Privacy notice

Last updated 27 September 2026

BusinessRunAI is the data controller for the personal data described in this notice. Our registered company details and UK Information Commissioner's Office registration number are available on request. You can reach us at privacy@businessrunai.com.

Where you use the platform to handle your own customers' data, you are the controller of that data and we act as your processor.

What we collect and why

• Account data (name, email address, login credentials) — to create and secure your account. Legal basis: performance of our contract with you.
• Business profile data (business name, services, prices, hours, policies) — so your AI assistants can answer accurately. Legal basis: contract.
• Contact and conversation data you or your customers enter (names, phone numbers, email addresses, enquiry messages) — to provide the CRM and assistant features. Legal basis: contract, and our legitimate interest in operating the service.
• Usage and technical data (device information, IP address, log and telemetry data) — for security, fraud prevention, troubleshooting and improving the product. Legal basis: legitimate interests.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Marketing preferences — to send product updates where you have opted in. Legal basis: consent, which you can withdraw at any time.

What the AI assistants process

Your AI assistants read your Business Brain (services, prices, hours, coverage areas, policies and FAQs) and the content of enquiries and conversations in your account, so they can reply, qualify leads, draft follow-ups and update your CRM. That includes the names, phone numbers, email addresses, addresses and job details your customers give you. Message content is sent to our AI model provider to generate a reply and is not used to train public models. Anything sensitive — refunds, complaints, unusual pricing, contracts and legal replies — is held for your approval rather than sent automatically.

Who we share it with

Our processors are:

• Stripe — payment processing, subscription management, tax calculation and invoicing.
• Our AI model provider (Google and OpenAI models accessed through the Lovable AI gateway) — generating assistant replies and drafts.
• Our hosting and database provider (Lovable Cloud, built on Supabase infrastructure, with data hosted in the EU/UK region) — running the application, database, authentication and file storage.
• Our email delivery provider — sending account, billing and outbound assistant emails.
• Professional advisers such as our accountants and lawyers.
• Authorities and regulators where we are required to do so by law.

We do not sell personal data.

International transfers

Some of our providers process data outside the UK and EEA. Where that happens we rely on an adequacy decision or on Standard Contractual Clauses together with appropriate additional safeguards.

How long we keep it

We keep account and business data for as long as your account is active and for up to 12 months afterwards, so you can reactivate. Billing and tax records are kept for 6 years as required by law. Logs are kept for up to 12 months. After these periods data is deleted or anonymised.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. Contact privacy@businessrunai.com and we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

Security

We use appropriate technical and organisational measures, including encryption in transit, database-level access controls that isolate each business's data, and least-privilege access for our team.

Cookies

We use essential cookies to keep you signed in and to keep the service secure. Any analytics cookies are only set with your consent, and you can change your preference at any time in your browser settings. We do not use advertising cookies.