Privacy Policy | BizCoorda

1. Introduction

Data Environmental Science, LLC (the “Company,” “we,” “us,” or “our”) operates BizCoorda, a multi-tenant, cloud-based platform that includes data processing, file and attachment storage, account management, and AI-assisted functionality.

This Privacy Policy describes how we collect, use, disclose, and protect information when you access or use BizCoorda and related applications, APIs, and services (collectively referred to as the “Service”).

Each BizCoorda account is associated with a Tenant controlled by the Account Holder. An Account Holder may authorize other users to access and interact with the Account Holder's Tenant.

For purposes of this Privacy Policy, “Account Holder” means the user who owns and controls an account and its associated Tenant, “Tenant” means the logically separated business environment associated with an account, and “Authorized User” means a user who has been granted access to another Account Holder's Tenant.

A user may have their own Tenant while also acting as an Authorized User within one or more other Tenants.

Depending on the context, we may act as a data controller or a data processor on behalf of our customers.

By using the Service, you acknowledge that you have reviewed this Privacy Policy.

2. Information We Collect

We collect information reasonably necessary to operate, secure, and provide the Service.

Account Information may include name, email address, organization, and authentication-related information.

Tenant Data includes business records, transactions, files, documents, attachments, and other structured or unstructured content submitted, uploaded, created, modified, or stored within a Tenant.

Tenant Data is associated with the Tenant in which it is maintained, regardless of whether the data was created, submitted, uploaded, or modified by the Account Holder or an Authorized User.

Authentication Data may include session state, login status, identity provider responses, and security-related metadata necessary to maintain account access and platform security.

Limited technical and operational information may be processed automatically through our infrastructure and service providers, such as timestamps, service activity, and diagnostic or security-related events.

AI functionality may process user-submitted prompts, contextual inputs, Tenant Data, and generated outputs as necessary to provide requested AI-assisted features.

Payment-related information may be processed by third-party payment providers; we do not store full payment card information.

We may use cookies, local storage, session storage, and similar technologies necessary for authentication, session management, security, and Service functionality.

When users upload files or attachments, we may process information associated with those files, including file names, file types, file sizes, upload and access activity, storage usage, and security or malware scanning results.

3. AI Data Handling and Use Restrictions

Our Service includes AI-powered functionality that processes user-submitted inputs to generate responses, perform actions, or assist workflows.

AI functionality may process prompts, business context, Tenant Data, structured or unstructured content, and generated outputs as necessary to provide requested features.

When an Authorized User uses AI functionality within another Account Holder's Tenant, the AI functionality may process Tenant Data available to that Authorized User according to the access and functionality provided within that Tenant.

We do not intentionally use customer-specific AI inputs or outputs to train publicly shared foundation models unless explicitly disclosed.

AI processing may involve third-party providers operating under contractual confidentiality, security, and data protection obligations.

Users are solely responsible for the content they submit when using AI functionality.

Users must comply with the Service restrictions regarding sensitive personal information and regulated data when using AI functionality.

AI-generated outputs may contain inaccuracies, incomplete information, or unintended results, and users are responsible for reviewing and validating outputs before reliance.

4. How We Use Information

We use information to operate, maintain, and improve the Service.

We authenticate users, manage secure sessions, and determine the Tenants and Service functionality users are authorized to access.

We process Tenant Data as necessary to provide the Service and in response to the instructions and actions of Account Holders and their Authorized Users, subject to applicable permissions and access controls.

We provide AI-assisted functionality and related Service features.

We maintain platform security, support operational reliability, and help detect unauthorized access, abuse, or misuse of the Service.

We communicate with users regarding updates, support, and operational notices.

We comply with legal obligations and enforce agreements.

We store, retrieve, transmit, and otherwise process files and Attachments as necessary to provide requested Service functionality.

We may scan files or Attachments using automated security technologies to detect malware, malicious content, or other security threats.

5. Multi-Tenant Architecture, Access, and Data Control

Our Service operates in a multi-tenant environment where each account is associated with a logically separated Tenant.

Each Tenant is controlled by its Account Holder. Account Holders may authorize other users to access and interact with their Tenant through functionality provided by the Service.

A user may have their own Tenant and may also be authorized to access one or more Tenants controlled by other Account Holders.

Tenant Data is associated with and controlled through the Tenant in which the data is created, submitted, uploaded, modified, or stored.

Business records, files, Attachments, and other Tenant Data created, submitted, uploaded, or modified by an Authorized User within another Account Holder's Tenant remain associated with that Tenant and are treated by the Service as data of that Tenant rather than data of the Authorized User's own Tenant.

Access to Tenant Data is controlled through authentication, authorization, tenant-scoped identifiers, and applicable user permissions.

We implement safeguards designed to prevent unauthorized cross-tenant access.

Account Holders are responsible for determining which users may access their Tenant and for managing applicable user permissions and access controls.

Authorized Users may access, create, modify, or otherwise interact with Tenant Data according to the permissions and functionality made available to them within that Tenant.

Removing an Authorized User's access to a Tenant does not delete Tenant Data that the Authorized User previously created, submitted, uploaded, or modified within that Tenant.

An Authorized User's deletion of their own account does not delete Tenant Data that the user previously created, submitted, uploaded, or modified within another Account Holder's Tenant.

8. Subprocessors and Service Providers

We use trusted third-party service providers and subprocessors to support the operation, security, infrastructure, payment processing, communication, and AI functionality of the Service.

Current subprocessors and service providers may include Amazon Web Services (AWS) for cloud hosting and infrastructure services, Stripe for payment processing and billing services, OpenAI for AI-powered functionality, Google Workspace or related Google services for operational communications, and ImprovMX for email forwarding and routing services.

These providers may process information only as reasonably necessary to provide services on our behalf and are subject to applicable contractual, confidentiality, security, and data protection obligations.

We may update or replace subprocessors from time to time as our business and operational needs evolve.

9. Sensitive Personal Information

The Service is not intended for the storage, processing, or transmission of sensitive personal information or regulated data.

Sensitive personal information may include government-issued identifiers, financial account information, payment card data, health information, precise geolocation data, or other categories of data designated as sensitive under applicable law.

Users must not submit, upload, store, transmit, or include sensitive personal information or regulated data in records, files, Attachments, AI inputs, or other content submitted through the Service unless explicitly supported by the Service.

If sensitive personal information is submitted inadvertently, it will only be processed to the extent reasonably necessary to secure, maintain, or operate the Service, comply with legal obligations, or remove the information.

10. Cookies and Client Storage

We use cookies, session storage, and local storage to maintain authentication sessions and improve usability.

These technologies support login persistence, session integrity, and application functionality.

Disabling these mechanisms may impact Service performance.

11. Data Retention and Account Deletion

We retain personal data and business data only for as long as necessary to provide the Service and to comply with legal, accounting, tax, audit, and contractual obligations.

Each account is associated with its own Tenant. Only the Account Holder may delete the Account Holder's account and associated Tenant through account deletion functionality provided by the Service.

When an Account Holder deletes their account, Tenant Data associated with that Account Holder's Tenant, including business records, files, and Attachments, is deleted from active production systems, except where retention is required by applicable law or reasonably necessary for legitimate business purposes such as compliance, dispute resolution, security, fraud prevention, or enforcement of agreements.

Deleting an account and its associated Tenant does not delete Tenant Data that the Account Holder or user previously created, submitted, uploaded, or modified while acting as an Authorized User within another Account Holder's Tenant. Such data remains associated with and controlled through the Tenant in which it was created, submitted, uploaded, modified, or stored.

Removal of an Authorized User from a Tenant does not delete Tenant Data created, submitted, uploaded, or modified by that Authorized User within the Tenant.

Files and Attachments may also be deleted in accordance with applicable account, subscription, storage, or retention policies.

Personal identifiers associated with the deleted account, including but not limited to name, email address, and contact information, are deleted or irreversibly anonymized when no longer required to provide access to other Tenants or otherwise retained for a purpose permitted by this Privacy Policy or applicable law.

Certain records may be retained after account deletion for defined retention periods, including logs, audit trails, system activity records, transactional and financial records, backup archives, and records of user consent or agreement acceptance, such as acceptance of the Terms of Service or Privacy Policy.

Retained records are maintained in a minimized and, where feasible, pseudonymized form, for example by retaining internal identifiers without associated direct personal identifiers, and are used solely for legal, regulatory, security, fraud prevention, accounting, operational continuity, and dispute resolution purposes.

Financial, tax, and accounting records may be retained for up to seven (7) years, or longer where required by law. Security logs, audit records, and backup archives may be retained for a reasonable period necessary to support monitoring, investigation, disaster recovery, and compliance obligations.

We may retain limited AI-related operational records, such as token usage, transaction metrics, and cost-related information, for billing, accounting, security, abuse prevention, and operational support purposes. We do not intentionally retain user prompts or AI-generated outputs except as necessary to provide the requested Service functionality.

Where data is retained following account deletion, it is either anonymized, aggregated, pseudonymized, or stored in a form that cannot reasonably be used to identify an individual without additional information that has been removed, segregated, or destroyed.

12. Security and Compliance

We implement reasonable administrative, technical, and physical safeguards designed to protect information.

Security practices may include encryption in transit, authentication, authorization, tenant-scoped access controls, system monitoring, logging, and automated security or malware scanning of uploaded files.

We maintain audit logs to support traceability and incident investigation.

Our practices are aligned with industry-standard security principles, though we do not guarantee absolute security.

13. Your Privacy Rights

Depending on your jurisdiction and applicable law, you may have rights to access, correct, delete, or obtain a copy of your personal information.

You may also have the right to limit certain uses of sensitive information.

Privacy rights relating to an individual's personal information are distinct from ownership or control of Tenant Data maintained within a customer's Tenant.

Where personal information is contained within Tenant Data controlled by another Account Holder, we may act as a processor or service provider on behalf of that Account Holder. Where appropriate, requests concerning such Tenant Data may be referred to or require action by the Account Holder responsible for that Tenant.

A user's privacy rights do not automatically require deletion of business records or other Tenant Data controlled by another Account Holder merely because the user created, submitted, uploaded, modified, or is referenced in that data, except where required by applicable law.

We will respond to verified requests in accordance with applicable law.

Requests may be submitted via [support@bizcoorda.com](mailto:support@bizcoorda.com).

14. International Data Transfers

Our infrastructure is primarily located in the United States.

If you access or use the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other jurisdictions where our providers operate.

15. Third-Party Services

The Service may integrate with third-party services.

Third-party services operate under their own privacy policies and practices.

Users should review applicable third-party policies.

16. Children's Privacy

The Service is intended for business and professional use and is not directed to individuals under 18 years of age.

We do not knowingly collect personal information from individuals under 18.

17. U.S. State Privacy Rights

Depending on your U.S. state of residence, you may have certain privacy rights under applicable state privacy laws, including the right to request access to, correction of, deletion of, or a copy of personal information we maintain about you.

Certain state laws may also provide rights to opt out of targeted advertising, the sale or sharing of personal information, profiling in furtherance of decisions producing legal or similarly significant effects, or certain uses of sensitive personal information.

We do not sell personal information or share personal information for cross-context behavioral advertising purposes as defined under applicable privacy laws.

Where personal information is processed by us as a processor or service provider on behalf of an Account Holder and is contained within that Account Holder's Tenant Data, privacy requests may need to be directed to or fulfilled through the applicable Account Holder, subject to applicable law.

We will respond to verified privacy requests in accordance with applicable law and may request additional information necessary to verify the identity or authority of the requester.

Authorized agents may submit requests on behalf of individuals where permitted by applicable law.

Privacy rights requests and related inquiries may be submitted through the contact methods identified in this Privacy Policy.

18. International Privacy Rights

Depending on your jurisdiction and applicable law, you may have certain rights regarding your personal information, including rights to access, correct, delete, restrict, or object to certain processing activities.

Where applicable, individuals may also have the right to request a copy of their personal information in a portable format or withdraw consent where processing is based on consent.

Where personal information is processed by us on behalf of an Account Holder and is contained within that Account Holder's Tenant Data, requests relating to such information may need to be directed to or fulfilled through the applicable Account Holder, subject to applicable law.

We will respond to verified requests in accordance with applicable law and may request additional information necessary to verify the identity of the requester.

Requests regarding personal information may be submitted through the contact methods identified in this Privacy Policy.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, legal requirements, security practices, or business operations.

When updates are made, the revised Privacy Policy will be posted with an updated effective or last updated date.

For material changes, we may provide additional notice through the Service, by email, or through other reasonable communication methods.

Continued use of the Service after changes become effective constitutes acknowledgment of the updated Privacy Policy.

20. Contact Us

For privacy-related inquiries or requests, contact [support@bizcoorda.com](mailto:support@bizcoorda.com).

Data Environmental Science, LLC