Privacy Policy

BizNote provides a free business scan and, for saved businesses, weekly priorities, drafts, check-ins and a weekly email. This notice explains the free scan flow and the account services.

1. Information used for a website check

You provide a business name, optional website URL, a brief description of your offer, your intended customer next step, optional descriptions of your audience and customer channels, and confirmation that you can authorize the scan. Do not submit customer information, passwords, private URLs or other sensitive information.

If you do not provide a website, we create a starter plan from your answers without requesting any webpage. If you include a website, we request the public HTML of your supplied page and extract limited observations such as its title, description, headings, contact language, HTTPS and viewport settings. Raw HTML is processed temporarily and is not saved in our scan database. This flow does not request Google listings, customer reviews or competitor information. When you use AI-assisted reports, your business answers and these limited observations are sent to OpenAI to generate and review recommendations. We do not send raw HTML, browser tokens or account details. If AI is unavailable or its output fails our checks, we provide a labeled template-based plan.

2. Storage, access and deletion

Inputs, findings, the authorization notice version and timestamps are stored in Supabase. Access expires seven days after creation. An hourly database cleanup removes expired records, so deletion may occur up to an hour after access ends during normal operation. Cleanup runs are recorded in the database job history; service outages can delay physical cleanup.

A secure, HTTP-only browser cookie controls access to your checks. We store a hash of the cookie token, not the token itself, in the database. Report links alone do not grant access. The cookie lasts seven days after your latest scan. Clearing cookies removes your access but does not delete saved records immediately; they still expire on schedule.

Use Download or Delete data on a report, or Delete all my checks on the My website checks page. Deletion removes the inputs and findings from the active database. Copies in infrastructure backups expire according to provider configuration and are not immediately erased by deleting an active record. Downloaded copies are under your control. If you lose browser access and need help, contact us with the report link; we may need to verify your request.

If you choose Save business details while signed in, we copy only your supplied business details into your private workspace. You can edit those details and add goals, service area, capacity and preferences. Account context stays until you remove the saved business from its context page. Priorities you prepare, the outcomes you record, your edited drafts and your weekly check-ins are stored with the saved business. Website findings and the original temporary scan are not copied and retain their seven-day expiry. Deleting a temporary scan does not delete separately saved account context, and removing account context does not delete the temporary scan. Backups expire separately.

3. Security and operational records

We use request metadata for rate limiting and security. The website-check rate limiter stores a daily keyed hash derived from the request IP rather than the raw IP. Rate-limit rows older than two days are removed hourly. Hosting providers may separately retain request logs. We do not deliberately log website-check request bodies or page content.

Supabase provides database storage and authentication; Vercel hosts the application. Optional PostHog analytics and Sentry error monitoring may process product events and error diagnostics when configured. These providers have their own retention controls. The new website-check flow does not send its inputs or report content to analytics.

4. Accounts, billing and email

If you use separate account services, Supabase processes your email and authentication information. Stripe processes payments; we do not store payment-card details. Resend delivers service emails and processes recipient addresses and email content. Subscribers to weekly notes receive a weekly email with their current priority and a link back to their account; you can change the delivery day or unsubscribe in Settings or through the link in the email. Financial or security records may need to be retained separately from report content.

To generate priorities, drafts and checklists, we send your saved business context, your recorded outcomes, your edited draft wording, your check-ins and any unexpired website observations to OpenAI. We disable optional OpenAI response storage (store: false). This is not Zero Data Retention: OpenAI may retain API content in abuse-monitoring logs for up to 30 days, or longer when legally required or reasonably necessary to prevent harm. Deleting a BizNote report does not immediately erase those provider logs. OpenAI does not use API data for model training by default. See the OpenAI data controls for details.

5. Your choices

We do not sell your data or use website-check content for advertising. You can request access, correction or deletion by emailing hello@biznoteai.com. We may verify your identity before acting. Account deletion and any legally required financial retention are handled separately from the browser-based scan deletion controls.

We use essential local storage or cookies for authentication and website-check access. Sign out to end an account session; use Delete all my checks to remove this browser’s website-check data and access cookie.

6. Limits and contact

The service is for adult business owners and authorized managers. No storage system is perfectly secure. Contact security@biznoteai.com about suspected unauthorized access. Material changes to these practices will be reflected in this notice and communicated where appropriate.