Privacy policy

This policy explains how Bizacqui (“Bizacqui”, “we”, “us”) handles personal data when you visit our website, create an account, or use the Bizacqui platform, and how we handle personal data on behalf of the businesses that use it.

1. Our two roles

As a controller. We decide how and why we process data about visitors to our website, people who contact us, and the people who hold accounts on Bizacqui (for example name, email, login and billing details).

As a processor. Businesses that use Bizacqui (“customers”) upload and receive data about their own leads, prospects and customers, such as names, business contact details and message content. For that data the customer is the controller and we process it only on their documented instructions, under our Terms and a data processing agreement. If you are a lead of one of our customers, please contact that business first about your data.

2. Data we collect

• Account data: name, email address, password hash, two-factor settings, workspace memberships and roles.
• Usage data: actions taken in the product, audit logs, device and browser information, IP address and timestamps.
• Customer content: knowledge documents, offers, settings, and messages exchanged with leads across connected channels.
• Prospect data: publicly published business contact details and public information about companies, gathered on a customer’s behalf for business-to-business outreach.
• Communications: what you send us through forms, email or chat.
• Billing data: plan, invoices and payment status (card details are handled by our payment processor, not stored by us).

3. How we use data

• To provide, secure and support the platform, including running AI agents that draft and send messages under each customer’s configured rules.
• To authenticate users, prevent abuse, enforce suppression and opt-out lists, and keep audit records.
• To send service and transactional email such as sign-in links, alerts and digests.
• To improve the product using aggregated, de-identified metrics. We do not use customer content to train third-party foundation models.
• To meet legal obligations.

Our legal bases include performance of a contract, legitimate interests (security, product improvement, B2B communication), consent where required, and legal obligation.

4. AI processing

Agent runs send the minimum necessary context for one workspace (its knowledge pack, settings and the relevant conversation) to AI model providers to produce a draft decision. Credentials are never included. Each run executes in an isolated, temporary environment that is deleted afterwards. Outputs are validated by the platform before any action is taken.

5. Sub-processors

We use carefully selected service providers, including:

• Anthropic and OpenAI: AI model processing through the Claude Code and Codex engines.
• Resend: transactional and customer email sending and receiving.
• Zernio: social media publishing and inbox (direct messages and comments).
• Stripe and Paystack: payment links and payment processing, when a customer connects them.
• Our cloud hosting and infrastructure providers: servers, storage and backups.

WhatsApp messaging runs through each customer’s own linked WhatsApp account. An up-to-date list is available on request.

6. Security

Customer data is logically separated per workspace with database row-level security. Credentials are encrypted with envelope encryption. Data is encrypted in transit with TLS. Access is role-based and audited, two-factor authentication is required for privileged accounts, and backups are encrypted. No system is perfectly secure; we will notify affected customers without undue delay if we become aware of a breach affecting their data.

7. Retention

Account data is kept while your account is active. Customer content is kept for the life of the workspace; when a workspace is deleted it is permanently erased after a 14-day grace period, and removed from backups within their normal rotation. Suppression (opt-out) records may be kept longer so that opt-outs continue to be honoured.

8. International transfers

Our providers may process data outside your country. Where required we rely on appropriate safeguards such as standard contractual clauses.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. To exercise them, email privacy@bizacqui.tutapis.com. You may also complain to your local data protection authority. Recipients of outreach can opt out at any time using the link in any message or by replying “stop”.

10. Cookies

We use strictly necessary cookies to keep you signed in and secure, and local storage to remember preferences such as light or dark theme. The website chat widget stores an anonymous visitor identifier so conversations can continue.

11. Children

Bizacqui is a business service and is not directed at children.

12. Changes and contact

We will post changes here and update the date above, and notify account holders of material changes. Questions: privacy@bizacqui.tutapis.com.