Data protection

Control access to your business data and request a copy or account deletion. For legal terms, see the privacy policy and data processing addendum. The data processing agreement applies to your business once an owner or admin accepts the business agreement for it, together with the Terms of Service. It takes no separate step. See Businesses.

​

Business-level isolation

Your contacts, messages, files, agents and automations belong to one business. Membership in one business does not grant access to another business’s data. See Businesses.

​

Account security

You control how your team signs in and what programmatic access exists:

• Passkeys — phishing-resistant sign-in
• Two-factor authentication — TOTP and backup codes
• API keys — scoped per permission, and revocable at any time

​

Encryption in transit

All traffic between your browser (or API and MCP clients) and Bizzy is encrypted in transit over HTTPS/TLS.

​

Connected email accounts

Connect your email without sharing your email password. Revoke access from your Google or Microsoft account settings. See Connect Email.

​

What AI agents can access

Agents operate inside your business only, and within it you decide what they can touch:

• Files are invisible to agents until you turn on Agent access. You can also exclude folders. See RAG Indexing.
• Set each tool to allow, ask, or deny; writes require your approval by default. See Tool Permissions.
• Review conversation transcripts, including tool calls and approvals. See Transcripts.

​

AI processing and web search

Your web-search queries may be used to improve or train AI models. On a plan below Enterprise, you do not receive a blanket promise that your data is never used for training or retained by AI providers. On Enterprise, check your agreement for the services expressly covered by supported protections. Do not put sensitive information, credentials or personal information in web search queries unless a separate approved arrangement permits that data and use. Connecting your mailbox or allowing an AI tool does not override mailbox data restrictions. See the privacy policy and data processing agreement for the qualified provider disclosures and restrictions.

​

Payments

You enter your subscription payment credentials through Stripe’s payment service. Your billing and transaction information is also shared with Bizzy.

​

Optional analytics choices

The first time you open Bizzy in a browser, a banner asks whether to allow optional product analytics. Choose Accept or Reject — Bizzy works the same either way, and signing in, security and billing never depend on the choice. To change it later, open Cookie settings from the page footer or from your account menu. A rejection stays in place in that browser across sign-in and sign-out, and withdrawing an earlier acceptance stops further optional collection and clears the related data stored in the browser. The cookie policy lists what each category covers.

​

Requesting your data or deleting your account

Email [email protected] from the address you sign in with. Say which business the request concerns and what you want: a copy of your data, a correction, deletion of your account, or a pause on processing. Don’t include passwords or other sensitive details. You get an acknowledgement with a reference, and a response within the legal deadline for your region (one month in the EU and UK, 45 days in the US). A copy of your data arrives as a file covering your account: profile, sign-in methods and sessions, memberships, billing contact details, usage history, legal acceptances, and notifications. If Bizzy support ever opened a session on your behalf, the file says so; it doesn’t include the support member’s details. For an account someone else owns, the file covers your seat on it, not the owner’s billing details. Records your business keeps about its own contacts and customers stay in the business — export those from the app or the API. Deleting your account removes your businesses and everything in them — contacts, messages, files, agents, automations, conversations, connected mailboxes, and domains you verified. Before you ask, release or transfer any domain you registered through Bizzy and cancel your subscription; a deletion can’t proceed while either is in place. Team members of your account lose access when it’s deleted. If your account has a payment history — a paid subscription, a purchase, a domain you bought through Bizzy, or a Stripe connection — it can’t be deleted outright yet. Instead, your sign-in is turned off: you can no longer sign in or connect an AI client, and your data stays with the billing records until the retention period for those records ends. A business you share with other people keeps running for them, agents and automations included, so delete any business content you no longer want from the app before you ask. Some records are kept in every case: billing and payment records for as long as accounting rules require, and the audit entry recording what happened. Your acceptance of domain-purchase legal terms stays on record for three calendar years from acceptance, including the accepted versions, who accepted, the business and account, the time, IP address and browser information, and references to linked purchases. Deleting your account or business does not shorten this period, and another purchase does not extend it. Expired evidence and its purchase references are removed automatically after the retention period ends; an interruption can delay removal. This exception does not change the payment-history restrictions above. Deleting your account doesn’t erase mail that stays in your Google or Microsoft mailbox, copies your recipients already received, or answers a web-search provider already returned.

​

Reporting a vulnerability

Report suspected security vulnerabilities to [email protected] before disclosing them publicly.

​

Related pages