Privacy Policy

Effective Date: June 2, 2026 | Last Updated: November 3, 2026

AI Bizlutions, LLC ("AI Bizlutions," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our AI Bizlutions platform and related services (collectively, the "Platform").

By accessing or using the Platform, you consent to the data practices described in this Privacy Policy. If you do not agree with these practices, please discontinue use of the Platform.

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, company name, phone number, password (stored only as a salted hash), and business role when you create an account.
• Business Data: Contacts, customer records, invoices, products, opportunities, workflows, social media content, knowledge base documents, and any other data you input into the Platform.
• Payment Information: Billing address and payment method details processed through Stripe. We do not store full credit card numbers on our servers.
• Communications: Messages you send through the Platform, support tickets, email correspondence, and feedback you provide to us.

1.2 Information We Collect Automatically

• Usage Data: Pages visited, features used, actions performed, timestamps, session duration, and interaction patterns within the Platform.
• Device Information: Browser type and version, operating system, screen resolution, and device identifiers.
• Log Data: IP addresses, access times, referring URLs, and system activity logs for security and debugging purposes.
• Cookies and Similar Technologies: Session cookies for authentication, preference cookies for settings persistence, and first-party analytics cookies for usage measurement (see Section 10).

1.3 AI-Generated Data

• AI Processing: When you use AI-powered features, your inputs (text prompts, document content, data queries) are processed by third-party AI services, primarily Google Gemini.
• PII Redaction: Before transmitting data to AI providers, we apply automated PII redaction that strips email addresses, phone numbers, social security numbers, and credit card numbers from prompts.
• User Responsibility: Do not submit highly sensitive data (trade secrets, medical records, legally privileged communications) to AI features. While we redact common PII patterns, we cannot guarantee detection of all sensitive information formats.
• AI Tags and Insights: The Platform generates classification tags, entity links, and business insights from your data using AI. This supplementary metadata is stored alongside your records and deleted when the source record is deleted.

2. How We Use Your Information

• Provide and Maintain the Platform: Operate, deliver, and improve Platform functionality including CRM, automation, invoicing, communications, and social marketing features.
• Process Transactions: Handle subscription billing, invoice payments, credit purchases, and affiliate payouts through Stripe.
• Personalize Your Experience: Customize dashboards, recommend actions, and tailor AI-generated content to your business context.
• Generate AI Content: Power AI features including content generation, entity tagging, insight extraction, knowledge search, automation suggestions, and the Bo AI assistant.
• Administrative Communications: Send account notifications, security alerts, billing receipts, policy updates, and service announcements.
• Marketing Communications: With your consent, send product updates, feature announcements, and educational content. You may opt out at any time via Settings or by emailing support@aibizlutions.com.
• Analyze and Improve: Monitor usage patterns, diagnose technical issues, and develop new features based on aggregated analytics.
• Comply with Legal Obligations: Respond to lawful requests, enforce our terms, and protect rights and safety.
• Detect and Prevent Fraud: Monitor for suspicious activity, brute-force login attempts, and unauthorized access patterns.

3. How We Share Your Information

We do not sell your personal information. We do not rent, trade, or otherwise monetize your data to third parties for their marketing purposes.

3.1 Service Providers

We share data with trusted service providers who assist in operating the Platform, bound by data processing agreements (DPAs) that limit their use of your information:

• Amazon Web Services (AWS): Cloud infrastructure, DynamoDB database storage, S3 file storage, and Lambda compute. Data resides in US-East-2 (Ohio).
• Stripe, Inc.: Payment processing, subscription management, and invoicing. Stripe processes payment card data under PCI DSS Level 1 compliance.
• Google LLC (Gemini AI): AI content generation, entity tagging, insight extraction, and natural language processing. Before transmission we remove email addresses, telephone numbers, government identifiers and payment card numbers. Personal and business names, and the business content of the record being processed, are included where the feature requires them — for example, tagging a contact or an invoice uses the contact and company name. Google does not use paid-tier API data to train its models.
• Replicate, Inc.: AI media generation (image-to-video processing) for social marketing features.
• Intuit (QuickBooks): Accounting integration for synchronized invoicing and customer records when you connect your QuickBooks account.
• Social Media Platforms (LinkedIn, Meta/Facebook/Instagram): Publishing content and retrieving profile information when you connect your social accounts.
• Email Service Providers (AWS SES): Transactional and marketing email delivery on your behalf.

A current list of authorized sub-processors is maintained at https://app.aibizlutions.com/sub-processors.html.

3.2 Legal Requirements

We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to: (a) comply with a legal obligation or lawful government request; (b) protect and defend our rights or property; (c) prevent fraud or investigate potential violations of our Terms; or (d) protect the personal safety of users or the public.

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of the transaction. We will notify you via email and/or a prominent notice on the Platform before your information becomes subject to a different privacy policy.

4. Third-Party Services and Integrations

When you connect third-party accounts to the Platform, we access and store only the limited data necessary to provide the integration features you enable. Each integration collects only what is required for functionality and deletes stored credentials immediately upon disconnection. The categories below disclose, for each integration, the data accessed, the OAuth scopes requested, how the data is used, and how it is retained and deleted (GDPR Art. 13(1)(e)–(f)).

4.1 LinkedIn Data Collection and Retention

When you connect your LinkedIn account, we collect and store:

• Profile ID: Your unique LinkedIn member identifier, used to associate posts with your account.
• Display Name: Your LinkedIn profile name, shown in the Platform UI for account identification.
• Access Token: An OAuth 2.0 access token encrypted with AES-256-GCM at rest, used to publish content on your behalf.
• Organization Destinations: If you administer LinkedIn Pages, we store destination IDs and names so you can choose where to publish.

Scopes Requested

• w_member_social - Publish posts, articles, and comments on your behalf
• rw_organization_admin - List the LinkedIn Pages you administer, so you can choose one as a destination
• w_organization_social - Publish to a LinkedIn Page you administer
• r_organization_social - Read mention notifications for LinkedIn Pages you administer
• r_organization_social_feed - Read comments and reactions on posts by LinkedIn Pages you administer
• w_organization_social_feed - Publish a reply to a comment as a LinkedIn Page you administer
• w_member_social_feed - Publish a reply to a comment as you

Replies are public, permanent, and never automatic. We publish a reply only when you have written it and confirmed it. LinkedIn provides no way to withdraw a published comment through the API, so there is no undo; the confirmation step exists for that reason. We publish the reply under the same identity that published the post it sits beneath — your Page for a Page post, you for a profile post — and if we cannot confirm which identity that was, we refuse to send rather than guess.

Other people's comments are shown to you but not kept. When we display comments on your LinkedIn Page posts, the comment text and the commenter's LinkedIn reference are fetched from LinkedIn at the moment you view them and are never written to our database, our CRM, or any export. Close the view and we hold nothing about them. This is stricter than our handling of Facebook and Instagram comments, which are cached, and it reflects LinkedIn's Marketing API data-storage requirements.

In most cases LinkedIn does not tell us who commented. LinkedIn returns an anonymous reference rather than a name, and obtaining the name would mean reading that person's profile — access we neither hold nor request. Comments therefore usually appear attributed to “LinkedIn member” with a short reference, so that different commenters remain distinguishable without us identifying any of them. Where LinkedIn does supply a name, we display it and still store nothing.

Comment reading is limited to LinkedIn Pages you administer. Comments on posts published to your personal LinkedIn profile are not available to us, because LinkedIn restricts that permission to a small number of approved partners and has not granted it to AI Bizlutions.

We do not receive your LinkedIn email address. AI Bizlutions connects through LinkedIn's Community Management API and requests no sign-in or profile-reading scopes, so LinkedIn does not disclose your email to us.

Retention and Deletion Timeline

• On Disconnect: Your LinkedIn access token is deleted from our servers immediately and irrevocably.
• Within 30 days: All LinkedIn metadata (profile ID, display name, destination list) is purged from our database.
• 60-day token expiry: LinkedIn access tokens expire after 60 days. If not refreshed (LinkedIn does not issue refresh tokens), the connection becomes inactive.
• 24-hour publishing window: Per LinkedIn API Terms, content must be published within 24 hours of user consent. We enforce this server-side.
• 90-day inactivity purge: Tokens not renewed within 90 days are automatically purged by our scheduled cleanup process.

To fully revoke access, disconnect in our Platform and also visit LinkedIn Settings > Permitted Services to remove AI Bizlutions.

4.2 Stripe Connect Data Collection and Retention

When you connect your Stripe account, we collect and store:

• Stripe Account ID: Your unique Stripe Connect account identifier.
• Account Display Name: Your Stripe business name for UI display.
• Access Token: An OAuth access token encrypted with AES-256-GCM at rest, used to process payments on your behalf.
• Payment Metadata: Transaction IDs, invoice references, and payment status (not full card numbers).

How We Use Stripe Data

• Process customer invoice payments on your behalf
• Synchronize payment status between platforms
• Generate billing reports and financial summaries

Your Stripe Customer List Is Copied Into Your CRM

Connecting Stripe starts a one-time import of the customers in your Stripe account into your AI Bizlutions contacts. For each Stripe customer we copy the name, email address, phone number, company name (where Stripe holds one) and the Stripe customer ID, and we tag the resulting contact as having come from Stripe. Contacts that duplicate an email address or phone number you already have are skipped.

The import covers your entire Stripe customer list, not a sample, and it begins automatically as soon as the connection succeeds — it is not offered as a separate choice and cannot currently be declined at connect time. Imported contacts are ordinary CRM contacts afterwards: you can edit or delete any of them individually, and disconnecting Stripe does not remove contacts that were already imported. If you do not want them, delete the imported contacts (they carry the stripe tag) or request erasure under Section 9.

Scope Requested

read_write — Stripe's full-access scope. Collecting a payment requires creating and updating objects in your Stripe account, so Stripe's read-only scope cannot support invoicing. This scope permits actions in your Stripe account beyond those AI Bizlutions performs; the operations we actually carry out are the ones listed in this section.

How We Do NOT Use Stripe Data

• We never store full credit card numbers, CVVs, or bank account details
• We do not use your financial data for our own marketing purposes
• We do not share payment data with unrelated third parties

On Disconnect: All Stripe credentials are deleted immediately. To revoke access, visit your Stripe Dashboard > Settings > Connected Apps and remove AI Bizlutions.

4.3 Microsoft Email Data Collection and Retention

When you connect your Microsoft account for email integration, we collect and store:

• OAuth tokens: Encrypted access and refresh tokens. The scopes requested are Mail.Send (send mail as you), Mail.Read (sync your inbox into the communications module), openid, email and profile (identify the connected account), and offline_access (renew the connection without asking you to sign in again). No others are requested.
• Profile information: Display name and email address (for sender identification).
• Email messages: Subject lines, body previews, sender/recipient addresses, and timestamps synced to your communications inbox.

How We Use Microsoft Data

• Send emails on your behalf through your connected Microsoft account
• Sync your inbox messages to the platform's communications module
• Display sender identity when composing messages

How We Do NOT Use Microsoft Data

• We do not use your email content for advertising, profiling, or marketing purposes
• We do not share your email data with unrelated third parties
• We do not train AI models on your Microsoft data
• We do not create bulk copies or databases of Microsoft user data beyond what is displayed in your communications inbox

Retention and Deletion Timeline

• On Disconnect: OAuth tokens are deleted immediately. Synced email data is removed within 30 days.
• On Account Deletion: All Microsoft-related data is cascade-deleted immediately as part of GDPR Art. 17 compliance.
• Revoke Access: Visit Microsoft My Apps to manage or revoke AI Bizlutions permissions directly with Microsoft.

4.4 Google (Gmail) Data Collection, Retention, and Limited Use

When you connect your Google account for email sending, AI Bizlutions requests only the following OAuth scopes:

• openid - Verify your identity via OpenID Connect
• userinfo.email - Identify which Google account is connected
• userinfo.profile - Display your name and profile picture
• https://www.googleapis.com/auth/gmail.send - Send email on your behalf (no read access)

Send-only access: The gmail.send scope permits sending email on your behalf. AI Bizlutions does not request gmail.readonly or any other Gmail read or modify scope, and therefore does not read, search, download, or store the contents of your Gmail mailbox. We store only your Google account email address and display name (for sender identification) and an OAuth access/refresh token encrypted with AES-256-GCM at rest.

On Disconnect: Your Google tokens are deleted immediately; on account deletion they are cascade-deleted. To revoke access externally, visit Google Account > Third-party access.

Google Search Console (read-only, separate from Gmail)

If you choose to connect Google Search Console, that is a separate connection from Gmail with its own consent screen, and it requests only openid, userinfo.email (to show which Google account is connected) and https://www.googleapis.com/auth/webmasters.readonly. With it we read your Search Console performance data for the websites you manage in the Platform: the search queries people find your site with, impressions, clicks, average position, and sitemap status. This access is read-only — we never write to, change, or submit anything in Search Console. We store a 28-day summary of that data (and the 28 days before it, for comparison) so your SEO report can show how your site is doing. The Search Console connection cannot send or read email, and the Gmail connection cannot read Search Console. When you disconnect Search Console, the stored access token is deleted immediately; on account deletion it is cascade-deleted. The Limited Use commitments above apply to Search Console data in the same way, with "the user-facing email-sending feature" read as "the user-facing SEO reporting feature you have enabled".

4.5 Meta Platforms (Facebook, Instagram, Threads) Data Collection and Retention

When you connect a Meta product (Facebook Pages, Instagram Business/Creator accounts, or Threads), we collect and store only what is required to publish content and manage messaging for the destinations you authorize:

• Account identifiers and tokens: Page/IG/Threads account IDs, page and account display names, and OAuth access tokens encrypted with AES-256-GCM at rest.
• Publishing data: Content, media, and scheduling metadata for posts you create through the Platform.
• Messaging data: Where you enable Facebook/Instagram messaging, direct-message content and metadata exchanged with your connected accounts.

Scopes Requested

Scopes correspond to the features you enable. Facebook: pages_show_list, pages_read_engagement, pages_manage_posts, pages_read_user_content, pages_manage_engagement, read_insights, pages_messaging, instagram_basic (lets a connected Page show us the Instagram business account linked to it, and read that account’s comments). Instagram: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_manage_insights (reads your own Instagram post reach and views so we can show them in your analytics). Threads: threads_basic, threads_content_publish, threads_manage_insights, threads_read_replies, threads_manage_replies, threads_manage_mentions. LinkedIn: w_member_social, rw_organization_admin, w_organization_social.

Retention, Deletion, and Limited Use

• Direct messages: Retained for a maximum of 120 days, then automatically purged via time-to-live (TTL) deletion.
• Tokens and metadata: Deleted immediately on disconnect; remaining integration data is purged within 30 days and cascade-deleted immediately on account deletion.
• Deletion callback: AI Bizlutions implements a Meta Data Deletion Request Callback. When you remove the app via Facebook/Instagram settings, Meta sends a signed deletion request to our callback endpoint; we delete the associated data and return a confirmation code and status URL. You may also request deletion at Data Deletion Instructions. Our Meta data flows are described at Meta Platform Data Flow.
• Limited use: Meta Platform Data is used only to provide the features you enable and is never sold or used for advertising, profiling, or model training, consistent with the Meta Platform Terms and Developer Policies.

4.6 Intuit QuickBooks Data Collection and Retention

When you connect your QuickBooks Online account, we store your QuickBooks company (realm) ID and OAuth access/refresh tokens encrypted with AES-256-GCM at rest. We access and synchronize only the accounting records necessary for invoicing — customers, invoices, items/products, and payment status — to keep your AI Bizlutions and QuickBooks records consistent. QuickBooks synchronization is performed on a best-effort, fire-and-forget basis and does not block Platform operations.

How We Do NOT Use QuickBooks Data

• We do not use your QuickBooks financial data for advertising, profiling, or AI model training
• We do not share your QuickBooks data with unrelated third parties

On Disconnect: QuickBooks tokens are deleted immediately; synced accounting data follows the same retention and deletion timeline as your other business records. To revoke access, visit your Intuit account settings.

5. Data Security

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (HTTPS).
• Encryption at Rest: Sensitive credentials (OAuth tokens, API keys) are encrypted using AES-256-GCM. Database storage is encrypted via AWS-managed keys.
• Access Controls: Role-based access control (RBAC) enforces least-privilege access. API endpoints validate authentication and authorization on every request.
• Security Monitoring: Automated detection of brute-force login attempts with progressive lockout. Activity logging with 90-day retention for security audit trails.
• Breach Notification: In the event of a data breach affecting your personal information, we will notify affected users without undue delay and within 72 hours of becoming aware, in compliance with GDPR Art. 33-34 and applicable state breach-notification laws.
• No Absolute Guarantee: While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

• Active Account: Your data is retained for as long as your account remains active and as needed to provide Platform services.
• Post-Deletion - Account Data: Upon account deletion via the in-app self-service mechanism, your personal data, business records, and integration credentials are permanently deleted immediately. Email-requested deletions are processed within 30 days of identity verification.
• Post-Deletion - Billing Records: Transaction and billing records are retained for up to 7 years as required by tax and financial regulations.
• Post-Deletion - Backups: AWS infrastructure backups (Point-in-Time Recovery) may retain residual data for up to 35 days. Individual records cannot be selectively purged from these backups. After the 35-day window, all backup data is automatically and permanently removed by AWS.
• AI Usage Events: AI interaction records (feature used, model, token counts, credits, and estimated provider cost — not the content of your prompts or outputs) are retained for 24 months (TTL-enforced) for billing reconciliation, cost accounting, fraud and abuse detection, then automatically purged. Because these are billing and accounting records, they are retained for that same period even after account deletion, as permitted by GDPR Art. 17(3)(b) and (e) (compliance with legal obligations and defence of legal claims); after deletion they are no longer linked to any identifying profile. A copy of your usage records is available through data export (Section 7) while your account is active.
• Activity Logs: Security and activity logs are retained for 90 days (TTL-enforced) for audit purposes. This includes the record of actions taken on your behalf by the AI assistant, together with the "before" copy of any record it changed that is kept so the action can be undone. A consequence worth knowing: the Undo offered on those actions stops working once the record reaches 90 days, and the history of what the assistant did is no longer visible after that point. If you need a longer record, export it before then (Settings > Profile > Export My Data).
• Meta Direct Messages: Retained for a maximum of 120 days (TTL-enforced).

You may request deletion of your data at any time by contacting support@aibizlutions.com or using the in-app account deletion feature (Settings > Profile > Delete Account).

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to legal retention obligations.
• Portability: Request your data in a structured, machine-readable format (JSON export available via Settings or GET /api/auth/my-data).
• Opt-Out: Opt out of marketing communications, AI processing of your data, or analytics tracking.
• Restriction: Request restriction of processing in certain circumstances (e.g., while accuracy of data is contested).

To exercise any of these rights, contact support@aibizlutions.com. We will respond to verified requests within 30 days.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions (legal obligations, fraud detection, completing transactions).
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. You will not receive different pricing or quality of service.

Sensitive Personal Information: We do not use or disclose sensitive personal information (as defined in CCPA §1798.121) for purposes other than those permitted without a right to limit. We do not use sensitive personal information to infer characteristics about you.

Authorized Agents

You may designate an authorized agent to submit CCPA/CPRA requests on your behalf. Authorized agents must provide: (a) written authorization signed by you, and (b) verification of their own identity. We may contact you directly to confirm you authorized the agent. We may deny requests from agents who cannot demonstrate proper authorization.

Request Acknowledgment Procedure

AI Bizlutions processes consumer rights requests through two channels:

• In-App Self-Service (Immediate): Data export (Settings > Profile > Export Data) and account deletion (Settings > Profile > Delete Account) are fulfilled immediately upon request. No separate acknowledgment is sent because the request is completed in real-time.
• Email Requests: Requests submitted to support@aibizlutions.com receive an auto-acknowledgment confirming receipt within 2 business days. The acknowledgment includes: confirmation of request type received, expected fulfillment timeline (within 45 calendar days per CCPA §1798.130), instructions for verifying identity if needed, and a reference number for tracking.

All consumer rights requests — regardless of channel — are fulfilled within 45 calendar days of receipt. Complex requests that require an extension will receive notice of the extension (up to an additional 45 days) with a written explanation of the reason.

Financial Incentives

We do not offer financial incentives or price or service differences in exchange for the retention, sale, or sharing of your personal information. Our Affiliate Program compensates affiliates for successful referrals and does not require the sale or sharing of personal information as a condition of participation.

To exercise your California privacy rights, contact support@aibizlutions.com with the subject line "CCPA Request." We will verify your identity before processing.

9. European Privacy Rights (GDPR)

Geographic Availability Notice: The Platform is currently available only to users located in the United States. New account registration is restricted to US-based users while additional jurisdictions are reviewed on a country-by-country basis. Existing account holders continue to have access subject to applicable law.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

Legal Bases for Processing

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide Platform services you have subscribed to.
• Legitimate Interests (Art. 6(1)(f)): Processing for fraud prevention, security monitoring, service improvement, and direct marketing (with opt-out).
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with tax, financial reporting, and law enforcement obligations.
• Consent (Art. 6(1)(a)): Processing based on your explicit consent, which you may withdraw at any time (e.g., marketing communications, AI data processing opt-in).

Additional GDPR Rights

• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, CNIL in France, BfDI in Germany) if you believe our processing violates your rights.
• Right to Object: You may object to processing based on legitimate interests at any time. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to Restriction: You may request restriction of processing under Art. 18 (e.g., while contesting accuracy, or if processing is unlawful but you oppose erasure).
• Automated Decision-Making: We do not make solely automated decisions with legal or similarly significant effects. AI-generated tags and insights are supplementary and subject to human review.

Identity of the Controller: The data controller is AI Bizlutions, LLC, PO Box 717, Queen Creek, AZ 85142, USA. AI Bizlutions currently offers the Platform only to users in the United States; new account registration from all other countries is unavailable at this time. Accordingly, the Article 27 GDPR representative designation obligation is not triggered at this time (see representatives.html for current status). Our Record of Processing Activities (Art. 30) is published at ropa.html.

Data Protection Officer: For GDPR-related inquiries, contact our DPO at dpo@aibizlutions.com.

10. Cookies and Tracking Technologies

We use the following cookies and similar technologies:

• Session/Authentication Cookies: Strictly necessary for maintaining your login session and authenticating API requests; cannot be disabled.
• Preference Cookies: Store your theme preference (dark/light mode), sidebar state, and widget layout configurations.
• Usage Analysis: Collect first-party, anonymized usage patterns to improve Platform features and identify technical issues. No third-party analytics services are used.
• Fraud Prevention: Monitor login patterns and detect suspicious activity to protect your account.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Platform. Disabling preference cookies will reset your personalization settings on each visit.

11. Children's Privacy

The Platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at support@aibizlutions.com so we can take appropriate action.

12. Third-Party Links

The Platform may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service before providing personal information.

Our integrations with third-party platforms (LinkedIn, Meta, Stripe, Google, Microsoft, QuickBooks) are governed by the specific data collection and retention terms described in Section 4 above, in addition to each platform's own privacy policy.

13. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for all international transfers:

Legal Basis for Transfers: International data transfers are conducted under the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), and/or explicit consent under GDPR Articles 44-49.

13.1 Data Storage Location

All primary data storage is located in AWS US-East-2 (Ohio, United States). We record EU residency preferences for users who indicate them, in anticipation of future EU-region data residency options. If you require EU-only data storage, please contact dpo@aibizlutions.com to discuss available arrangements.

14. Data Protection Impact Assessment (Art. 35)

In compliance with GDPR Article 35, we have conducted a Data Protection Impact Assessment (DPIA) for high-risk processing activities on the Platform:

Processing Activities Assessed

• AI-powered entity tagging and classification of business contacts
• Automated insight extraction from uploaded documents
• Entity linking across CRM records, communications, and knowledge base
• Usage analytics and behavioral pattern analysis
• AI content generation using third-party language models

Risks Identified

• Inaccurate Profiling: AI tags may incorrectly classify contacts or business entities.
• Data Exposure to AI Provider: Prompts sent to Google Gemini may contain business context.
• Purpose Creep: AI-generated insights could be used beyond original collection purpose.

Safeguards Implemented

• PII Redaction: Automated stripping of emails, phone numbers, SSNs, and credit card numbers before AI transmission.
• Opt-Out via Settings: Users can disable AI processing of their data (analyticsOptOut flag).
• Supplementary Only: AI tags are supplementary metadata, not used for automated decisions with legal effects.
• No Automated Legal Decisions: No solely automated processing produces legal or similarly significant effects on data subjects.
• Input Truncation: AI inputs are truncated to 10,000 characters maximum to limit exposure.
• 24-Month TTL: AI usage metadata expires automatically after 24 months; no prompt or output content is stored, and it is kept for the same 24 months after account closure as a billing record, no longer linked to any identifying profile.
• Art. 18 Restriction Right: Users may invoke their right to restrict AI processing at any time.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us through the appropriate channel:

Email Opt-Out Mailbox Monitoring

Commercial emails sent by AI Bizlutions include RFC 8058 List-Unsubscribe headers referencing support@aibizlutions.com. This mailbox is actively monitored to ensure email-based opt-out requests are processed in compliance with CAN-SPAM Act §7704(a)(3)(B):

• Monitoring frequency: Checked at minimum once per business day (Monday–Friday)
• Processing timeline: Opt-out requests received via email reply are processed within 5 business days (well within the CAN-SPAM 10 business day requirement)
• Processing method: Recipient email address is added to the platform-wide suppression list (EMAIL_SUPPRESSIONS_TABLE) with reason "unsubscribe" and permanent flag
• Retention: Mailbox opt-out requests are retained for 30 days post-send per CAN-SPAM requirements
• Backup mechanism: All commercial emails also include a one-click HTTPS unsubscribe link that processes opt-outs immediately and automatically, independent of mailbox monitoring

Data Deletion Instructions

To delete your data from AI Bizlutions and connected services:

1. Disconnect integrations: Log in, navigate to Settings > Integrations, and click Disconnect for each connected platform (LinkedIn, Instagram, Facebook, Stripe, etc.).
2. Delete your account: Go to Settings > Profile > Delete Account. Type the confirmation phrase and confirm. This permanently and immediately removes all your data.
3. Email request: Alternatively, email support@aibizlutions.com with the subject "Data Deletion Request" from your registered email address. We will process verified requests within 30 days.

For detailed step-by-step instructions, see our Data Deletion Instructions page.

This Privacy Policy is effective as of June 2, 2026, last updated August 21, 2026. For previous versions, contact support@aibizlutions.com.
See also: Terms of Service | Data Deletion Instructions | Data Processing Agreement | Record of Processing Activities | EU/UK Representatives