Privacy Policy

Bazas AI ("Bazas," "we," "us," or "our") is an AI-powered CRM platform for service businesses, operated by Bazas AI LLC. This Privacy Policy explains how we collect, use, share, and protect information when you use our website (bazas.ai), web application and related services (collectively, the "Services").

By using our Services, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. If you do not agree, please do not use our Services.

2.1 Information You Provide Directly

• Account information: name, email address, phone number, password, company name, and role when you create an account.
• Business data: contacts, leads, jobs, invoices, estimates, receipts, messages, notes, and other operational data you enter into the platform.
• Communications: SMS messages, emails, and voice calls sent or received through the platform on your behalf.
• Payment information: billing details processed through the payment provider used for an approved paid pilot. We do not store full credit card numbers.
• Waitlist/contact form: email address, name, company, phone number, and message when you join our waitlist or contact us.

2.2 Information Collected Through Third-Party Integrations

• Financial data (Plaid): When you choose to connect your bank account via Plaid, we receive account information such as account name, type, balance, and transaction history. We access this data only with your explicit consent and use it solely to provide financial features within the platform. See Section 8 for details on Plaid.
• Accounting/export data: invoice, payment, customer, or export data processed at your request.
• Google user data (Google Calendar, and Gmail if you choose to connect it): accessed only after you sign in with Google and grant permission. See Section 9 for exactly what we access and how we use, store, share, and delete it.

2.3 Information Collected Automatically

• Usage data: pages visited, features used, actions taken, timestamps, and session duration.
• Device information: browser type, operating system, device type, screen resolution, and IP address.
• Cookies: we use essential cookies for authentication and session management. We use Google Analytics 4 for aggregated usage statistics and Microsoft Clarity for website experience analytics such as heatmaps and session replay. See Section 11.

We use the information we collect to:

• Provide, operate, and maintain the Services.
• Process and manage your business operations (contacts, jobs, invoices, messaging).
• Generate AI-powered suggestions, auto-replies, and analytics within your organization.
• Send transactional communications (account verification, password resets, billing receipts).
• Provide customer support and respond to your inquiries.
• Improve and develop new features based on aggregated usage patterns.
• Detect, prevent, and address fraud, abuse, and security issues.
• Comply with legal obligations.

Your data is not used to train AI models. AI features are powered by OpenAI. Under OpenAI's API terms, inputs and outputs are not used to train OpenAI's models by default, though they may be processed and temporarily retained by the provider to deliver and secure the service.

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

• Service providers (sub-processors): We use trusted third-party services to operate the platform. Each sub-processor processes only the minimum data necessary. See Section 7 for the full list.
• At your direction: When you connect integrations such as accounting exports, Plaid, Google Calendar, or send messages (SMS, email), data is shared with the respective provider as required to perform the action.
• Legal requirements: We may disclose data if required by law, subpoena, court order, or government request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before this occurs.

We implement industry-standard security measures to protect your data:

• Encryption in transit: Connections between your device and the Services use HTTPS/TLS.
• Encryption at rest: Storage protection depends on the infrastructure provider and configuration. Contact us to confirm the controls required for your pilot.
• Multi-tenant isolation: Organization-scoped access controls and resource permissions restrict business data. Authorized operational access may be needed for support, maintenance, security, or legal compliance.
• Access control: Staff and partner access follows assigned organization, role, and resource permissions.
• Password security: Account and integration credentials are handled according to the applicable authentication workflow. Do not submit passwords through website forms.
• API authentication: CRM access requires authentication and permissions. Public website intake endpoints validate submitted fields and apply request limits.
• Infrastructure: The Services use managed hosting providers. Backup and recovery coverage depend on the configured services and plans.

For more details, visit our Security page.

We retain your data for as long as your account is active or as needed to provide the Services. Specifically:

• Active accounts: We keep records needed to provide the agreed Services. Retention can vary by workflow, account settings and provider.
• Account deletion: Verified deletion requests are reviewed and processed, subject to legal, security, fraud-prevention, and accounting retention requirements. Backup copies expire according to the applicable provider retention and rotation policy. Contact privacy@bazas.ai to confirm the status and scope of your request.
• Website application data: Contact details and the information you submit are used to review fit, discuss onboarding, and respond to your request. You can request deletion by contacting privacy@bazas.ai.
• Financial data (Plaid): Disconnecting a bank connection stops further imports; previously imported financial records may remain. You can request deletion, subject to applicable legal and accounting retention requirements.
• Logs and analytics: Log and analytics retention depends on the provider and service configuration. Aggregated, anonymized analytics may be retained to understand product usage.

You may request deletion of your data by contacting privacy@bazas.ai.

We use the following third-party service providers to operate the platform:

Our platform uses Plaid Inc. ("Plaid") to connect your financial accounts. When you use Plaid Link within our application:

• You provide your bank credentials directly to Plaid — we never see or store your bank login credentials.
• Plaid transmits your financial data (account balances, transaction history) to us via secure, encrypted APIs.
• We use this data solely to provide financial features (expense tracking, income visibility) within the platform.
• We do not sell, share, or use your financial data for advertising or any purpose other than providing Services to you.
• You can request help revoking Plaid access and deleting associated financial data. Applicable legal and accounting retention requirements may still apply.

Plaid's use of your data is governed by Plaid's End User Privacy Policy.

Bazas connects to Google services only when a user signs in with Google and explicitly grants permission on Google's consent screen. This section describes exactly what Google user data we access, why, and how it is handled.

9.1 Data we access

• Google Calendar (scope https://www.googleapis.com/auth/calendar): the list of your calendars and their names; free/busy information and event details (title, start and end time, location, description, attendees' email addresses) from the calendars you choose to check for conflicts; and the events that Bazas itself creates for appointments you schedule in Bazas.
• Gmail (scope https://www.googleapis.com/auth/gmail.readonly, only if you connect your personal Gmail inside Bazas): the sender, subject, date, text and attachments of messages that match the sender and domain filters you set (for example, receipts from a supplier). Messages that do not match your filters are not stored. We never send, modify, label, or delete email in your Gmail account.
• Basic profile (your Google account email address), to show which Google account is connected.

9.2 How we use it

• Google Calendar: to show your existing events and busy times next to your Bazas schedule, to prevent double-booking when appointments are scheduled, and to create, update, and delete the events for appointments you (or your team) schedule, reschedule, or cancel in Bazas, in the calendar you selected. Bazas can also create a separate calendar for these appointments if you ask it to.
• Gmail: to show the matching messages to you in Bazas and, if you enable it, to read receipts and invoices from those messages so they appear in your expenses as drafts for you to review and confirm.
• We use Google user data only to provide these user-facing features. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve, or train generalized AI or machine-learning models.

9.3 Who can see it

• Calendar data is visible inside your Bazas organization according to its roles and permissions, in the same way as the schedule itself.
• Gmail data is visible only to the user who connected the mailbox. It is not shown to other members of the organization, including administrators.
• Bazas staff do not read your Google user data, except with your explicit permission for a support request, when necessary for security purposes (such as investigating abuse), or to comply with applicable law.

9.4 Sharing and transfer

We do not share or transfer Google user data to third parties, except: to the sub-processors listed in Section 7 that host and operate the Services (for example, our hosting and database providers), and, for the receipt-reading feature only, to our AI provider (OpenAI) to extract the fields of a receipt you asked Bazas to process, under terms that prohibit using it to train their models; when required by law; or as part of a merger or acquisition with prior notice to you.

9.5 Storage and security

OAuth tokens and retained Google data are handled server-side with access restricted to the services and permissions needed for the connected features. Connections use HTTPS/TLS; storage and backup protection depend on the configured infrastructure. Contact us to confirm controls required for your pilot.

9.6 Retention, deletion and revoking access

• Use the supported connection settings or contact support to disconnect Google Calendar or Gmail. You can request deletion of retained Google data and confirm the status at privacy@bazas.ai. Appointments you created in Bazas may remain as business records; retention and deletion follow Section 6.
• You can also revoke Bazas's access at any time at myaccount.google.com/permissions.
• Account and Google-data deletion requests are reviewed under Section 6, including retained business records and provider copies. Contact privacy@bazas.ai to confirm the scope and completion status.

9.7 Limited Use

Bazas's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data by contacting privacy support.
• Data portability: Request an export of your data. Available exports vary by workflow; confirm the scope and format with us.
• Opt-out: Unsubscribe from marketing emails using the link in any email, or contact us.
• Withdraw consent: Disconnect any third-party integration at any time.

To exercise any of these rights, contact us at privacy@bazas.ai. We review requests individually and confirm the next steps and expected timing.

We use a minimal set of cookies:

• Essential cookies: Required for authentication and session management. Cannot be disabled.
• Website language: We remember your selected language for up to 180 days. Without a saved choice, we use the language preferences sent by your browser. You can change the language in the header or clear the preference in your browser.
• Analytics (Google Analytics 4): Collects anonymized usage data to help us improve the product. Does not track individual users across sites. You may opt out via your browser settings or a cookie blocker extension.
• Website experience analytics (Microsoft Clarity): Helps us understand how visitors use the marketing site through aggregated behavior analytics, heatmaps, and session replay so we can improve usability and conversion paths. Clarity may collect interaction, device, browser, and approximate location data. We do not use Clarity for advertising or retargeting.

We do not use advertising cookies or retargeting pixels.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" at the top of this page and notify registered users via email. Continued use of the Services after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us:

• Email: privacy@bazas.ai
• Company: Bazas AI LLC
• Address: 350 Northern Blvd Ste 324 #1412, Albany, NY 12204