Your data, your rights

Bzyness (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

We use the collected information for the following purposes:

• Provide and maintain our services

• Generate business analytics and recommendations

• Process payments and subscriptions

• Send notifications and updates

• Improve our platform and user experience

• Comply with legal obligations

We share your information only with the following sub-processors who help us deliver our services:

• Razorpay — payment processing and subscription billing

• MongoDB Atlas — cloud database hosting for all stored data

• Redis / cloud hosting — session management and caching infrastructure

• SMTP / email provider — transactional email delivery (billing receipts, alerts)

• AI inference providers — anonymised business metrics are sent to AI APIs to generate profit briefs and recommendations; no end-customer PII is included

• Legal authorities — when required by Indian law or court order

We implement industry-standard security measures to protect your data:

• TLS encryption for all data in transit (HTTPS everywhere via Traefik)

• AES-256-GCM encryption for OAuth tokens, API keys, and payment identifiers at rest

• bcrypt (12 rounds) for passwords — never stored in readable form

• Role-based access control with multi-tenant isolation — no cross-account data access

• Immutable audit logs on all data access and account actions

• Rate limiting, input sanitisation, and suspicious pattern detection

We apply industry-standard security controls and conduct periodic internal security reviews. We plan to commission independent penetration testing (VAPT) from a CERT-In empanelled auditor before our enterprise tier launch.

Under the Digital Personal Data Protection Act, 2023 (India) and applicable law, you have the following rights regarding your personal data:

• Access: Request a copy of all personal data we hold about you

• Correction: Update or correct inaccurate personal information

• Deletion (Erasure): Request deletion of your account and personal data

• Portability: Export your data in a structured, machine-readable format

• Objection: Object to processing of your personal data for specific purposes

• Grievance Redressal: Lodge a complaint with our Grievance Officer (see §11)

• Opt-out: Unsubscribe from marketing communications at any time

To exercise any of these rights, email tech@bzyness.ai with your request. We will respond within 30 days as required under the DPDP Act, 2023.

We retain your personal data for as long as necessary to provide our services and fulfill the purposes described in this Privacy Policy. When you delete your account, we will anonymise or delete your personal data within 30 days of the deletion request being processed.

GST exception: Financial records including invoices and payment transactions are retained for 7 years as required under the Goods and Services Tax Act and applicable Indian tax law. These records are anonymised upon account deletion — your name and contact details are removed while the financial amounts and GST data required for compliance are preserved.

Our services are not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will delete that information promptly.

We may update this Privacy Policy from time to time. For material changes — particularly any changes to how we collect, use, or share your personal data — we will notify you by email at least 14 days before the change takes effect. We will also update the “Last updated” date at the top of this page. Where changes affect how we process your personal data, we will seek your explicit consent before the change takes effect.

If you have questions about this Privacy Policy or want to exercise your rights under the Digital Personal Data Protection Act, 2023, please contact us:

In accordance with the Digital Personal Data Protection Act, 2023 (§13) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Redressal Officer to address complaints about our data practices.

We operate under the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000, and applicable provisions of the Consumer Protection Act, 2019.