Privacy Policy

1. About this policy

This policy explains how Biztech Expert ("we", "us", "our") handles personal information across our website at biztech.expert and every product we supply. We are based in Ahmedabad, Gujarat, India.

We act as the controller of your own account and contact information, and of information collected through our website. Where we operate a product on your behalf and process data about your customers, contacts, or audience, we act as a processor for that data and you are the controller — see section 9.

2. Which products it covers

This policy covers all Biztech Expert products, including:

• Websites & digital builds — design, development, hosting, and maintenance
• BE CRM — customer relationship management at crm.biztech.expert, including the BE CRM app for Android
• BE Agents — WhatsApp conversation automation
• BE Socials — social media scheduling, inbox, and analytics at socials.biztech.expert
• BE Ads — advertising campaign management
• Biztech Voice — AI calling and voice agents
• Any other product, add-on, or service we supply under the Biztech Expert name

Where a product handles data differently from the general description below, this is noted in the relevant section.

3. What we do not do

• We do not sell, rent, or lease your personal information to anyone.
• We do not share your information with advertisers, ad networks, data brokers, or marketing-automation vendors.
• We do not load advertising pixels, remarketing tags, or cross-site trackers on our website or in our products.
• We do not collect biometric data.
• We do not train AI models on your content or your customers' conversations.
• We do not use the content of your connected channels, or the conversations our products handle for you, for anything other than providing the product to you.
• We do not store your full payment-card number.

5. Our Android app

The BE CRM app for Android is a client for the CRM service at crm.biztech.expert. It is not a separate service: it shows the same records you already see in the browser, and everything you do in it is stored on our servers, not on the phone.

What the app collects

• Account details — your email address and password, used to sign in. The password is sent over HTTPS to our server and stored hashed; the app does not keep it after sign-in.
• Business records — leads, contacts, companies, deals, invoices, tasks and notes that you or your team enter. These belong to your organisation and are held on our servers.
• Crash reports — if the app fails, it sends us the error message, the technical stack trace, the screen you were on, the app version, and the email address you were signed in with. We use these only to fix faults. They are stored on our own servers, not sent to any third party.
• No advertising or tracking identifiers. The app contains no advertising SDK, no analytics SDK and no third-party tracking. We do not build a profile of you and we do not sell data.

Permissions the app asks for

• Internet — required to reach the CRM. There is no offline mode.
• Biometric / fingerprint — optional. If you turn on app lock, this lets you unlock the app with the fingerprint already enrolled on your phone. The fingerprint never leaves your device; the app only receives the result of Android's own check.

The app does not request access to your camera, microphone, contacts, files, location, SMS or call logs.

Where the data lives

Records are stored on servers we control and are separated from every other customer at the database level. Nothing is stored in a third-party cloud by the app itself. Deleting the app from your phone does not delete your records — see section 7 below and our account deletion page.

Children

The app is a business tool and is not directed at children. It is not available to anyone under 18.

4. What we collect

Contact and account information. Name, email address, phone number, company name, billing address, and a hashed password where you have a login. For team products: your organisation, memberships, roles, and settings.

Billing information. Plan, invoices, payment status, and billing history. Where card payment is used, details are entered with our payment processor and we receive only the card brand, last four digits, and expiry needed to display your payment method. For bank transfer or UPI we hold the transaction reference.

Project information. For website and build work: the content, logos, images, text, and credentials you send us to produce the deliverable, and correspondence about the work.

Product usage data. Drafts, scheduled and published posts, message and call logs, campaign settings, contact lists you upload, analytics snapshots retrieved from connected platforms, inbox threads, and audit logs of actions in your workspace.

Connected platform credentials. When you connect a social, messaging, or advertising account, we receive the access tokens needed to act on your behalf, plus public profile metadata needed to display the connection. Tokens are stored encrypted at rest.

Website logs. Standard server logs for our website and products, containing IP address, request path, user agent, referring URL, and timestamp.

Error telemetry. When something breaks, a report containing a stack trace, the page involved, and basic device context may be captured. Secrets and personal data are scrubbed before storage.

5. How we use your information

• to provide, operate, and maintain the products you have paid for;
• to deliver project work — building, hosting, and maintaining websites;
• to publish and schedule content, run campaigns, retrieve analytics, and handle conversations at your direction;
• to generate content and responses using AI where a product includes AI features;
• to send transactional email and service notifications — invoices, receipts, renewal reminders, security alerts, and agreed product notifications;
• to provide support and respond to your enquiries;
• to detect and prevent abuse, fraud, security incidents, and spam;
• to diagnose and fix bugs and operational errors;
• to measure aggregate product usage so we can improve what we sell;
• to comply with applicable laws, tax obligations, legal process, and lawful government requests.

6. Our legal basis

Where data-protection law requires a legal basis, we rely on: contract (to supply the product you have paid for), legal obligation (tax, accounting, and lawful requests), legitimate interests (operating and securing our service, preventing abuse, improving our products, and communicating about your account), and consent where we specifically ask for it. You may withdraw consent at any time, though withdrawing consent needed to run a product means we can no longer supply it.

7. Who we share information with

We share information only where needed to run our business:

• Service providers who host, secure, and operate our infrastructure and products, bound by contract to use it only for that purpose;
• Platforms you connect — social, messaging, advertising, and telecom providers, whose own policies govern their handling;
• Payment and accounting providers for billing, invoicing, and tax compliance;
• Professional advisers — legal and accounting — where necessary;
• Authorities, where required by law, legal process, or a lawful government request, or where necessary to protect rights, property, or someone's safety.

We do not share your information with anyone for their own marketing.

8. Sub-processors

To run our products we use third parties for hosting and infrastructure, email delivery, payment processing, error monitoring, AI model inference, and messaging and telephony delivery. Each is bound to use the information only to provide the service we have engaged them for.

Because AI and messaging features rely on third-party model and carrier providers, a request you make may be processed in a country other than India. We choose providers that do not use your content to train their models. We will name current providers and their locations on request — write to contact@biztech.expert.

9. Data you hold about other people

Some products process personal information about people who are not our customers — for example your WhatsApp contacts, people who message your business, callers handled by a voice agent, or recipients of your advertising.

You are the controller of that data; we process it on your instructions. You are responsible for having a lawful basis to contact those people, for providing any notice they are entitled to, for honouring their rights, and for complying with messaging, telecom, and advertising rules — including WhatsApp's and Meta's policies and any consent requirements for outbound calls and messages.

We process that data only to provide the product to you, do not use it for our own purposes, and do not add it to any list we sell.

10. AI processing

Where a product includes AI features, content you submit — prompts, text, images, call audio, and conversation history — is sent to AI model providers so they can generate a result. We select, configure, and pay for these providers as part of your subscription.

We configure providers so that your content is not used to train their models, and we do not use it to train models of our own. Providers may retain data briefly for abuse monitoring under their own policies. We do not send more than is needed for the feature you are using.

11. Connected platforms

When you connect a platform, you authorise us to act on your behalf within the permissions you grant. You can disconnect at any time from your settings, or by revoking access in that platform's own app settings. Disconnecting stops future activity but does not delete data already received — use the deletion process in section 15 for that.

12. Cookies & analytics

Our products use functional cookies only: session cookies that keep you signed in, and short-lived security tokens during account-connection handshakes, deleted when the handshake completes. We set no advertising cookies and no cross-site trackers.

We may measure aggregate usage — page views and feature use — without building profiles of individuals and without advertising identifiers. You can block or delete cookies in your browser, though signing in will not work without functional cookies.

13. Security

We apply reasonable technical and organisational safeguards: HTTPS/TLS in transit, encryption at rest for connected-platform tokens and credentials, hashed passwords, access scoped per organisation, and restricted internal access on a need-to-know basis.

No system is perfectly secure. You acknowledge that security and privacy limitations inherent to the internet are beyond our control, and you are responsible for keeping your own credentials safe and for who you give access to.

14. Data retention

Account and product data is retained while your account or subscription is active. On deletion, we remove personal information and product content within 30 days, except encrypted backups, which roll off within a further 30 days. Server logs roll off typically within 30 days. Billing and tax records are retained as required by Indian tax and accounting law. Conversation, call, and campaign records you have configured to be kept longer are retained per that setting.

15. Your rights

You may ask us to:

• confirm what personal information we hold about you and give you access to it;
• correct information that is inaccurate or incomplete;
• delete your personal information;
• restrict or object to certain processing;
• provide a copy of the information you gave us in a portable format.

Email contact@biztech.expert. We may need to verify your identity. We respond within the timeframe required by applicable law, and normally within 30 days.

16. India — Digital Personal Data Protection Act, 2023

If you are in India, we process personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), on the basis of your consent given when you engage us or create an account, and for certain legitimate uses permitted under the Act.

As a Data Principal you have the right to access a summary of the personal data we process about you, to correction and erasure, to grievance redressal, and to nominate a person to exercise your rights in the event of death or incapacity. You may withdraw consent at any time by contacting us; withdrawing consent for data essential to a product means we can no longer supply it.

To raise a grievance, email contact@biztech.expert with the subject "Grievance". We will acknowledge and resolve it within the timelines prescribed under the DPDP Act. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

17. EU/EEA/UK residents — GDPR and UK GDPR

Where GDPR applies, our legal bases are those in section 6. You may exercise your rights of access, rectification, erasure, restriction, portability, and objection by contacting us, and you have the right to lodge a complaint with your supervisory authority. Where we transfer personal data outside the EU/EEA/UK we rely on an appropriate transfer mechanism.

18. California residents — CCPA/CPRA

We do not "sell" or "share" personal information for cross-context behavioural advertising as defined by the CCPA as amended by the CPRA. Because we do not sell or share, there is no opt-out we need to offer — but you keep all other rights, including access, correction, deletion, portability, limitation of use of sensitive information, and non-discrimination for exercising them. Contact us to exercise them.

19. Deletion — exceptions

On a verifiable request we will delete your personal information and direct our providers to do the same. We may decline, or comply in part, where retention is necessary to:

• complete a transaction or perform our contract with you;
• comply with a legal obligation, including tax and accounting law;
• detect security incidents or protect against fraudulent or illegal activity;
• debug to repair errors that impair functionality;
• establish, exercise, or defend legal claims;
• exercise free speech or protect another person's rights.

20. Breach notification

If a security incident affects your personal information, we will investigate promptly and notify affected individuals and the relevant authorities in the manner and within the timeframes required by applicable law, including the DPDP Act where it applies.

21. Children

Our products are business tools and are not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it promptly.

22. International transfers

We are based in India, and some providers we use operate infrastructure in other countries. Your information may therefore be processed outside your country of residence. We take the steps required by applicable law for such transfers, and by using our products you acknowledge that processing may occur in jurisdictions with different data-protection laws from your own.

23. Changes to this policy

We may update this policy when our products, our practices, or the law change. Where a change is material, we will notify you by email to the address we hold or by a prominent notice in the product. The "Last updated" date at the top shows when it last changed.

24. Contact

Questions, requests, or grievances about privacy:

Biztech Expert
Ahmedabad, Gujarat, India
Email: contact@biztech.expert
WhatsApp: +91 63524 45717