Privacy notice

The application and its operator

This notice covers Google sign-in, guest drafts, saved account projects, AI requests, subscriptions and PDF access at app.bplan.ai. The marketing website at bplan.ai has separate notices.

Business Plan AI. support@bplan.ai.

Google sign-in

The app requests openid email to authenticate your Google account and check that its email is verified. The saved account identifier is Google issuer and subject, linked to an internal account ID. Verified email is checked during sign-in; it is not saved as the app account identifier. The app does not request access to Gmail or Google Drive.

Google handles your Google password. Temporary sign-in state and secure browser cookies help validate the sign-in and prevent forgery; Google access and ID tokens are not saved as app session credentials. Google processes sign-in under its Privacy Policy.

Your browser, drafts and saved work

The browser uses local storage for a guest draft and navigation preferences, and session storage for the active project and a pending checkout journey. A guest draft can include questionnaire answers, selected suggestions and financial inputs. Saved account projects stay on the server and in the current page memory rather than being copied into the guest draft store.

Server records can include project titles, answers, suggestions, financial models, calculated snapshots, document versions, generated text and saved PDF bytes. These records support reopening and editing your work and checking access to saved documents. Signing out does not delete account projects, payment history or saved documents. Clearing browser storage affects local copies; it does not erase server records.

AI requests and OpenAI

When an AI action runs, the app sends the business information and context needed for that action to OpenAI. This can include questionnaire answers, selected suggestions, assumptions, financial-model context and document text. The app stores returned guidance and generated documents to provide the requested workflow.

Public paid AI requests set store:false and disable background processing. Web search follows the saved AI settings; when enabled, it can send search queries as part of the requested action. This setting does not promise zero retention by the provider. OpenAI describes its API processing and retention controls in its API data documentation. Avoid putting passwords, card numbers or unnecessary personal information into your business answers.

Subscriptions, payments and usage records

Card details are entered on Stripe-hosted Checkout. The app sends Stripe the selected plan and internal account/checkout identifiers and stores verified customer, subscription, invoice and payment-status references, paid periods and project allowances. Payment and usage records help enforce access, handle cancellation and respond to refunds or disputes. Stripe describes its processing in its Privacy Policy.

TEST billing and real LIVE billing are separate. A TEST payment is not a real purchase. Returning from Checkout alone does not grant paid access. AI request records, including an uncertain provider outcome, remain recorded so a retry does not silently spend again.

Purposes and legal grounds

The app uses the data described above to authenticate you, save your work, perform requested calculations and AI actions, deliver paid documents, administer subscriptions and enforce security and usage limits.

Where the law that applies requires a legal basis, our grounds are providing the service you request under a contract, complying with applicable legal obligations, and our legitimate interests in protecting accounts, preventing fraud and resolving service issues, balanced against your rights. Processing that requires consent is identified separately; reading this notice is not consent.

Retention and deletion

Guest draft reuse and server draft expiry are different from deleting all copies. Saved account versions, payment rights and usage receipts have separate lifecycles. Canceling renewal or signing out is not a deletion request. The app currently has no self-service account deletion control.

Saved account projects and document histories are retained for reopening work and checking document access; canceling a subscription does not automatically erase them. Payment and AI request-outcome records are separate from editable project content. For a deletion request, email support@bplan.ai. We assess the request against applicable rights and any necessary transaction, dispute or security records, and explain any records that must remain.

Infrastructure and international processing

The main application loads the Inter font from Google Fonts, which creates browser requests to Google font services. These notice pages themselves load no external fonts, scripts or tracking assets. Google, OpenAI and Stripe have their own provider policies; the operator remains responsible for the application practices described here.

Business Plan AI operates from Wyoming, United States. The application is hosted on Railway; its current application service and attached persistent volume run in US East (Virginia, United States). Railway processes network and operational metadata, which can include IP address, user agent, request path, response status and logs. Its Hobby plan currently provides seven days of log access; this does not promise that every provider copy is erased after seven days. Railway's published processing terms describe international transfers and contractual safeguards. Operator-controlled recovery archives are encrypted and held separately from the running application. Canceling a subscription or signing out does not delete those archives. Deletion requests are assessed under the retention rules in this notice, including necessary transaction, dispute, security and recovery records. Google, OpenAI and Stripe may process information in the United States and other countries under the provider policies linked here. A deployment region does not guarantee that every provider processes information only in that country. Email support@bplan.ai for information about the arrangements applicable to your data.

Railway publishes its Privacy Policy and Data Processing Addendum.

Your choices, requests and contact

You can edit saved project inputs, sign out, clear local browser storage and cancel subscription renewal in Billing. Depending on applicable law, you may have rights to access, correct, erase, restrict or receive your personal data, object to processing, withdraw consent where relied on, or complain to a data-protection authority. These rights can have conditions and exceptions.

Email support@bplan.ai to request access, correction, deletion or another right available under the law that applies. Identify the account and the request; do not send your Google password or full card details. We may ask for information reasonably needed to verify identity and protect other people's data. We assess and answer requests under applicable law, including explaining any limits and available complaint routes.

For privacy requests, contact Business Plan AI. support@bplan.ai.