LEGAL

Privacy Policy

Effective and last updated: October 31, 2026

BIDrivenSME (“BIDrivenSME”, “we”, “us”, or “our”) helps small businesses record, organise, and understand their sales, expenses, inventory, invoices, and team activity. This Privacy Policy explains what personal information we collect, how we use and share it, and the rights and choices available to you. It applies to our website at www.bidrivensme.com and the BIDrivenSME application (together, the “Service”).

This policy should be read with our Terms of Service. If you have a question or a privacy request, contact us at bi.driven.sme.support@gmail.com.

1. Our role

We decide how and why personal information is used for account, security, support, and service-improvement purposes, and are responsible for that information.

A business using BIDrivenSME decides what it records about its own customers, suppliers, and staff. For those workspace records, the business is responsible for the information and we handle it on the business’s instructions in order to provide the Service. If you are a customer of a business that uses BIDrivenSME, please send requests about your information to that business first.

2. Information we collect

Account information: your name, email address, password (stored only in protected form by our authentication provider), sign-in method, and account security settings.
Business and workspace information: your business name, country, currency, and time zone, and the information you enter or import, including sales, expenses, inventory, suppliers, invoices, reports, and customer names. Files you upload are read and validated so their records can be imported. If you save a dataset for analysis, we keep a summary and a limited preview of it.
Questions and answers: the questions you ask the Problem Solver and the answers it gives, which are saved with your account and workspace.
Team information: the names, email addresses, roles, and invitation status of people invited to a workspace, and a record of workspace activity, such as who recorded a sale or changed a setting.
Support and feedback information: your name, account email, workspace name, the page you choose to include, and your message when you contact us or send feedback.
Security and device information: verification codes, passkey details, two-step verification settings, and, where device approval is enabled, a protected device identifier and a general device description, such as the browser and operating system type.
Usage information: basic counts of feature use, such as opening the dashboard or reports. These are limited to one count per signed-in user, workspace, feature, and day. They do not include typed messages, sales figures, invoices, uploaded file contents, questions you ask, passwords, or bank information.
Technical information: our hosting and network security providers process information such as IP address, browser type, and request details so they can deliver and protect the Service.

We do not ask for bank login details or card numbers, and third-party payment, bank, point-of-sale, and accounting connections are not currently available in the Service.

3. How we use information and our legal bases

We use personal information only where the law allows it:

To provide the Service under our agreement with you: creating accounts and workspaces, importing and displaying records, producing reports and alerts, answering questions about your data, managing team access, and sending invitations, verification codes, and reports you have scheduled.
For our legitimate interests: keeping the Service secure, preventing misuse, diagnosing problems, responding to support requests, and understanding which features are used so we can improve them. We balance these interests against your rights.
To meet legal obligations: complying with applicable law, lawful requests, and record-keeping duties.
With your consent: where consent is required. You can withdraw consent at any time, which does not affect earlier use.

We do not use your business data for advertising, and we do not make decisions about you that produce legal or similarly significant effects solely by automated means.

4. Automated insights

Reports, alerts, the Problem Solver, and dataset answers are produced by BIDrivenSME’s own software from the information in your workspace or the file you provide. We do not currently send your business data to a third-party AI provider, and we do not use it to train AI models. We will update this policy before that changes.

When you choose Continue with Google, we use your Google name, profile picture, and email address only to authenticate your BIDrivenSME account. We do not request access to your Gmail, Google Drive, contacts, or other Google business data, and we do not sell this information or use it for advertising.

We do not sell your personal or business data. We share information only as follows:

Within your workspace: workspace owners can see their workspace’s records, team, and activity. Sales staff can see only what their role allows and cannot see expenses, profit, unit costs, or imported and saved files.
With our service providers: companies that operate parts of the Service for us and may use information only for that purpose. They currently are Supabase (authentication and database), Render (application hosting), Cloudflare (domain, network, and security), Resend (email delivery), and Google (optional sign-in and website fonts).
For legal and safety reasons: where we reasonably believe disclosure is required by law or needed to protect the rights, safety, or security of our users, the public, or the Service.
In a business transfer: as part of a merger, acquisition, or transfer of the Service, subject to this policy or a notice to you.

Our internal owner console shows aggregate usage, account and workspace details needed for support, and reports you choose to send to BIDrivenSME support. It does not show your sales, invoices, uploads, or questions.

7. International transfers

Our service providers may process information in countries other than the one where you live, including countries with different data protection laws. Where the law requires it, we rely on appropriate safeguards for those transfers. You can contact us for more information.

8. How we protect information

Each business has a private workspace, and access is limited to its owner and the team members the owner authorises. Information is encrypted in transit, and we offer two-step verification and passkeys. No online service can be guaranteed to be completely secure, so please use a strong, unique password and keep your sign-in details private. If a data breach affects your information, we will notify you and the relevant authorities where the law requires.

9. How long we keep information

We keep personal information for as long as your account or workspace is active and as needed to provide the Service. Owners can remove imported files, saved datasets, and business records from within the app. Accounts cannot currently be deleted in the app, so to close your account or delete a workspace, contact us. We will delete or anonymise the information unless we need to keep it to meet legal obligations, resolve disputes, or enforce our agreements. Copies may remain in routine backups for a limited time before they are overwritten.

10. Your rights and choices

Depending on where you live, and subject to legal limits, you may have the right to:

ask for access to, or a copy of, your personal information;
correct inaccurate or incomplete information;
ask us to delete your information;
object to, or ask us to restrict, certain uses of your information;
receive your information in a portable format;
withdraw consent where we rely on it; and
complain to a data protection authority.

You can update your details, change security settings, and remove passkeys in Settings. For anything else, email bi.driven.sme.support@gmail.com. We may need to verify your identity and will respond within the time required by applicable law.

If you are in Nigeria, your rights are protected by the Nigeria Data Protection Act 2023, and you may complain to the Nigeria Data Protection Commission. If you are elsewhere, you may contact your local data protection authority.

11. Cookies and browser storage

We use only cookies that the Service needs to work. They keep you signed in, remember your active workspace, protect sign-in steps, and, where device approval is enabled, recognise an approved device. Sign-in cookies last up to 30 days, the device approval cookie lasts up to one year, and most temporary security cookies expire within minutes. We also store your sidebar preference in your browser and keep app files on your device so the Service loads quickly.

We do not use advertising cookies. Blocking essential cookies will stop you from signing in. Our pages load fonts from Google, which receives your IP address when they load.

12. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the Service or the law changes. We will change the date at the top of this page and, for material changes, give notice by email or in the Service before they take effect.

14. Contact us

For privacy questions or requests, email bi.driven.sme.support@gmail.com.