Privacy Policy

1. Who we are

This website and its services are operated by OpenLeap AI LLC, a Washington limited liability company doing business as BizFocus AI (“OpenLeap AI”, “BizFocus AI”, “we”, “us”, “our”), based in Seattle, Washington, USA. OpenLeap AI LLC is the data controller for the personal information described in this policy. For any privacy question or request, contact us at contact@bizfocus.ai.

2. What data we collect

Free Diagnostic

When you complete our free diagnostic quiz we collect: your first name, email address, industry, annual revenue range, team size, weekly inbound leads, your answers to the quiz questions, and the calculated AI Opportunity Cost figure. We also record whether you agreed to receive marketing email and the timestamp of your consent.

AI Business Audit (paid)

When you purchase an AI Business Audit we additionally collect: your business name and website, contact name / title / phone, and your answers to the audit wizard, including any discovery-call notes. You can type your answers or dictate them — dictated audio is sent to our transcription provider (OpenAI Whisper) to convert it to text. We keep only the resulting text, not the audio.

Account

We store your account email, name, hashed password, and audit history. Payment card details are handled by Stripe — we never see or store them.

Technical & usage data

Our hosting and infrastructure providers automatically process technical data needed to run the site securely: your IP address, browser/user-agent, and request metadata. We use your approximate location (derived from your IP by our host) to set the correct privacy-consent defaults for your region, and we use your IP for rate-limiting to prevent abuse. When an administrator acts on an account, we log the administrator’s IP address and user-agent as a security audit trail. We also receive advertising identifiers (such as Meta _fbp / _fbc and UTM parameters) when you arrive from an ad or campaign link.

3. Why we collect it

• To run the free diagnostic and email you your results.
• To generate your AI Business Audit report when you purchase one (this requires sending your business information to our AI provider — see Section 4).
• To send you product updates, launch announcements and occasional educational content (you can opt out of marketing email at any time — see Section 6).
• To measure advertising and improve our funnel (analytics and conversion measurement, subject to your consent choices — see Section 8).
• To improve our calculations, opportunity library, and report quality (in aggregate, never identifying you individually).
• To detect abuse and operate the site safely (server logs, rate limiting, fraud/dispute handling).

4. Third-party processors & sub-processors

We use the following processors. Each receives only the data needed for the function they perform. We do not sell your personal information for money.

• Anthropic — your business information, quiz/audit answers, and discovery transcript, sent to the Claude AI models that generate your audit report. Your business data is processed by this third-party AI service to produce your report.
• OpenAI — short audio clips from any dictated wizard answers, sent to Whisper to transcribe them to text. The audio is not retained after transcription.
• Stripe — your email address (and any billing details you enter on Stripe’s hosted checkout), used to process payment. Stripe holds all payment card data; BizFocus does not.
• Brevo — your email address, first name, industry, engagement and purchase status, and the cost-of-inaction figure, used to send your diagnostic results and the email sequences you have opted into. Emails we send you may include your diagnostic one-pager or audit report as an attachment.
• Meta (Conversions API) — your hashed (SHA-256) email address plus Meta browser/click identifiers, sent server-side when a purchase completes, so we can attribute paid-advertising conversions.
• Meta Pixel (browser) — sets _fbp / _fbc cookies and fires page-view, lead and checkout events. Only loaded if you accept cookies.
• Google (Tag Manager & Analytics / GA4) — manages our marketing tags and measures site usage and conversions. Where we pass an email identifier to these tags it is hashed, never sent in the clear. These tags run subject to your consent choices (see Section 8).
• Vercel — hosting; server logs (IP address, request URL, response status) for reliability and security.
• Neon — all data we store about you, hosted in their managed Postgres infrastructure with encryption at rest.
• Upstash — a Redis service used for rate-limiting; processes an IP-derived key to throttle abusive traffic.
• Inngest — runs our background jobs (e.g. report generation and email steps); processes job payloads that may reference your audit.

5. How long we keep it

• Diagnostic leads from medical / dental and insurance verticals are deleted after 12 months.
• Diagnostic leads from all other industries are deleted after 24 months.
• Your audit data and reports are retained while your account is active.
• Transcribed text from any dictated answers is retained alongside your audit data and deleted with it. The original audio is not stored — it is discarded after transcription.
• Your account itself is retained until you request deletion (see Section 6).

6. Your rights

• Right to access — download all data we hold on you from your account settings.
• Right to erasure — request deletion of your data from your account settings. We process all deletion requests within 30 days.
• Right to correction — ask us to correct inaccurate personal information.
• Right to data portability — your downloaded data is provided in machine-readable JSON.
• Right to withdraw consent — every marketing email contains an unsubscribe link.

For any of these requests, contact contact@bizfocus.ai. We will verify your identity before acting and respond within the timeframe required by applicable law (generally 30–45 days).

7. California & U.S. state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have additional rights over your personal information, which may include: the right to know / access the categories and specific pieces of personal information we collect; the right to delete it; the right to correct it; the right to opt out of “sale” or “sharing” of personal information for targeted / cross-context behavioral advertising; the right to limit the use of sensitive personal information; and the right to be free from discrimination for exercising these rights.

We do not sell your personal information for money. However, our use of advertising and analytics cookies (Meta and Google) to measure and target advertising may be considered a “sale” or “sharing” / “targeted advertising” under some state laws. You can opt out of this at any time by selecting Decline on our cookie banner, which turns off these advertising and analytics technologies for your browser.

You may exercise these rights, or submit a request through an authorized agent, by emailing contact@bizfocus.ai. If we decline a request, you may appeal by replying to our response. We will not discriminate against you for exercising any of these rights.

8. Cookies & tracking

• Session cookie (ai_audit_session) — strictly necessary to keep you signed in. Cannot be disabled while you are using the authenticated parts of the site.
• Meta Pixel cookies (_fbp, _fbc) — advertising and conversion measurement. Only set if you accept cookies on the consent banner.
• Google Tag Manager / Analytics (GA4) cookies — analytics and advertising tags. In regions that require prior consent (such as the EEA and UK) these stay off until you accept; elsewhere they may run by default and you can turn them off by declining on the cookie banner.
• Consent-preference cookie (bf_consent) — a functional cookie that securely records your advertising / analytics consent choice so we can honour it on later visits.

You can change your choice at any time using the cookie banner. When you complete a purchase and have not declined advertising, we also send a server-side conversion event to Meta containing a hashed (not readable) version of your email so we can measure ad performance. This server-side event respects your advertising choice — if you decline, it is not sent.

9. Children’s privacy

Our website and services are intended for businesses and adults aged 18 and over. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact contact@bizfocus.ai and we will delete it.

10. Contact

For any privacy question or request, email contact@bizfocus.ai. We respond to verifiable requests within the time required by applicable law. Postal mail can be addressed to OpenLeap AI LLC, Seattle, Washington, USA.

11. Changes to this policy

We will update this policy when our practices change. The “Last updated” date at the top reflects the most recent version. Material changes will be communicated by email to active users.