Privacy Policy

What Data We Collect

Account data: when you sign up, we collect your name, email address, and password, which is stored in encrypted form.

Authentication data: when you sign in with email/password or Google OAuth, we collect the identifiers and session data needed to authenticate your account and keep it secure.

AI conversation data: when you use the AI Analyst, we collect the messages you submit, the generated responses, conversation titles and timestamps, selected company or report context, tool activity and associated report cards, and technical identifiers needed to keep the conversation connected.

Usage data: we log the searches you run, reports you generate, and entities you monitor. This is necessary to provide the service.

Analytics data: if you consent to analytics, we use PostHog on the authenticated application to understand product usage. We do not send your email address to PostHog.

Payment data: payments are processed by Stripe. We do not store your card details. Stripe's privacy policy applies to payment processing.

Technical data: we collect standard technical information including IP address, browser type, and device information for security and service improvement purposes.

AI Analyst and OpenAI Processing

When you use the AI Analyst, BizRisk sends your prompt and the relevant context needed to answer it to OpenAI's Responses API. That context may include your message, system instructions, the company, director, domain, or report information you selected, tool definitions, tool results, relevant report content, and previous OpenAI response identifiers.

OpenAI acts as a service provider that processes this API data so BizRisk can generate AI responses and tool calls. OpenAI's API data is not used to train or improve OpenAI models unless BizRisk explicitly opts in to that use.

This does not mean the data is never transmitted to or temporarily retained by OpenAI. Under standard API controls, OpenAI may retain API content for service operation and abuse monitoring. Please do not submit unnecessary sensitive or confidential information to the AI Analyst.

How We Use Your Data

We use your data to provide and operate BizRisk, generate AI analysis and responses, maintain conversation history, run reports and monitoring actions you request, send account-related emails, improve the platform, and meet legal or compliance obligations.

• Provide and operate the BizRisk service
• Generate AI analysis and responses
• Maintain conversation history
• Perform reports and monitoring actions you request
• Send confirmations, alerts, and support responses
• Secure, debug, and prevent abuse of the AI service
• Improve and maintain the platform
• Meet legal and compliance obligations
• Support automated scoring, summaries, and monitoring alerts that remain subject to human review

We do not sell your data to third parties. We do not use your data for advertising.

Data Sources We Query

When you run a report, BizRisk queries public data sources on your behalf. The subjects of those reports, including companies, directors, and domains, are not users of BizRisk and their data is handled in accordance with applicable data protection law.

Where Article 14 notice obligations apply to third-party report subjects, BizRisk applies the relevant legal basis, exemption, or notice process required by law and uses the minimum data needed to produce the report.

Lawful Bases

We rely on different lawful bases under data protection law depending on the processing involved.

• Contractual necessity for providing accounts, reports, monitoring, and requested AI Analyst functionality
• Legitimate interests for service security, fraud prevention, debugging, and limited product improvement
• Legal obligation where records must be retained by law
• Consent for optional analytics cookies and PostHog product analytics where those are enabled

Withdrawing analytics consent does not affect core service processing that is carried out because it is necessary to perform our contract with you.

Data Retention

We retain your account data for as long as your account remains active.

AI conversations are retained while your account remains active unless you delete them earlier, where that feature is available.

If you close your account, BizRisk deletes stored AI conversations and the associated application data, subject to any legal retention requirement that applies.

OpenAI applies its own API retention controls separately as the processor for AI Analyst requests.

We do not promise a shorter technical deletion period than our implementation guarantees.

International Data Transfers

Some of our service providers may process data outside Ireland or the European Economic Area.

Where required, we use appropriate contractual and legal safeguards such as adequacy decisions or approved standard contractual clauses.

We do not claim that every provider stores all data exclusively in Europe.

Your Rights

Under GDPR you have the right to access, correct, delete, restrict, or move the personal data we hold about you.

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Data portability
• Withdraw consent where we rely on consent
• Complain to the Irish Data Protection Commission
• If UK data protection law applies to your matter, complain to the UK Information Commissioner's Office

If you withdraw consent for analytics cookies, the change only affects that consent-based processing and does not affect core service processing carried out under contract.

To exercise any of these rights, contact us at support@bizrisk.uk.

Cookies

We use strictly necessary cookies and similar technologies to keep BizRisk secure and working properly. These are used across the site, including the authenticated application, for things like login, session handling, and security. These cookies are essential and do not require consent under Irish and UK ePrivacy rules.

On our public marketing pages only, we use Google Analytics (GA4) to understand how visitors use the site and to improve the product. Google Analytics is not loaded within the authenticated application. Analytics cookies are only set after you choose Accept in the cookie banner. If you choose Reject, analytics cookies stay off and you can still use the site fully.

When analytics consent is granted, we also use PostHog in the authenticated application to understand product usage. PostHog is not identified with your email address, and withdrawing consent stops future analytics capture and clears the current analytics identity.

Google Analytics helps us understand general usage patterns such as which pages are visited, how visitors arrive at the site, approximate region or location information, and the type of device or browser being used. It also helps us see referral sources, such as whether someone came from a search engine or another website.

We store your cookie consent choice for 6 months. After that, we ask again.

Third-Party Services

We use third-party services to operate BizRisk.

• OpenAI for AI Analyst prompt processing, response generation, and tool calls
• Google Analytics for consent-based analytics on the public site
• Google for OAuth sign-in
• PostHog for consent-based product analytics in the authenticated application
• Stripe for payment processing
• Supabase for database, authentication, and application storage
• Vercel for hosting and deployment
• Resend for transactional email

Each provider has its own privacy policy governing its handling of data.

Security

We take reasonable technical and organisational measures to protect your data. All data is transmitted over HTTPS. Passwords are hashed and never stored in plain text.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or by a notice on the platform.

Contact

If you have any questions about this policy, contact us at support@bizrisk.uk.