Privacy Policy — Bisavy

1. Who we are

Bisavy Inc. ("Bisavy", "we", "us") operates bisavy.com and app.bisavy.com. Our registered contact email is privacy@bisavy.com. This policy applies to all visitors and users of our services.

2. Data we collect

Account data: name, email address, and password (hashed) when you create an account.
Workflow data: the integrations you connect, workflow configurations, and run history — stored to operate the service.
Usage data: pages visited, features used, and session duration — collected via anonymised analytics.
Third-party credentials: OAuth tokens for connected integrations (e.g. Gmail, Shopify). These are encrypted at rest using AES-256-GCM and never stored in plaintext.
Payment data: billing details are handled entirely by Stripe. We never see or store your card number.

3. How we use your data

To operate and deliver the Bisavy service.
To send transactional emails (workflow alerts, approval requests, invoices).
To improve the product using aggregated, anonymised usage analytics.
To respond to support requests.

We do not sell your data. We do not use your workflow data to train AI models without explicit consent.

4. Data sharing

We share data only with:

Supabase — database and authentication infrastructure.
Stripe — payment processing.
Vercel — hosting and edge delivery.
Third-party integrations — only the data required to execute your configured workflows.

All sub-processors are bound by data processing agreements and comply with applicable privacy law.

5. Data retention

Workflow run logs are retained for 90 days by default. Account data is retained for the lifetime of your account plus 30 days after deletion to allow recovery. You may request immediate deletion at any time.

6. Your rights

Depending on your location, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data.
Export your data in a machine-readable format.
Object to certain processing activities.

To exercise any of these rights, email privacy@bisavy.com. We respond within 30 days.

7. Cookies

We use essential cookies for session management and authentication. We do not use advertising or tracking cookies. Analytics are collected using privacy-preserving methods that do not require cookies.

8. Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256-GCM). We are pursuing SOC 2 Type I certification and follow PIPEDA guidelines. If you discover a security issue, please report it to security@bisavy.com.

9. Changes to this policy

We will notify you by email and in-app notification if we make material changes to this policy. Continued use of the service after such notice constitutes acceptance.

10. Contact

Questions about this policy? Email privacy@bisavy.com or write to: Bisavy Inc., Canada.