Privacy Policy

This policy explains how personal data is handled on BizOS (bizos.jonnyai.co.uk). We play two roles under UK GDPR, and it matters which one applies to you:

• We are the controller for the personal data of people who sign up: account emails, workspace details, billing records, support correspondence.
• We are a processor for everything a business stores in its own workspace about its customers, staff, contractors and clients ("Customer Data"). For that data, the business is the controller and this platform acts on its instructions. If a business has your data in its BizOS workspace, your privacy rights are exercised against that business — though we will always help route a request.

1. What we collect (as controller)

• Account data: email address, workspace name, role, sign-in timestamps.
• Billing data: subscription plan, Stripe customer and subscription identifiers, invoice history. Card numbers are held by Stripe, never by us.
• Usage and security data: server logs (IP address, request path, timestamp) kept for security and debugging; an append-only audit trail of actions in each workspace.
• Support correspondence: emails you send us.

We do not run third-party advertising or analytics trackers. The only cookies set are strictly necessary: authentication session cookies and your workspace/theme preferences.

2. Why we process it (lawful bases)

• Contract: running your account, workspace and subscription.
• Legitimate interests: securing the platform, preventing abuse, improving the Service, and sending service-relevant messages to account holders.
• Legal obligation: keeping billing records for tax purposes.
• Consent: anything genuinely optional — for example, marketing emails a business sends through BizOS go only to recipients who have opted in, and every one carries a working unsubscribe link.

3. AI processing

JonnyAI features send relevant workspace context (module data snapshots, your question, meeting notes or audio where you use those features) to third-party AI providers — currently Anthropic (language model) and Groq (audio transcription) — to generate the response. These providers process the data to provide the service and do not use it to train their models under the terms we use them on. AI-proposed actions execute only after a person confirms them, and are audited.

4. Who we share data with (sub-processors)

• Supabase — database, authentication and file storage (hosted in the EU, Paris region).
• Google Cloud — application hosting (London region).
• Stripe — payments and subscription billing.
• Resend — transactional and (consented) marketing email delivery.
• Anthropic and Groq — AI processing as described above.

We do not sell personal data. Where a sub-processor is outside the UK/EEA, transfers rely on adequacy regulations or standard contractual clauses. We will update this list when sub-processors change.

5. How long we keep it

Account and workspace data: for the life of the workspace, then deleted after a retention window of at least 60 days following closure or subscription lapse (so you can export or reactivate). Billing records: 6 years, as UK tax law requires. Server logs: rotated on a short cycle. Audit trails live inside the workspace they belong to and follow its lifecycle.

6. Security

Data is encrypted in transit (TLS) and at rest. Every workspace is isolated by row-level security enforced in the database itself, so one business can never read another's data. Access follows least-privilege: portal users see only their own portal; staff see only their workspace; platform-level operations are restricted and audited. Payment card data never touches our servers.

7. Your rights

Under UK GDPR you can ask for access to your personal data, ask us to correct or delete it, restrict or object to processing, and request a portable copy. Email hello@biz-os.co.uk and we will respond within one month. Remember the two roles: for data a business holds about you in its workspace, the request belongs with that business — we will help them fulfil it. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). Aleejy AI Ltd (trading as JonnyAI, BizOS) is registered with the ICO, reference C2011497.

8. Children

The Service is for businesses and is not directed at children. Workspace data about minors (for example in care or education modules) is Customer Data controlled by the business that stores it, which is responsible for its lawful basis.

9. Changes

We will post any changes here and, for material changes, notify account holders by email or in-app before they take effect.