against unauthorized access, destruction, loss, or alteration:
- Tenant Isolation: All database queries are strictly partitioned by authenticated workspace identifiers (
businessId). Users cannot query or modify data belonging to other businesses. - Encryption: Data in transit is encrypted using TLS 1.3 / HTTPS. Data at rest in our PostgreSQL database is encrypted using industry-standard AES-256 encryption.
- Credential Hashing: Passwords and verification codes (OTP) are hashed using salted cryptographic algorithms (bcrypt and HMAC SHA-256) and are never stored in plaintext.
- Webhook Protection: Meta WhatsApp webhook payloads are cryptographically verified using SHA-256 signatures before being queued or processed.
7. Data Retention & Lifecycle
We retain your business records for as long as your workspace remains active. When you close your account or request data deletion:
- Your account credentials, product catalogs, customer databases, and active sessions will be permanently purged within 30 calendar days.
- Ephemeral data (such as temporary OTP hashes, action confirmation tokens, and message deduplication IDs) are automatically purged within 2 hours to 30 days.
- We may retain anonymized usage statistics and financial transaction audit logs only where strictly required by statutory tax and financial reporting laws.
8. Your Rights & Privacy Controls
Depending on your jurisdiction (e.g., NDPR, GDPR, CCPA), you have the right to:
- Access & Export: Access your business information, sales ledgers, customer records, and invoices directly from your dashboard.
- Correction: Update or rectify incomplete or inaccurate information via your workspace Settings.
- Integration Control: Disconnect or unlink your WhatsApp Business number at any time in Settings → WhatsApp AI Integration.
- Erasure / Deletion: Request full erasure of your account and business data by following our Data Deletion instructions.
9. Cookies & Local Storage
BizPilot AI uses essential session cookies and local storage tokens to manage authentication state, active business selection, and visual theme preferences (bizpilot-theme). We do not use third-party behavioral advertising cookies or track users across external websites.
10. Children's Privacy
BizPilot AI is designed strictly for commercial enterprises and business owners aged 18 and older. We do not knowingly collect or solicit personal information from minors.
11. Changes to this Policy
We may update this Privacy Policy from time to time to reflect technological improvements, new feature releases, or legal requirements. Material updates will be communicated through in-app dashboard notices or email announcements with an updated effective date.
12. Contact & Data Protection Officer
If you have questions, feedback, or privacy requests regarding this policy or how your data is handled, please contact our data protection team: