1. Roles: Data Controller and Data Processor
Data Controller: We act as the Data Controller for personal data collected directly from users when registering an account, purchasing a subscription, or communicating with our support team.
Data Processor / Service Provider: When founders enter operational venture figures, cap tables, budgets, or third-party investor contact information into the Platform, the founder (or their corporate entity) acts as the Data Controller, and Static Play Holdings LLC acts as the Data Processor processing that information strictly on the founder's behalf.
2. Information We Collect
Information You Provide Directly:
- Account Credentials: Email address, workspace name, password credentials (managed securely via Supabase Auth).
- Billing Information: Payment details, billing address, and transaction history. All payment card numbers are tokenized and processed directly by Stripe, Inc.; we never store raw credit card numbers or CVV codes on our servers.
- Founder Venture & Operational Data: Stated financial metrics, cash balances, revenue figures, cost items, headcount and compensation assumptions, lean canvas cards, milestone roadmaps, and scenario diffs (“Venture Data”).
- Third-Party Investor Contacts: Names, email addresses, affiliations, and update preferences entered by founders to send investor updates (“Monday Pulse”).
Information Collected Automatically:
- System Telemetry: IP addresses, browser user-agent strings, operating system, referrer URLs, and device types.
- Usage & Audit Logs: Cryptographic seal chain logs, model recalculation timestamps, dossier export counts, and share-token generation history.
- Security Tokens: Salted cryptographic hashes for embed view metering and per-visitor rate-limiting.
3. How We Use Your Information
We process personal and operational data for the following specific business purposes:
- To Deliver and Maintain the Service: Computing financial models, rendering runway and burn charts, generating presentation decks (.pptx, .pdf), and managing workspace state.
- To Process Payments and Subscriptions: Managing billing, invoices, upgrades, downgrades, and renewals through Stripe.
- To Send Authorized Investor Updates: Transmitting “Monday Pulse” briefings to founder-designated contacts via Resend, Inc.
- To Sort Support Requests: When you write to support, an automated classifier (TypeSafe AI) labels the request by topic and urgency so a person reads the urgent ones first. It never replies, never issues refunds, and its labels are hints to our staff only.
- To Ensure Security and Prevent Abuse: Enforcing share-token rate limits, authenticating sessions via Supabase Auth, and detecting fraudulent or unauthorized activity.
- To Comply with Legal Obligations: Maintaining required accounting records and enforcing our Terms of Service.
4. Third-Party Subprocessors & Infrastructure
We do not sell, rent, or trade your personal information or venture financial models to any third parties for advertising or commercial monetization. We share data only with trusted third-party service providers (subprocessors) necessary to operate our infrastructure:
| Subprocessor | Purpose | Location | Data Handled |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge routing | United States | IP, headers, request payloads |
| Supabase Inc. | PostgreSQL database, user auth | United States | Encrypted records, venture models |
| Stripe, Inc. | Payment processing, billing portal | United States | Name, email, payment tokens |
| Resend, Inc. | Transactional & update email delivery | United States | Recipient email, email body, logs |
| TypeSafe AI | Automated classification of support requests and of public competitor page text | United States | Support request subject and message; crawled public web pages |
| Anthropic PBC (Anthropic) | AI model inference for planning, advisory, simulator, competitor scan, copilot, document drafting, optimizer, scoring and comparison | United States | Your request text: goal, roadmap, decisions, team and payroll figures, budget and ledger figures, and prompts you write |
| X.AI LLC (xAI) | AI model inference for planning, advisory, simulator, competitor scan, copilot, document drafting, optimizer, scoring and comparison | United States | Your request text: goal, roadmap, decisions, team and payroll figures, budget and ledger figures, and prompts you write |
| Moonshot AI (Moonshot) | AI model inference for planning, advisory, simulator, competitor scan, copilot, document drafting, optimizer, scoring and comparison | China | Your request text: goal, roadmap, decisions, team and payroll figures, budget and ledger figures, and prompts you write |
| OpenAI, L.L.C. (OpenAI) | AI model inference for planning, advisory, simulator, competitor scan, copilot, document drafting, optimizer, scoring and comparison | United States | Your request text: goal, roadmap, decisions, team and payroll figures, budget and ledger figures, and prompts you write |
| Google LLC (Google) | AI model inference for planning, advisory, simulator, competitor scan, copilot, document drafting, optimizer, scoring and comparison | United States | Your request text: goal, roadmap, decisions, team and payroll figures, budget and ledger figures, and prompts you write |
| OpenRouter, Inc. (OpenRouter) | AI model inference for planning, advisory, simulator, competitor scan, copilot, document drafting, optimizer, scoring and comparison routing | United States | Your request text: goal, roadmap, decisions, team and payroll figures, budget and ledger figures, and prompts you write (forwards your request to the model vendor you selected, including the vendors listed above) |
Which AI model provider receives your content, and when
BizzyRoad's planning, advisory, simulator, competitor-scan, prompt-optimizer, scoring and comparison features send the text of your request — which, depending on the feature, can include your goal, roadmap, decisions, team and payroll figures, budget and ledger figures, and the prompts you write — to an AI model provider so the model can respond. The provider is determined by which API key pays for that specific run:
- Your own provider key. If you have stored a key under Settings → Keys, your content goes to the provider you chose, under your own account and that provider's terms with you.
- Your own OpenRouter key. Your content goes to OpenRouter, which forwards it to the underlying model vendor for the model you selected.
- Our key (included runs). When a run is covered by your plan rather than by a key of yours, we pay for it with our own credentials, and your content goes to the provider serving that model — directly, or through OpenRouter to that provider.
We do not use your content to train any model, and we do not authorise these providers to do so. Each provider is bound by its own published terms and retention policy; where a provider retains request content for abuse monitoring, that retention is governed by the provider, not by us. You can avoid our key entirely by supplying your own under Settings → Keys, and you can avoid these providers altogether by not using the AI features.
5. Third-Party Investor Contacts & Founder Attestation
Founders utilizing BizzyRoad's investor management and “Monday Pulse” investor update features warrant and attest that they have established a legitimate prior business relationship or obtained affirmative consent from each investor or stakeholder before uploading their email address to the Platform.
Recipient Rights & Immediate Suppression:
Every email sent through our platform on behalf of a founder contains an automated, single-click unsubscribe link. When an investor clicks this link:
- Their address is immediately flagged as unsubscribed in our database.
- The Platform suppresses all future emails to that address from that workspace.
- The recipient may also contact us directly at
support@bizzyroad.comto request permanent removal of their contact record across the Platform.
6. Data Security Measures
We implement comprehensive administrative, physical, and technical safeguards designed to protect personal and business data against unauthorized access, loss, or alteration:
- Encryption in Transit: All traffic to and from bizzyroad.com is encrypted using Transport Layer Security (TLS 1.3).
- Encryption at Rest: All database tables and file assets hosted on Supabase are encrypted at rest using AES-256.
- Tenant Isolation: The server checks that the signed-in account owns a project before every read and write, and Supabase PostgreSQL Row-Level Security (RLS) policies block direct database access to other accounts' rows.
- Rate-Limiting & Hash Masking: Share links are long random tokens stored only as hashes; widget views are rate-limited using salted visitor hashes.
7. Data Retention & Account Deletion
We retain your account data and Venture Data for as long as your account remains active. If you cancel your subscription, your plan stays active until the end of the period you paid for, then moves to Free; your data stays in your account.
Right to Deletion (Purge Guarantee): You may request permanent deletion of your account and all associated workspace data at any time by emailing support@bizzyroad.com. Upon receipt of a verified deletion request, all database records, financial models, and contact entries will be permanently purged within thirty (30) days, except where retention is strictly required by law or tax compliance.
8. Your Statutory Privacy Rights (CCPA / CPRA & State Laws)
Depending on your jurisdiction, you may have specific statutory rights regarding your personal information:
- Right to Know / Access: Request disclosure of categories and specific pieces of personal information collected about you.
- Right to Delete: Request deletion of personal information held by us, subject to legal exceptions.
- Right to Correct: Request correction of inaccurate personal data.
- Right to Non-Discrimination: We will not deny services, charge different prices, or provide a different quality of service because you exercised any of your privacy rights.
- Notice Regarding “Sale” or “Sharing”: We do not sell personal information or share personal information for cross-context behavioral advertising.
To exercise any of these statutory rights, email support@bizzyroad.com with the subject line “Privacy Rights Request”.
9. Contact & Privacy Officer
10. Pilot program
A venture the operator places in the pilot asks its founder first. Nothing is recorded on a venture that is not in the pilot, and nothing before the founder says yes.
What we record, only after you say yes:
- How long this venture’s overview page took to load.
- Which controls you clicked on that page — buttons, links, form fields and other marked controls — by their label with any digits blanked, never what you typed into a field. A click anywhere else is not recorded.
- How many times the words “unstated” or “not computed” were on that page (an approximate count).
- What you write in the “What got in the way this week?” feedback box.
- We do not record your figures: not your numbers, your documents or your contacts.
- We keep the recording for 90 days after the pilot ends, then the operator deletes it by hand. Ask support to delete it sooner.
- You can withdraw at any time from this panel or by asking support; recording stops at once.
- Recording happens only on this venture, and only while you are signed in.
11. Cookies, Browser Storage & Performance Telemetry
We use strictly necessary cookies and browser storage to operate authentication and session security, as well as lightweight performance telemetry:
- Authentication & Security: We use Supabase Auth session cookies (
sb-access-token,sb-refresh-token) to authenticate requests and secure founder sessions across navigations. - Preferences: Functional cookies (e.g.
promptlab_rotation) hold your client-side model rotation preferences without storing identifying personal data. - Performance Telemetry (Vercel Speed Insights): We run Vercel Speed Insights to monitor Core Web Vitals (such as load time and layout stability). Speed Insights gathers anonymized performance metrics without collecting personal data, tracking across sites, or selling data to advertising networks.