Privacy Policy

1. Introduction

Business Boost ("Business Boost," "we," "our," or "us"), operating at businessbst.com and affiliated subdomains, is committed to safeguarding your privacy and ensuring you have complete control over your personal data.

This Privacy Policy explains how we collect, store, process, transfer, and protect your information across our AI-powered small business suite, including our AI CRM, Field Dispatch PWA, AI Website Builder, Autonomous Social Media Engine, and Billing services.

2. Information We Collect

A. Information You Provide Directly

• Account Registration: Name, business email, encrypted password, phone number, and company name.
• Consent Records: Timestamp of Terms of Service acceptance and explicit marketing opt-in selections.
• Business Profile & CRM Data: Customer lists, client contact records, job site addresses, quotes, work orders, service histories, and invoices entered into your CRM.
• Media & Brand Assets: Logos, brand guidelines, photos, team bios, promotional copy, and social media schedules uploaded for website and social generation.
• Billing Information: Payment card details, billing addresses, and tax identifiers (securely tokenized and processed via Stripe; Business Boost does not store raw card numbers).

B. Information Collected Automatically

• Usage & Performance Data: Feature utilization metrics, dispatch routes, AI generation counts, page views, error logs, and session durations.
• Device & Telemetry Data: IP address, device type, browser user agent, operating system, and geolocation (when permitted for field route optimization).

C. Social Media & API Integration Data

When you connect third-party platforms (Meta/Facebook/Instagram, LinkedIn, X/Twitter, Google Business Profile), we store authorized OAuth tokens to publish scheduled posts and read post performance analytics on your behalf.

3. How We Use Your Information

We process your personal information strictly for legitimate business and contractual purposes:

• To provide, host, maintain, and enhance the Business Boost platform.
• To authenticate accounts and secure access across multi-tenant organizations.
• To execute AI-assisted copywriting, field dispatching, invoice generation, and social publishing.
• To send operational transactional notifications (e.g., account verification, invoice alerts, security updates).
• To send promotional updates, product features, and business growth insights strictly where voluntary opt-in consent has been provided.
• To detect, prevent, and mitigate fraud, abuse, and security vulnerabilities.

4. Marketing Communications & Unbundled Consent

• Unbundled Consent: During registration, the marketing checkbox is left unchecked by default. You are only subscribed to growth newsletters and promotional offers if you affirmatively check the box.
• Immediate One-Click Unsubscribe: Every promotional email includes an automated, direct unsubscribe link in the footer. Clicking this link immediately updates your preferences.
• Self-Service Preference Center: You can toggle marketing notifications on or off at any time directly in your account settings or by emailing privacy@businessbst.com.

5. SMS & Mobile Information Protection (TCPA / 10DLC)

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All use-case categories exclude text messaging originator opt-in data and consent; this information will strictly never be shared, sold, rented, or transferred to any third party.

6. Sharing & Third-Party Sub-Processors

We do not sell personal data. We share data only with trusted sub-processors necessary to run the Service:

• Cloud Infrastructure: Supabase (PostgreSQL database), Vercel (Next.js serverless hosting), AWS / Google Cloud (cloud storage and compute).
• Payment Processing: Stripe (PCI-DSS Level 1 certified processor for invoices and subscriptions).
• Transactional Email & Communications: Resend and Twilio (for password resets and authorized CRM SMS notifications).
• AI Inference: Google Gemini APIs (processed securely under enterprise data protection standards; customer proprietary data is not used to train global public foundational models).

7. Google User Data & Limited Use Disclosure

Business Boost integrates with Google APIs to enable automated posting and profile synchronization for your Google Business Profile. When you connect your Google account:

• We access only the scopes strictly necessary to manage and publish your business posts and locations.
• We do not transfer or disclose your Google user data to external data brokers or ad networks.
• You can disconnect Google at any time via your Business Boost integrations tab or via Google Account Security permissions. Disconnection triggers immediate deletion of stored tokens.
• Business Boost's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Data Security & Retention

We enforce multi-layered security controls, including TLS 1.3 encryption in transit, AES-256 encryption at rest, strict tenant-isolation policies, role-based access control, and continuous vulnerability scans.

We retain personal data as long as your account is active or needed to provide you with the Service. Upon account termination, your data is permanently scrubbed from our active production databases in accordance with our data retention schedule, subject only to statutory tax and accounting retention requirements.

9. Your Global Privacy Rights (GDPR & CCPA/CPRA)

Regardless of your geographic location, Business Boost grants you the right to:

• Access & Portability: Request an export of all personal data held about you in a structured, machine-readable format.
• Rectification: Correct inaccurate or incomplete records in your account settings.
• Erasure ("Right to be Forgotten"): Request permanent deletion of your account and personal records.
• Restriction & Objection: Object to processing of your personal data or withdraw consent at any time without penalty.
• Non-Discrimination: We never discriminate against users who exercise their statutory privacy rights.

To submit a privacy or data deletion request, email our Data Protection team at privacy@businessbst.com.

10. Contact Us

For questions, privacy inquiries, or data requests, please contact us at: