Privacy Policy

This policy explains what personal data BizPeel (bizpeel.com) collects, how we use it and the choices you have. The team that operates BizPeel is responsible for this data. Send any privacy question or request to support@bizpeel.com.

What we collect

Account details. When you sign up we store your name, email address and a hashed password. If you sign in with Google, Google gives us your name, email address and profile picture; we never see your Google password.

Subscription and billing. Stripe collects your payment details when you subscribe. We receive and keep your Stripe customer ID, plan, billing period, subscription status and payment records (amounts, dates, invoices). We never receive or store your full card number.

Reading and organising. We record which reports you open, so My projects can list the reports you have read and where to continue; we also keep the projects you create, which reports you put in them, and feedback you send on a report.

Agent connections. When you authorise an AI app through OAuth we keep the app, when you authorised it and its access tokens. When you create an API key we store only a hash of the key and its name. We count MCP reads per account per UTC day to apply your limits, and note which report versions you have read that day so a second read of the same one is not counted again.

Messages. When you contact us through the form or by email, we keep your name, email address and message so we can reply.

Technical data. When you visit the site, our hosting provider processes your IP address, browser and device information and the pages you request, to serve the site and prevent abuse. Sign-in sessions record the IP address and browser that created them. When the site hits an error, the error report records the page and technical details, without your name or email address.

Analytics. The live site uses Google Analytics 4 and Open Analytics to count page views and product events (such as opening a report or starting a checkout). When you are signed in these events carry your account ID, not your email address. We never send your email address or search text to an analytics service.

How we use it

to create and secure your account and keep you signed in
to run your subscription, decide which reports and versions you can read, and keep billing records
to let the agents you authorise read reports, and to apply your MCP limits
to send service emails such as email verification, password resets and replies to your messages
to send product updates to people on our mailing list (you can unsubscribe at any time)
to understand which pages and reports are used, so we can improve them
to detect and prevent fraud, abuse and scraping
to meet legal, tax and accounting obligations

We do not sell your personal data or use it for advertising.

Services that process your data

BizPeel runs on these providers, each processing data only to provide its service to us:

Provider	What it does for BizPeel
Cloudflare	Hosting, database, file storage, security, agent authorisation data and service emails
Stripe	Payments, subscriptions, invoices and the billing portal
Google	Google sign-in (only if you choose it) and Google Analytics 4
Open Analytics	Page view and product event analytics
Resend	Our mailing list and product update emails
Sentry	Error reports that help us fix the site

These providers may process data outside your country, including in the United States. Where the law requires it, such transfers rely on the providers' standard contractual safeguards.

Emails

When you sign up we add your email address to our product update list. You can unsubscribe at any time with the link in an email or by writing to support@bizpeel.com; service emails such as verification and password resets still reach you.

Cookies

We use a small number of cookies and browser storage for sign-in, language, interface settings and analytics. The full list is in our Cookie Policy.

How long we keep it

Account details, reading history, saved reports and projects are kept while your account exists and deleted when the account is deleted.
Sign-in sessions expire after seven days without use.
Agent authorisations and API keys are kept until you revoke them, delete them or delete your account; MCP counts keep only the number of reads per day, and the note of which reports were read is deleted once the day is over.
Billing records are kept for as long as tax and accounting law requires, including after an account is deleted.
Support messages are kept for as long as needed to handle your request.
Analytics data and error reports follow the retention settings of those providers.

Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to complain to your local data protection authority.

You can change your name in your account settings.
You can manage or cancel your subscription in the billing portal.
You can revoke authorised apps and delete API keys on the agent connections page of your workspace.
You can unsubscribe from product update emails at any time.
You can delete your account yourself in your account settings; if you have an active subscription, cancel it in the billing portal first.
To export your data, have us delete it, or for any other request, email support@bizpeel.com.

We reply to requests within 30 days and may ask you to confirm the account is yours.

Security

Passwords and API keys are stored as hashes, connections to the site use HTTPS, and only the people who run BizPeel can access production data. No system is perfectly secure; if a security incident affects your data, we will tell you as the law requires.