1. The short version
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months.
- We do not use or disclose sensitive personal information for purposes that require a right to limit.
- We do not knowingly collect or sell the personal information of anyone under 16.
- You can access, correct, delete, or export your data at any time — see section 4.
2. Controller vs. processor
Business Management AI is the business/controller for information about our own visitors, account holders, and billing contacts. For the client, project, and invoice records our customers store in their workspaces, the customer is the business/controller and we act as a service provider/processor under our Data Processing Addendum. If you are an end client of one of our customers, direct your request to that customer — we will support them in responding, and will forward requests we receive.
3. Categories of personal information
In the preceding 12 months we collected the following CCPA categories. Each is collected from you directly, from your organization’s administrator, or automatically from your device, and each is disclosed only to the service providers listed on our Subprocessors page for the business purposes described.
| Category | Examples | Business purpose |
|---|---|---|
| Identifiers | Name, email address, account ID, IP address | Account creation, authentication, support, security |
| Customer records | Organization name, billing contact, payment identifiers | Billing, subscription management, tax compliance |
| Commercial information | Plan, subscription history, invoices and payments | Providing and billing for the Service |
| Internet or network activity | Pages viewed, features used, log and device data | Product analytics, abuse prevention, troubleshooting |
| Professional information | Job title, role in the workspace, billable rate | Access control and time/profitability reporting |
| Inferences | Feature usage patterns used to improve the product | Product improvement |
| User-generated content | Documents, notes, messages, and AI assistant prompts | Providing the Service at your direction |
We keep each category for as long as your account is active and afterwards only as needed for legal, accounting, or security purposes — see the retention section of our Privacy Policy.
4. Your rights
Subject to verification and the exceptions in applicable law, you may:
- Know and access — request the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the recipients.
- Delete — request deletion of personal information we collected from you.
- Correct — request correction of inaccurate personal information.
- Portability — receive a copy in a portable, machine-readable format.
- Opt out — of the sale or sharing of personal information and of targeted advertising. We do not engage in these activities, so there is nothing to opt out of; a request is honored as a standing preference.
- Limit sensitive information — we do not use sensitive personal information for purposes that trigger this right.
- Non-discrimination — we will not deny service, charge a different price, or provide a different level of quality because you exercised a right.
- Appeal — if we decline a request, you may appeal by replying to our decision. We will respond in writing within 45 days with our reasoning and, where required, information about contacting your state attorney general.
5. How to exercise your rights
- Email — privacy@businessmanagementai.com with the subject “Privacy request” and the right you wish to exercise.
- In the product — account holders can view and correct their profile, export their workspace data, and delete their account from Settings → Profile.
We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we will tell you why.
Verification
To protect your data we verify requests before acting. For account holders this normally means responding from the email address on the account; for other requests we may ask for additional information matching what we already hold. We use that information only to verify the request.
Authorized agents
An authorized agent may submit a request on your behalf with written permission signed by you. We may still contact you directly to confirm the authorization and verify your identity.
6. Global Privacy Control
We honor opt-out preference signals such as Global Privacy Control (GPC) transmitted by your browser. Because we neither sell nor share personal information, receiving a GPC signal does not change what we do with your data — it is recorded and respected as an opt-out preference.
7. Shine the Light (California Civil Code § 1798.83)
We do not disclose personal information to third parties for their own direct marketing purposes. California residents may request confirmation of this once per year by writing to privacy@businessmanagementai.com.
8. Contact
Business Management AI, Inc. — privacy@businessmanagementai.com. For the full picture of our data practices, read the Privacy Policy; for how we protect data, see Security.