BusiTools stores your business data on our servers. The list below is complete and describes what is actually held.

2.1 Account and identity data

• Email address and authentication credentials (your password is stored by our authentication provider as a salted hash — we never see or store it in plain text)
• Display name
• Group (business) name, logo and timezone
• Team membership, role and permissions

2.2 Business details

• Business name, type and trading address
• Owner first and last name
• Company registration number and VAT number
• National Insurance number, where you enter one for sole-trader invoicing
• Business phone, email and website
• Bank details used for invoicing: bank name, sort code, account number and IBAN

2.3 Employee and HR data (entered by you about your team)

• Names, job title, employment type, start and end dates
• Date of birth and home address
• Personal phone number and emergency contact name and number
• National Insurance number
• Hourly rate, contracted weekly hours and payroll records
• Free-text notes and any custom fields you create
• Rota shifts, worked hours, tasks and completion history
• Holiday and absence requests, including the reason category you select — categories such as sickness, maternity or paternity can reveal health information about a person

2.4 Client and customer data (entered by you about your clients)

• Client and contact names, company, email, phone and address
• VAT number, currency and country
• Notes, tags and activity history
• Invoices, invoice line items, payment records and purchase orders
• Expense reports and expense entries

2.5 Operational data

• Stock items, levels, movements, categories and storage locations
• Production plans, runs, lines, materials and logs
• Checklists, templates, runs and results
• To-do items and notifications

2.6 Billing data

• Subscription plan, status, billing period and renewal date
• Our payment provider's customer and subscription identifiers

We never receive or store your card number. Card details are entered directly on our payment provider's hosted checkout page and never pass through BusiTools servers.

2.7 Technical and security data

• Audit log entries recording who changed permissions, members or structure, and when
• Server request and error logs, which may include IP address and timestamps
• Device type, operating system and app version
• Crash and error reports

2.8 Data stored on your device

The app keeps a local copy of data so screens load quickly, together with your device settings and login session. Clearing the app's storage or uninstalling removes that local copy, but it does not delete your data from our servers — see the Your Rights section.

4.1 Where your data lives

Your data is stored in a managed PostgreSQL database operated by our hosting provider, located in [EU West - Amsterdam], with authentication handled by a separate provider.

4.2 How we protect it

• In transit: all traffic between the app, the website and our servers is encrypted with TLS
• At rest: database storage and backups are encrypted at rest by our infrastructure providers
• Authentication: access requires a signed token issued by our authentication provider and verified on every request
• Separation between businesses: every database query is scoped to your business, so one customer's records cannot be returned to another
• Role-based access: owners and managers control which team members can see which parts of the app, and permission changes are written to an audit log
• Staff access: access to production systems is limited to the personnel who need it to operate and support the service

An honest limit. Your data is encrypted in transit and at rest, but fields such as bank account numbers and National Insurance numbers are stored in ordinary database columns, not separately encrypted per field. They are protected by the access controls above rather than by additional application-level encryption. No internet service can promise absolute security.

4.3 Your responsibility

You remain responsible for keeping your password confidential, using a device lock, removing team members who leave, and granting access only to people who need it. We cannot protect data against someone using your credentials or an unlocked device.

4.4 Data breaches

If a breach occurs that risks your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.

We do not sell your data and we do not share it with advertisers. We use a small number of service providers who process data on our behalf under contract, and who are permitted to use it only to provide their service to us.

Hosting and database — Railway. Runs the application and stores all business data. Location: [EU West - Amsterdam].

Authentication — Supabase. Stores your email address and password hash and issues login tokens. No business data is stored there. Location: [EU West - Amsterdam].

Payments — Stripe. Subscription billing and checkout. Receives your name, email and billing details. Stripe holds your card data; we do not.

Transactional email — Resend. Delivers team invitations and deletion confirmations. Receives recipient email addresses and message content.

Website hosting and analytics — Vercel. Hosts busitools.net and provides cookieless, aggregated visitor statistics.

App distribution — Google Play. Distributes the Android app. Google's own privacy policy governs the store.

We may also disclose data where the law requires it — in response to a valid court order or a lawful request from a public authority — or to establish or defend legal claims. If BusiTools is ever sold or merged, your data may transfer to the buyer, who would remain bound by this policy; we will tell you before that happens.

BusiTools offers optional AI suggestions, such as proposing a category for a new stock item.

• The feature is assist-only. A suggestion is never saved automatically; you confirm or reject it.
• The model is shown only the short list of options relevant to your request, plus the name you typed. It is never given your database, your customers' records or your employees' records.
• Nothing you enter is used to train any AI model.
• The model currently runs on our own private infrastructure, so this data is not sent to an external AI company. If we ever change to a third-party AI provider, we will name that provider in this policy and update it before the change takes effect.
• If the AI service is unavailable, the feature simply returns no suggestion. Nothing else stops working.

Your business data: kept while your account is active, so your team can use it.

After you delete a group: the group and all its records — members, employees, clients, invoices, stock, tasks, rotas, payroll — are deleted from our database.

After you delete your account: your profile, business details and groups are deleted. Your subscription is cancelled with our payment provider before the deletion runs, so billing stops.

Backups: deleted data may persist in encrypted backups for up to 30 days, after which it is overwritten in the normal backup cycle.

Billing and tax records: we keep the minimum invoice and transaction records that UK tax law requires us to retain, normally six years, even after account deletion. This is a legal obligation and is not affected by a deletion request.

Security and audit logs: retained for twelve months and then deleted or anonymised.

Historical purchase records: if you bought the one-off in-app unlock that the app offered before September 2026, a record of that purchase is retained so that older app builds continue to recognise it. Nothing can be purchased through that route any more. The record will be removed once those builds are no longer in use.

Some of our service providers are based in, or process data in, the United States.

Where personal data is transferred outside the UK or the EEA, we rely on appropriate safeguards: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or an adequacy decision including the UK–US Data Bridge and the EU–US Data Privacy Framework where the provider is certified under it.

You can request details of the safeguards applying to a specific transfer by emailing us.

This section covers our website, busitools.net.

We keep tracking to the minimum. BusiTools uses no advertising, marketing or cross-site tracking cookies, and we never sell your data or feed it to third-party AI models.

Analytics without cookies. We measure basic, aggregated site usage with Vercel Web Analytics and Speed Insights. These are cookieless: they store nothing on your device and do not follow you across other websites.

Essential cookies for signed-in users. When you sign in to the dashboard we set strictly necessary cookies to keep you securely logged in through our authentication provider. These are required for the service to work and, under the UK Privacy and Electronic Communications Regulations, do not require consent. We also keep some preferences in your browser's local storage, such as your sidebar and active-team settings.

No consent banner, and here is why. We run no non-essential tracking, so there is nothing to consent to. If that ever changes we will ask for clear, opt-in consent first, with a reject option just as prominent as the accept one.

BusiTools is a business tool intended for people aged 18 and over, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

If you use BusiTools to manage employees under 18, such as apprentices, you are the controller of those records and responsible for the additional protections that apply to a child's data.

We may update this policy as the service develops. When we do, we will update the "Last Updated" date, post the new version on busitools.net and in the app, and — for changes that materially affect your rights — notify you directly by email or in-app notice before they take effect.

Change history

• September 2026: major rewrite. The previous version described BusiTools as an offline-first app whose sensitive data never left the device. The service is now cloud-based: business, employee, client and financial data is stored on our servers so that teams can share it across devices. This version describes that accurately, sets out our separate roles as controller and processor, names our service providers, and adds rights information for US residents.

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right.

You also have the right to complain to a supervisory authority.

United Kingdom — Information Commissioner's Office: https://ico.org.uk/make-a-complaint/

European Economic Area — the data protection authority in your country of residence, work or the place where the issue arose.