Privacy Policy

1. Who we are

Business Intelligence Quotient Centre Pty Ltd (ABN 98 695 595 978), trading as BIQc ("BIQc", "we", "us"), is an Australian company based in Victoria. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to biqc.ai, the BIQc app and our support channels.

When a business connects its systems to BIQc, that business controls its business data and we process it on the business's behalf under our Data Processing Agreement. We are responsible for our own account, billing, marketing and website data.

BIQc is a service for businesses and is not intended for people under 18.

2. Information we collect

• Account details: name, email address, phone number, company, role, sign-in identifiers and multi-factor authentication settings. If you sign in with Google or Microsoft, we receive your name and email address from that provider.
• Passwords: BIQc does not store your password. Our sign-in provider (Supabase) stores only a secure hash of it.
• Connected business data: CRM contacts and deals, accounting and invoice records, HR, job and operational records, and files you choose to connect, either directly or through our integration platform (Merge).
• Email and calendar data: if you connect a Google or Microsoft account, your email messages, including the full message text, and your calendar events. Section 5 explains how we handle Google data.
• Product content: questions you ask in Ask BIQc, documents you upload, AI answers and reports.
• Billing: billing contact, subscription, invoices and wallet transactions. You enter card details directly into Stripe's payment pages; they never reach BIQc.
• Support and communications: support emails, contact forms, website chat messages, and recordings of calls where everyone on the call has agreed.
• Website and product use: device and browser information, cookie identifiers and page analytics (see section 8), and records of how you use the product, such as sign-ins, chats, seats and AI usage.
• Business contacts: contact details you give us, form submissions and meeting bookings.

We do not intentionally collect sensitive information, such as health information. If your connected data contains it, we protect it with our strictest controls.

3. How we use information

• To provide BIQc: connect your systems, produce intelligence and answers for your organisation, and run the features you choose.
• To keep BIQc secure and to prevent fraud and misuse.
• To bill for BIQc and keep tax records.
• To support you and answer enquiries, including through website chat.
• To send service messages, such as security alerts and changes to BIQc.
• To send marketing to business contacts, only with consent and with a working unsubscribe link in every message.
• To meet our legal obligations.

We do not sell personal information, do not share it for third-party advertising, and do not use customer data to train or fine-tune AI models.

4. AI processing

To answer your questions, BIQc sends the question and the relevant business context to an AI model provider. That context can include connected data such as email content. We use OpenAI, Anthropic, Google (Gemini) and Perplexity through their commercial APIs, under terms that exclude training on API data.

Where a provider offers a no-storage option, we use it (for example, OpenAI requests are sent with storage turned off). Providers may keep data for a short time for abuse monitoring, or where the law requires, under their own terms. Where a provider asks for a user identifier for abuse monitoring, we send a scrambled code (a salted hash), never your name or email address.

You own your inputs and your outputs.

5. Google user data

This section explains how BIQc accesses, uses, stores and shares data from your Google account. Google data reaches BIQc only in the ways below, and only after you choose to connect.

Google sign-in

If you sign in with Google, BIQc receives your name, email address and profile picture (Google's basic profile: openid, email, profile). We use them only to create your account and sign you in.

Gmail and Google Calendar connection

When you connect Gmail and Google Calendar in BIQc, BIQc asks Google for:

• Basic profile (openid, email, profile): to identify the Google account you connect.
• Read your Gmail (https://www.googleapis.com/auth/gmail.readonly): BIQc reads messages in your Inbox, Sent, Drafts, archive and your own labels (not Trash or Spam) to rank your inbox by priority, find tasks and follow-ups, suggest replies inside BIQc, and answer your own Ask BIQc questions about your email.
• Read your Google Calendar (https://www.googleapis.com/auth/calendar.readonly): BIQc reads events in your primary calendar, from four weeks back to about four weeks ahead, for meeting preparation and schedule context in your dashboard and in Ask BIQc answers.

BIQc does not use this connection to send, change or delete anything in your Gmail or Google Calendar. Connections made between April and August 2026 may also hold permission to send email (gmail.send) and to read Google Drive and Google Sheets files (drive.readonly, spreadsheets.readonly). BIQc no longer asks for these permissions; disconnecting and reconnecting removes them.

Actions you approve in Ask BIQc

If you connect Google for actions in Ask BIQc, the connection is made through our integration platform, Merge, which holds the Google sign-in. It asks Google for permission to read, send and change messages in your Gmail, to read and change your Google Calendar events, and, if you connect Google Drive for actions, to work with your Drive files.

BIQc uses this connection only when you ask Ask BIQc to look something up or to take an action. Looking things up runs straight away. Sending an email or changing a message, event or file shows you an approval card first, unless you have chosen "Always allow" for that connection. "Always allow" covers every action on that connection, including sending email, and lapses after 90 days. Your organisation's administrator can require approval every time or turn actions off.

Google Drive files through Data Sync

If you connect Google Drive through Data Sync, BIQc stores file details (name, folder, link, type, size and owner). It reads a file's content only when you choose that file in BIQc, for example to ask a question about it.

What BIQc stores

• Email messages: sender, subject, date, Gmail's short preview, the message text up to 100,000 characters per message, read status, folder and conversation. Attachments are not downloaded.
• Calendar events: title, start and end time, location, attendees' names and email addresses, organiser, and the first 200 characters of the description.
• Results BIQc works out from them, such as priority, summaries, tasks, follow-ups, meeting load and frequent contacts.
• The results of lookups and actions, saved in the Ask BIQc conversation where you used them.
• Google Drive file details, and the text of files you choose to use.
• The access tokens that keep your Gmail and Calendar connection working, in database tables that only BIQc's servers can reach. For actions and Data Sync, Merge holds the Google sign-in.

This data is stored in BIQc's database in Sydney, Australia, and is encrypted at rest. Synced email and calendar data stays until you disconnect or your account is deleted.

How BIQc uses it

BIQc uses Google user data only to provide these features to the person or organisation that connected the account, inside that BIQc account:

• Priority inbox: ranking your messages and finding tasks and follow-ups.
• Email and calendar intelligence in your dashboard, such as reply times, meeting load and meeting preparation.
• Reply suggestions shown in BIQc for you to review. BIQc does not send them for you.
• Answers to your own Ask BIQc questions about your email, calendar and files.
• Actions you ask for and approve, such as sending an email or creating an event.

Who BIQc shares it with

• Anthropic: receives the sender, subject, date and first 150 characters of up to 20 recent messages every 10 minutes, to rank your inbox. If Anthropic fails, OpenAI receives the same details. Some dashboard summaries also send message subjects, senders and short previews to Anthropic, and in one feature to Google (Gemini).
• OpenAI: receives what it needs for priority analysis (sender, subject and a short preview), reply suggestions (sender, subject, date and up to 3,000 characters of the message), voice conversations (subject, date and preview), and the search index and image reading for files you choose.
• The AI provider that answers your Ask BIQc question (OpenAI, Anthropic, Google (Gemini) or Perplexity, which runs OpenAI models): the email, calendar and file content needed to answer, which can include the full text of messages when Ask BIQc looks up your email, and the results of lookups and actions.
• Merge: for actions and Data Sync, Merge holds the Google sign-in and passes requests and results between BIQc and Google.

These providers use the data only to produce your results, under terms that exclude training their models on it. We do not share Google user data with anyone else, except where the law requires it, to investigate abuse or a security incident, or as part of a merger, acquisition or sale of assets, with notice to you.

Limited Use

BIQc's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

• We use Google user data only to provide or improve the user-facing features described above.
• We never use or transfer Google user data for advertising, including retargeting and personalised or interest-based advertising, and we never sell it.
• Google user data is never used to develop, improve or train generalised AI or machine-learning models, by BIQc or by any provider it uses.
• No person at BIQc reads your Google user data unless you have agreed for specific messages, it is needed for security purposes such as investigating abuse or a security incident, it is needed to comply with the law, or it has been combined and anonymised for internal operations.

Disconnecting Google and deleting your data

• Gmail and Google Calendar: go to Integrations, open the Google Email & Calendar card and click Disconnect. BIQc revokes its access at Google and deletes the email, calendar and other data it synced from your account.
• Actions: in Ask BIQc, open My connections and disconnect Google. BIQc asks Merge to delete the Google sign-in and withdraws any "Always allow".
• Google Drive (Data Sync): disconnect the Google Drive card in Integrations. BIQc asks Merge to remove the connection and deletes its Drive file list and search index.
• In your Google Account: you can remove BIQc at https://myaccount.google.com/permissions. BIQc stops syncing as soon as Google refuses its access, and deletes the data it synced within 30 days. Email privacy@biqc.ai if you want it deleted sooner.
• If you delete your BIQc account, your Google user data is deleted with it when the 30-day recovery window ends (section 9). To end BIQc's access to Google straight away, disconnect Google first.

Disconnecting does not remove Google data already saved in your Ask BIQc conversations, file details recorded by Data Sync, or text from files you chose to use in a chat. These are deleted with your account, or sooner if you email privacy@biqc.ai.

We handle Outlook email and calendar data from Microsoft accounts in the same way. Microsoft does not offer a way for BIQc to revoke its own access, so when you disconnect Outlook we delete our stored access and the synced data, and you can also remove BIQc in your Microsoft account's app permissions.

6. How we share information

We share personal information only with the service providers listed in section 7, and only as they need it to deliver BIQc; with your organisation's administrators, for data in your organisation's BIQc account; where the law requires it; or as part of a merger, acquisition or sale of assets. We do not sell, rent or share personal information for marketing.

Every 30 minutes we copy each BIQc user's email address, role, last sign-in and chat dates, number of chats, seats, spend and AI usage totals into our customer-relationship system (HubSpot), so we can support and bill customers.

7. Where data is stored, and overseas recipients

BIQc's database, sign-in and file storage are hosted with Supabase in Sydney, Australia. The application, secrets vault and cache run in Microsoft Azure Australia East (Sydney) and Australia Southeast (Melbourne).

Some of our service providers process or store personal information outside Australia. Before we disclose personal information overseas, we take reasonable steps, through contract terms and vendor review, to make sure the recipient handles it consistently with the APPs. This is our current list of service providers (sub-processors) that handle personal information. We update it within 30 days of any change.

• Supabase: database, sign-in and file storage. Australia (Sydney).
• Microsoft Azure: application hosting, secrets vault, cache and monitoring. Australia.
• OpenAI: AI models, voice, search indexes, image reading and web search. United States.
• Anthropic: AI models and email priority sorting. United States.
• Google: Gemini AI models, Google sign-in, the Gmail, Google Calendar and Google Drive connections, reCAPTCHA bot protection, Google Analytics and Google Tag Manager. United States and other Google locations.
• Perplexity: AI answers, research and web search. United States.
• Merge: integration platform for connected business systems, Google Drive Data Sync, and the actions you approve in Ask BIQc. United States.
• Microsoft: the Outlook, calendar and OneDrive connection, Microsoft sign-in, and BIQc's own company email. Microsoft locations, which can be outside Australia.
• Stripe: payments, subscriptions and invoices. United States and other Stripe locations.
• Resend (Amazon SES): service emails such as verification, invitations and receipts. Japan (Tokyo) and United States.
• Sentry: error monitoring. United States.
• Intercom: website chat. United States.
• HubSpot: customer-relationship management, forms, meeting booking and website tracking after consent. United States and other HubSpot locations.
• Atlassian: support tickets created from our contact form. United States and other Atlassian locations.
• Fathom: call recordings and notes, only where everyone on the call has agreed. United States.

8. Cookies, analytics and website chat

• Essential storage: we keep your sign-in session and settings, such as your theme and cookie choice, in your browser's storage. BIQc needs these to work.
• Analytics and conversion measurement: Google Tag Manager loads on our pages with Google Consent Mode set to "denied", so Google Analytics and conversion tags do not store cookies until you click Accept. HubSpot website tracking loads only after you accept. Personalised advertising is always off. To change your choice, clear cookies and site data for biqc.ai in your browser and we will ask again.
• Bot protection: our sign-in and sign-up pages use Google reCAPTCHA, which collects information about your device and browser to tell people from bots.
• Error monitoring: the app sends error reports to Sentry, including your BIQc user ID and technical details of the error. When an error happens, Sentry may record a short replay of the screen with all text masked.
• Payments: billing pages load Stripe's payment script.
• Fonts: our pages load fonts from Google Fonts, which receives your IP address.

On BIQc marketing pages, Intercom acts as our website-chat service provider. A BIQc chat panel may appear when you visit the page, but Intercom is not loaded and sets no cookies until you choose to open chat. Once you open it, Intercom may process functional cookies, basic browser or device identifiers, and the conversation content you send on our behalf. BIQc does not send account data to the website Messenger; please do not submit passwords, financial records, customer personal information, or other sensitive data in chat.

9. Retention and deletion

• Account and customer data: kept for the life of your subscription.
• Cancelling or deleting your account: the account is disabled straight away and can be recovered for 30 days. After 30 days an automated job permanently deletes its data from our live systems.
• Immediate deletion: if you ask us to delete your data without waiting, we verify the request and delete your live data within 14 business days, skipping the 30-day recovery window, and confirm in writing.
• Backups: removed by our provider's backup cycle no later than 90 days after the data is deleted from our live systems.
• Google and Microsoft data: deleted when you disconnect the account in BIQc, or when you delete your BIQc account (section 5).
• Ask BIQc conversations: kept until your account is deleted. Deleting a conversation removes it from view; it is permanently deleted with your account, or sooner if you ask us.
• Billing, tax and payment records: kept for 7 years, as Australian tax law requires. Records we must keep after an account is deleted are anonymised where possible.
• Logs: server and application logs are kept for 30 to 90 days. Anonymised usage and access records are kept for up to 12 months.
• Support records: kept while needed to resolve the matter and for up to 2 years afterwards.
• Marketing contacts: kept until you unsubscribe or ask us to remove you. We review inactive contacts every 12 months.
• Call recordings: kept for up to 12 months, unless needed for a contract or dispute.

You can export your data at any time from Settings. We may keep data that has been de-identified, so that no one can reasonably be identified, for service analytics. Our Data Retention Policy at https://biqc.ai/legal/retention explains the deletion steps in more detail.

10. Security and data breaches

We protect personal information with encryption at rest (AES-256, by our hosting providers) and in transit (TLS 1.2 or higher), role-based access checked on the server for every request, database row-level security, and monitoring. Our Security & Infrastructure page at https://biqc.ai/trust/security has the details.

If we suspect a data breach, we assess it as quickly as possible and within 30 days. If it is an eligible data breach under the Notifiable Data Breaches scheme, we notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals as soon as practicable. If a customer's data is affected, we tell the account Owner without undue delay and within 72 hours of confirming it. If Google user data is affected, we also notify Google.

11. Your rights and complaints

• You can ask to access, correct or delete your personal information, withdraw consent, or opt out of marketing. Email privacy@biqc.ai.
• We verify your identity, then respond within 30 days. There is no charge.
• If we refuse a request, we explain why in writing and tell you how to complain.
• If your organisation's BIQc account holds your information, we pass your request to that organisation and help it respond.
• We acknowledge complaints within 5 business days and answer them within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

12. Changes to this policy

We review this policy at least every 12 months and whenever our use of data or our service providers change. The version number and effective date are shown at the end of this policy. If we make a material change, we will tell you in the app or by email.

13. Contact us

Privacy Officer, Business Intelligence Quotient Centre Pty Ltd: privacy@biqc.ai

Security and vulnerability reports: security@biqc.ai

Everything else: support@biqc.ai