VisionaryHub is a product of BizRendevous LLC, a Texas limited liability company ("BizRendevous", "we", "us", "our"). This policy explains what we collect when you use VisionaryHub, why we collect it, who else sees it, and what you can require us to do about it.

It applies to VisionaryHub and the other digital products operated by BizRendevous LLC. It does not apply to Neighbors Postal Plus, which is a separate business and a separate entity.

Controller and contact
BizRendevous LLC
8190 Barker Cypress Rd., Ste 1900, Cypress, TX 77433, United States
Privacy and data requests: privacy@bizrendevous.com

1. The short version

We collect what we need to run your account and no more. We do not sell your personal information and we do not share it for cross-context behavioural advertising. Your business content belongs to you. We send it to a third party in exactly one situation, described in section 4, and only when you ask us to.

2. What we collect

Information you give us

• Account details — your name, email address, password (stored only as a cryptographic hash, never in readable form), and your workspace name.
• Profile details, if you add them — phone number, address, and social media handles. All optional.
• Your business content — everything you enter into the product: SWOT and PESTLE entries, business and marketing plans, financial forecasts, pitch deck text, tasks, notes, ideas, investor records, and organisation profiles. This is the substance of what VisionaryHub is for, and we treat it as confidential.
• Support correspondence — what you write to us and our replies.

Information we collect automatically

• Authentication and security data — sign-in times, IP address, and browser user-agent, kept so we can detect unauthorised access to your account.
• Usage data — which features are used and when, in aggregate, so we know what to improve.
• Essential cookies — a session cookie and a CSRF token. See the Cookie Policy.

Payment information we never see

Card payments are processed by Stripe. Your card number is entered directly into Stripe's systems and is never transmitted to or stored on our servers. We receive only a payment confirmation, the last four digits, the card brand, and expiry — enough to show you what you paid with and to handle billing questions.

3. Why we collect it, and our lawful basis

For customers in the UK, the European Economic Area, and other jurisdictions with equivalent law, our lawful bases under the GDPR are:

Purpose	Lawful basis
Creating and running your account; storing your business content; providing the features you use	Performance of a contract
Taking payment and issuing receipts	Performance of a contract
Sending an AI draft request to OpenAI when you invoke it	Performance of a contract, at your instruction
Keeping the service secure; detecting fraud, abuse, and automated sign-ups	Legitimate interests
Understanding aggregate feature usage to improve the product	Legitimate interests
Retaining billing and tax records	Legal obligation
Marketing emails, where these are sent	Consent, withdrawable at any time

4. Artificial intelligence features, and what leaves our systems

Read this section even if you skip the rest.

Several parts of VisionaryHub offer to draft content for you — the McKinsey 7-S, PESTLE and Porter's Five Forces pages, the financial forecast, the organisation profile, and the marketing tools. These are marked with a "Generate" or "AI" button.

When, and only when, you press one of those buttons, the relevant text from your workspace — which may include your business plan, your strategy, your competitor analysis, or your financial figures — is transmitted to OpenAI so that a draft can be produced and returned to you. OpenAI may store that content on its systems in accordance with its own terms and retention practices.

What this means in practice:

• Nothing is sent to OpenAI when you simply browse, type, or save. Only pressing an AI generate button transmits anything.
• If you would rather no part of your content ever left our systems, do not use the AI features. Every page works without them.
• We do not control OpenAI's retention. If that matters to your business — for example if your plan is commercially sensitive or covered by a confidentiality obligation to a third party — decide before you press the button, not after.

5. Who else processes your data

We use a small number of service providers ("sub-processors"). Each is bound by contract to process data only on our instructions.

Provider	What they do	What they receive
Hostinger	Hosting and database	All account and content data, at rest
Stripe	Payment processing	Your name, email, and card details entered directly with them
Cloudflare	Bot protection on sign-up and sign-in (Turnstile)	IP address and browser signals at the moment of sign-up or sign-in
OpenAI	AI drafting, on your invocation only	The content described in section 4

We will update this list before adding a new sub-processor that handles personal data.

6. We do not sell or share your personal information

For the purposes of the California Consumer Privacy Act as amended by the CPRA: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Because we do not sell or share, there is nothing for you to opt out of — but the rights in section 8 apply in full.

We do not use your business content to train any machine learning model of our own.

7. How long we keep it

• While your account is active — for as long as you keep it.
• After you cancel — your workspace remains recoverable for 30 days, so an accidental cancellation is not a catastrophe. After that it is deleted from our live systems within a further 30 days.
• Backups — deleted data may persist in encrypted backups for up to 90 days after live deletion, then is overwritten.
• Billing and tax records — kept as long as United States tax law requires, currently seven years, regardless of account closure. These are financial records, not your business content.

If you ask us to delete your data sooner, see section 8.

8. Your rights

These rights are available to every customer, wherever you are. We have chosen not to limit them by geography.

• Access — a copy of the personal data we hold about you.
• Correction — fix anything inaccurate. Most of it you can edit yourself in the product.
• Deletion — erase your account and content, subject only to records we must keep by law.
• Portability — your content in a machine-readable format. The CSV and PDF export buttons throughout the product do much of this immediately.
• Objection and restriction — object to processing based on legitimate interests, or ask us to pause it while a dispute is resolved.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting what was lawful beforehand.
• Non-discrimination — we will not degrade your service or charge you more for exercising any of these rights.
• Authorised agent — you may use an agent to make a request on your behalf; we will ask for proof of their authority.

Write to privacy@bizrendevous.com. We will respond within 30 days, and will tell you if we need longer and why. We may ask you to verify your identity first — usually by replying from the email address on the account — because handing your business plan to someone impersonating you would be the worse outcome.

If you are in the UK or EEA and are unhappy with our response, you may complain to your national supervisory authority. We would rather you told us first.

9. International transfers

BizRendevous LLC is based in the United States and our servers are located there. If you use VisionaryHub from outside the United States, your data is transferred to and processed in the United States. Where we transfer personal data out of the UK or EEA, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, and we assess whether additional safeguards are needed.

10. Security

Passwords are stored as salted cryptographic hashes and cannot be read by us or recovered. Traffic is encrypted in transit with TLS. Each customer's workspace is isolated so that one customer cannot read another's content. Sign-up and sign-in are protected against automated abuse.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data, we will notify you and the relevant regulator without undue delay and, where the law sets a deadline, within it.

11. Children

VisionaryHub is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

12. Changes to this policy

If we change this policy materially — a new sub-processor handling your content, a new purpose, a shorter or longer retention period — we will email account holders before the change takes effect. The date at the top shows the current version.