Privacy Policy

This policy explains how Blackcrest ("we") handles personal data when you use BizOneFlow. BizOneFlow is managed by Blackcrest. We follow India's Digital Personal Data Protection Act, 2023 and other applicable law.

1. Two roles

For the account details you give us (name, email, business name, billing information) we are the data fiduciary. For the data you store about your own leads, contacts and clients we act as a processor on your instructions — you decide what to collect and why.

2. What we collect

• Account data: name, email, phone, business name, password (stored only as a one-way hash).
• Billing data: plan, subscription status and payment references. Card, UPI and bank details are entered on Razorpay's secure checkout — we never see or store them.
• Customer Data: the leads, contacts, messages, documents and files you add or connect.
• Usage and technical data: sign-in times, device and browser details, and error logs, used to run and secure the Service.
• Enquiries: what you send us through the contact form, so we can reply.

3. How we use it

To provide and support the Service, process payments, keep it secure, prevent abuse, and communicate with you about your account.

We do not sell personal data — not yours, and not the data of your leads and customers — and we do not supply leads or contact lists to anyone. We do not use your Customer Data for advertising.

4. Who we share it with

Only service providers needed to run the Service, under confidentiality obligations: hosting and database (Vercel, Supabase), payments (Razorpay), email delivery (Resend), AI drafting (Anthropic — only the content you ask it to work on), and the integrations you enable, such as WATI. We may disclose data if the law requires it.

5. Security

Each workspace's data is logically isolated from every other workspace. Data is encrypted in transit; stored credentials (such as client logins) are encrypted at rest; access inside a workspace is governed by roles you control. Our primary database is hosted in Mumbai, India. No system is perfectly secure, and we'll tell you without undue delay if a breach affects your data.

6. Retention and deletion

We keep your data while your account is open. If you cancel, we keep it for a short period so you can return or export it; a workspace you delete is permanently erased after 30 days. We retain records only where the law requires it (for example, tax invoices). You can ask us to delete your workspace at any time.

7. Your rights

You can access, correct, export or erase your personal data, withdraw consent, and nominate someone to exercise these rights for you. Contact us and we'll respond within a reasonable time. If you're a lead or contact of one of our customers, please contact that business first.

8. Cookies and analytics

We use the cookies and browser storage needed to keep you signed in and remember preferences. On our marketing website, with your consent, we may also use analytics and advertising-measurement tools (such as Google Analytics and Meta Pixel) and a first-party cookie that remembers which campaign brought you here. You can decline, and nothing from those tools loads until you accept. They are not used inside your workspace.

9. Children

The Service is for businesses and isn't directed at children under 18.

10. Grievance officer

Nirmal Kanani, Blackcrest, Surat, Gujarat, India. Email: support@bizdesk.app. We acknowledge complaints promptly and aim to resolve them within 30 days.