Privacy policy

BizOS is run by Improvable LTD (“we”, “us”). Company number and registered address: [company number and address to add]. You can contact us at [contact email to add].

This policy covers two groups of people: those who have an account with us (the businesses and agencies that use BizOS), and the people those businesses deal with, such as their customers and leads.

For the details you give us to create and run your account, such as your name, email address and billing details, we are the controller.

For the contacts, messages, bookings, invoices and other records you put into BizOS about your own customers, you are the controller and we are your processor. We handle that data on your instructions, to run the service. If you are an agency using BizOS for your clients, your client is the controller and you and we are processors. If you are a customer of one of our users and want to see or change your data, please contact that business first. A data processing agreement is [to be confirmed].

• Account details: name, email address and password (we do not see your password in readable form), and which businesses you belong to.
• Billing details: your plan, credit balance and payment history. Card details are handled by Stripe and do not pass through our own systems.
• Business records you add: contacts, deals, conversations, bookings, forms and responses, invoices, files, and anything else you store in the apps you switch on.
• Messages sent and received through the service by text, call, email and website chat, including records of when they happened.
• Information from services you connect, such as calendars, accounting data and reviews, limited to what you allow when you connect them.
• Basic technical information needed to run and protect the service, such as sign-in sessions.

To provide the service you asked for (our contract with you), to take payment and keep records (contract and legal obligation), to keep the service secure and fix problems (our legitimate interests), and to contact you about your account. Where we rely on consent, you can withdraw it at any time. [Lawful bases to be confirmed on review]

We use these providers to run the service. Each receives only what it needs for its part.

• Supabase: hosting, database and sign-in.
• Stripe: payments, including subscriptions and card payments taken for you.
• Resend: sending email.
• Telnyx: sending and receiving texts and making calls.
• Anthropic: the AI behind Sidekick and other AI features. When you use an AI feature, the text needed for the request, which can include contact or business information, is sent to Anthropic to produce a reply.
• Nango: manages the connections you make to Xero, QuickBooks, Google, Microsoft and Meta. Data from those services passes through it to reach BizOS.

The services you connect (Xero, QuickBooks, Google, Microsoft, Meta and any others) are separate from us, and their own privacy policies apply to what they hold. We do not sell personal information.

Some of these providers may process data outside the UK. The safeguards we rely on are [to be confirmed]. We may also share information where the law requires it.

We only set what the service needs to work. We do not set advertising cookies on our own pages.

• Sign-in session (Supabase): keeps you signed in. Needed to use your account.
• Connection and payment set-up: short-lived cookies used while you connect Stripe, Google reviews or a calendar, to make sure the request is really yours.
• Customer portal, membership and affiliate sessions (orbit_portal, orbit_portal_account, orbit_member and ref_session cookies): keep a business’s customers, members or referral partners signed in to that business’s pages. Portal sessions last up to 14 days.
• Referral tracking (a ref_ cookie): if you arrive through a referral link, a cookie records it so the referrer can be credited. The business running the programme sets how long it lasts.
• Home screen style (orbit-home): remembers a display choice.
• Browser storage: your browser’s local storage remembers things like whether the sidebar is collapsed, a basket on a business’s shop, tour progress and chat state.

Websites that businesses build with BizOS can include tracking, which those businesses are responsible for. The sites we host ask visitors for their choice before tracking starts.

We keep account and business records while your account is open. Some features have their own limits, for example sign-in sessions and portal sessions expire after a set time. How long data is kept after you close an account or delete a record, and how long backups are kept, is [to be confirmed]. We may keep billing records for as long as the law requires.

Access to each business’s data is separated by account in our database, and sign-in is required for the dashboard. No system is perfectly secure, and we cannot promise that nothing will ever go wrong. If a breach affects your personal data we will tell you and the ICO where the law says we must.

Under UK GDPR you have the right to:

• be told how your data is used, and ask for a copy of it;
• have wrong data corrected, and in some cases erased;
• restrict or object to some uses of it;
• receive the data you gave us in a portable format; and
• withdraw consent where we rely on it.

To use these rights for data we control, contact us at [contact email to add]. For data held by a business that uses BizOS, contact that business.

You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to put things right first.

We will update this page if our practices change, and tell account holders about important changes.