Your privacy matters.

BusinessOS AI is an AI-powered business platform operated by Kelechi C Damian (trading as BusinessOS AI), based at No 2 Oleh Rd, Sapele, Delta State, 331107, Nigeria. We provide tools that help small and medium businesses build websites, manage customers, communicate with leads, generate content with AI, and operate online.

BusinessOS AI is not currently a registered limited liability company. We operate as a sole proprietorship. We plan to incorporate in Nigeria and potentially other jurisdictions as we grow. When that happens, this policy will be updated to reflect the new legal entity.

For the purposes of the Nigeria Data Protection Regulation (NDPR) 2019 and, where applicable, the EU General Data Protection Regulation (GDPR), BusinessOS AI is the data controller of personal data you provide when you use our services.

We collect the following categories of information:

• Account information: your name, email address, password (hashed by our authentication provider), and — if you provide them — phone number and business name.
• Business information: the details you enter about your business, including the business description, services, target customers, and any content you generate or upload.
• Customer and lead data: names, phone numbers, email addresses, and messages of the customers and leads you manage through our CRM and WhatsApp Inbox.
• Payment information: handled entirely by our payment processor, Paystack. We never store your card number, CVV, or bank details on our servers.
• Content you create: websites, social posts, images, invoices, and other materials you generate or upload.
• Usage and technical data: IP address, browser type, device type, pages visited, and actions taken within the platform, collected to keep the service secure and reliable.
• Communications: messages you send us by email, WhatsApp, or through our contact form.

We use your information to:

• Provide, operate, and maintain the BusinessOS AI platform.
• Create and secure your account and authenticate you.
• Generate the websites, content, images, and other materials you request using AI.
• Process payments, manage subscriptions, and prevent fraud.
• Send service messages such as security alerts, billing receipts, and important product updates.
• Provide customer support and respond to your questions or complaints.
• Improve the platform by understanding how it is used and where it can be improved.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information or your customers' personal information to third parties.

We rely on the following legal bases:

• Contract: to provide the services you signed up for.
• Legitimate interests: to secure and improve our platform and prevent fraud.
• Consent: where you have explicitly agreed, such as for marketing communications.
• Legal obligation: where we must retain or disclose information to comply with the law.

We rely on carefully selected third-party providers to run BusinessOS AI. When you use our service, these providers may process data on our behalf:

• Supabase — authentication, database, and file storage for your account and business data.
• Vercel — hosting and content delivery for our web application.
• Cloudflare — DNS, security, and email routing.
• Paystack — payment processing, subscription billing, and refunds. Paystack's own privacy policy governs your payment information.
• OpenAI — AI models that generate websites, images, and written content you request. Content you submit for generation is sent to OpenAI for processing.
• Twilio — WhatsApp messaging infrastructure that powers our WhatsApp Inbox.

Each provider is contractually bound to protect your data and to use it only for the purposes of providing their service to us.

We keep your information for as long as your account is active and for a reasonable period afterward to meet legal, accounting, and security obligations.

• Account data: retained while your account is active, and for up to 90 days after deletion to allow for account recovery and fraud prevention.
• Billing records: retained for at least 6 years to comply with Nigerian tax and financial record-keeping requirements.
• AI-generated content: retained until you delete it, or until your account is closed.
• Support communications: retained for up to 2 years.

Under the NDPR and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

We use industry-standard security practices, including encrypted connections (HTTPS/TLS), encrypted data at rest, secure authentication, access controls, and regular monitoring. Our infrastructure providers (Supabase, Vercel, Cloudflare) maintain independent security certifications.

No system is 100% secure. If we become aware of a data breach that affects your personal information, we will notify you and the relevant authorities as required by law.

Some of our service providers process data outside Nigeria, including in the United States and the European Union. When we transfer data internationally, we rely on contractual safeguards and standard data protection clauses to ensure your data receives an adequate level of protection.

BusinessOS AI is not intended for anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us and we will delete it promptly.

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used. You can control cookies through your browser settings, but disabling certain cookies may affect the functionality of the service.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or through the platform before the changes take effect. The "Last updated" date at the top of this page shows when this policy was last revised.

If you have questions about this Privacy Policy or how we handle your data, contact us: