Privacy Policy

1. Our role

Customer Data. Businesses that subscribe to the Service (“Customers”) put records in their workspaces, for example ledger entries, bank account details, documents, products, sales, customers and information about their directors, employees and contractors. For that data we act as a service provider / processor on the Customer’s behalf, and the Customer is the business / controller. If your information is in a Customer’s workspace, please contact that Customer to exercise your rights; we will assist them as required. Our processing of Customer Data is governed by our agreement with the Customer and our Data Processing Addendum.

Our own data. We act as the business / controller for information about website visitors, people who contact us, prospective customers, and account and billing information about Customer representatives. This policy mainly describes that processing.

2. Information we collect

Information you give us

• Account information: name, work email, password (stored only as a secure hash), company name, role and preferences.
• Contact and sales enquiries: name, email, company, phone (optional), company size, topic and message submitted through our contact form or by email.
• Billing information: billing contact, plan and billing history. Card details are collected directly by Stripe; we receive only limited information such as card brand, last four digits and expiry.
• Support communications: messages and attachments you send to support, and information in your workspace that we view to resolve your request.
• Babu conversations: the questions you ask Babu, its answers, whether you marked an answer helpful, and which categories your company uses for each payee. We review them to improve Babu: an answer we teach Babu is written by us and shared with all customers, never your data. Babu’s memory of your categories stays within your company.
• Voice: if you speak to Babu, your browser’s own speech recognition turns your voice into text; some browsers (such as Chrome) do this on their maker’s servers. We receive only the text, never the recording. Reading answers aloud happens on your device.
• Device unlock and offline use: if you sign in with Face ID, a fingerprint or your device PIN, your biometric never leaves your device; we store only a public key that proves the sign-in came from it. To work offline, the app keeps recently opened pages and any entries you save offline on your device until they sync; signing out removes the kept pages.
• Sign-in records: each time you sign in we record the time, your IP address, the country our network provider reports for it, your device type and browser, and a random device ID stored in your browser. We use them to protect your account (for example, to email you about a sign-in from a new device), and you can see your own sign-ins and sign out other devices under Account → Sign-in activity. We do not collect your precise location or fingerprint your device.
• Online shops: when a customer publishes a shop with our E-commerce extension, the shop is responsible for its shoppers’ data (names, phones, addresses, orders and loyalty points); we store it on the shop’s behalf, as their processor, and never sell it or use it for our own marketing.
• Sign-in codes: to confirm it is you, we email a one-time code when you sign in with a password; we store only a scrambled form of it, and a trusted-browser marker if you choose “trust this device”.
• Partners: if you join our partner program, we collect your full profile, National ID or passport number and photos, live selfies for face verification every 90 days, and your payout details. They are stored encrypted, used only to verify you, prevent fraud and pay you, and seen only by our verification team. Customers you refer are shown to you only with most of their name and email hidden.
• Point of sale, CRM and HR: when a customer uses these extensions, records of their in-store sales, their own customers and deals, and their staff (including leave, attendance and, where entered, a National ID or passport number, which we store encrypted and show only as its last four digits) are Customer Data that we process on the customer’s behalf.
• Babu on our website: questions you ask Babu on https://smartbusinesswizard.com are kept with the answer, the page you asked from and the country our network provider reports, but not your IP address or any cookie, so they are anonymous. We read them to improve our answers.
• Customer Data you or your organization upload to the Service (see “Our role”).

Information collected automatically

• Log and device data: IP address, browser and device type, pages requested, referring URL, timestamps and error information, used for security, troubleshooting and capacity planning. Our network provider, Cloudflare, also processes this to protect the website and application against attacks.
• Application activity: in-app actions recorded in the workspace activity history (for example who approved a record and when), which is part of Customer Data.
• Cookies and device storage: essential cookies and storage only, as described in our Cookie Policy. We do not use advertising or third-party analytics cookies.

Information from third parties

• Payment status and fraud-prevention signals from Stripe; information from a colleague who invites you to a workspace (your name, email and role).

3. How we use information

• To provide, maintain and secure the Service, including authentication, invitations and customer support.
• To process payments, manage subscriptions and trials, and send transactional messages (receipts, trial reminders, security and service notices).
• To respond to enquiries and demo requests you send us.
• To operate Babu, including optional Babu AI features where enabled (see below).
• To monitor, debug and improve the Service using logs and aggregated or de-identified usage information.
• To detect and prevent fraud, abuse and security incidents, and to enforce our Terms.
• To comply with legal obligations and respond to lawful requests.
• With your consent or at your direction, for other purposes we describe when we ask. We may send occasional product news to customer contacts; you can unsubscribe at any time.

Legal bases (EEA/UK). We rely on performance of a contract (providing the Service), legitimate interests (securing and improving the Service, responding to business enquiries, B2B marketing), legal obligation, and consent where required (you may withdraw consent at any time).

4. Babu and AI processing

Babu runs on our own servers using Ask Babu, our own assistant software. What Babu knows (our public website, built-in help topics and answers our team writes) is kept on our servers, and Babu does not send your requests, documents or Customer Data to an outside AI provider. If we ever connect Babu to an outside AI model provider, we will list it on our Subprocessors page and update this policy before any of your data is sent to it. We do not use Customer Data to train generative AI models. Babu only works with records the signed-in person is permitted to access, and it never saves records on its own.

5. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose personal information only:

• With service providers (subprocessors) who host, secure, email, process payments or provide optional AI features on our behalf, under contracts that restrict their use of the data. See our Subprocessors list.
• Within a Customer’s workspace, to other Authorized Users according to the roles and permissions the Customer sets.
• For legal reasons, when we believe in good faith that disclosure is required by law or legal process, or needed to protect the rights, property or safety of our users, the public or us.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to this Policy’s protections.
• With your direction or consent.

6. Data retention

We keep personal information only as long as needed for the purposes above. Customer Data is kept for the life of the subscription, remains available for export for 30 days after cancellation, and is deleted from active systems within 60 days after the subscription ends, and from encrypted backups on their normal rotation. Billing records are kept as required for tax and accounting law (typically up to seven years). Contact-form enquiries from people who don’t become customers are kept for up to 24 months. Security logs are kept for a limited period appropriate to their purpose.

7. Security

We use administrative, technical and physical safeguards appropriate to financial records, including encryption in transit, encryption of stored documents, role-based access controls, server-side permission checks and audit logging. See our Security overview. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. International transfers

We are based in Bangladesh, and our primary hosting is in the United States. Your information is therefore processed in the United States, in Bangladesh (where our team provides support, only as described in this policy) and in other countries where our subprocessors operate. Where required, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can update most account information in the application. To make a request, email privacy@smartbusinesswizard.com. We will verify your request (usually by confirming control of the email address on the account) and respond within the time required by law. You may use an authorized agent where the law allows; we may ask for proof of authorization. We will not discriminate against you for exercising your rights.

If your information is in a Customer’s workspace, we will refer your request to that Customer and help them respond.

Marketing emails: use the unsubscribe link in any marketing email. Service and security messages cannot be switched off while you have an account.

10. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

In the past 12 months we have collected these categories of personal information, for the business purposes described in “How we use information”, and disclosed them to service providers for those purposes:

We do not sell or share (as those terms are defined under California law) personal information, including of consumers under 16, and we use sensitive personal information only for purposes permitted without a right to limit. We honor Global Privacy Control (GPC) signals as an opt-out of sale/sharing. To exercise your rights, email privacy@smartbusinesswizard.com with the subject “California privacy request”.

11. EEA, UK and Swiss rights (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data protection authority. The controller for the processing described in this policy is AI Tech, 6232 Camellia Ave, North Hollywood, CA 91606-4119, United States (mailing address). You can reach us about any privacy matter at privacy@smartbusinesswizard.com.

12. Children

The Service is designed for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16, and accounts are only for people 18 or older. If you believe a child has provided us personal information, contact privacy@smartbusinesswizard.com and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, if changes are material, notify customers by email or in the Service before they take effect.

14. Contact us

Privacy questions or requests: privacy@smartbusinesswizard.com

Smart Business Wizard is operated by AI Tech.
Mailing Address: 6232 Camellia Ave, North Hollywood, CA 91606-4119, United States
UK Contact Address: 73 Meon Rd, Southsea, Portsmouth, Southsea PO4 8NN, United Kingdom
Phone: +1 443 251 6605 · WhatsApp: Chat with us on WhatsApp
General information: info@smartbusinesswizard.com · Customer support: support@smartbusinesswizard.com