BizNetAI Privacy Policy

Effective Date: Jan 01 2026

Last Updated: Jan 01 2026

1. Introduction

Welcome to BizNetAI, an agentic e-commerce engine and B2B platform operated by ConsumerGenie Corporation, a Delaware corporation ("we," "our," or "us").

Your data security and privacy are critical to our business operations and customer relationships. This Privacy Policy explains how we collect, use, disclose, and safeguard information when enterprise merchants, e-commerce platform operators, and business partners ("you," "your," "Business Partner," or "Customer") use our platform, APIs, SDK, services, and AI-powered agentic e-commerce solutions (collectively, the "Services").

This Policy applies globally and includes additional information for Business Partners and Customers resident in certain regions (such as the European Economic Area, United Kingdom, Canada, and U.S. states with privacy laws).

By entering into an agreement with us or using our Services, you agree to the terms of this Privacy Policy. If you do not agree with this Policy, you may not use our Services. Please contact us to discuss compliance options or contractual data terms.

2. Information We Collect

We may collect the following categories of information from Business Partners and Customers:

2.1 Business Information

Company name, business registration details, and legal entity information
Business contact persons, titles, email addresses, and phone numbers
Business address and registered office location
Tax identification numbers and financial information (for invoicing and payment processing)
Business type, industry classification, and merchant category

2.2 Account and Authentication Data

Login credentials, API keys, OAuth tokens, and authentication credentials used to access our Services
Account configuration settings, preferences, and security settings
User roles, permissions, and access levels within your organization
Multi-factor authentication data (e.g., phone numbers for SMS verification, authenticator app registrations)

2.3 Transaction and Operational Data

Product data you upload or integrate with our platform
Merchant inventory data, pricing information, and product attributes
Customer order data, transaction records, and sales activity (processed through our platform)
Shipping and fulfillment information
End-customer data processed on behalf of our Business Partners (such as names, contact details, and order information). BizNetAI acts as a data processor for such information and processes it solely per the Business Partner's lawful instructions.
Payment transaction details (processed by third-party payment processors; we do not store full payment card data)
Refund, dispute, and chargeback information
Integration logs, API and MCP call data

2.4 AI Interaction and Processing Data

Queries, commands, and prompts you submit to our AI systems and agentic services
Generated outputs, recommendations, and AI-processed results
Training data you provide for model customization or merchant-specific optimization
Data used for product categorization, pricing optimization, and market analysis
Aggregated or de-identified data we may use to improve AI accuracy and performance
We do not use customer-provided queries or training data for unrelated model training or public model development without explicit written consent.

2.5 Technical and Usage Data

IP addresses, session IDs, and device identifiers
Operating system, browser type, and user agent strings
API request logs, endpoint usage, and integration activity
Feature usage patterns, performance metrics, and error logs
Timestamp, duration, and frequency of Service access and API calls
Geographic location data derived from IP address or business registration
Cookies and similar tracking technologies (see Section 6)

2.6 Communication Data

Email correspondence, support tickets, and customer service interactions
Feedback, feature requests, and complaint records
Meeting notes, recorded calls (with consent), and webinar attendance
Newsletter and marketing communication preferences

2.7 Security and Compliance Data

Security event logs, access attempts, and authentication failures
Data related to fraud detection, abuse prevention, and account security
Compliance certifications, audit reports, and regulatory documentation you provide
Know Your Business (KYB) verification data and due diligence information

2.8 Data from Third Parties

Data we receive from e-commerce platforms, marketplace operators, or integration partners you connect with our Services
Credit and background check information (if applicable for onboarding)
Payment processor data and transaction verification
Third-party identity verification and KYB service providers

2.9 Data Protection for Business Users

We do not knowingly collect personal data from individuals under the age of 18 who are not authorized business representatives. Business Partners are responsible for ensuring all individuals accessing our Services are authorized representatives of their organization and of legal age.
If we become aware of unauthorized use by minors, we will take appropriate action in accordance with applicable law.

3. How We Use Your Information

We use Business Partner and Customer information for purposes including:

3.1 Service Delivery and Operations

Providing, maintaining, and improving the BizNetAI Services and API platform
Processing transactions, managing accounts, and handling payments
Delivering AI-powered agentic services, product recommendations, and optimization features
Integrating your data with third-party e-commerce platforms and services you authorize
Providing technical support, troubleshooting, and account management

3.2 AI and Machine Learning

Processing your data through our AI and agentic systems to generate outputs and recommendations
Optimizing product categorization, pricing recommendations, and market analysis
Improving model accuracy and AI system performance through aggregated or de-identified data analysis
Training and tuning AI models for merchant-specific use cases (only with explicit consent)

3.3 Analytics and Business Intelligence

Analyzing aggregated and de-identified usage data to understand platform adoption, feature usage, and customer needs
Generating business intelligence, market insights, and performance reports
Monitoring system performance, reliability, and security metrics
Benchmarking and competitive analysis using de-identified data

3.4 Compliance and Legal Obligations

Ensuring legal compliance with applicable laws, regulations, and contractual obligations
Conducting Know Your Business (KYB) verification and anti-money laundering (AML) screening
Responding to legal requests, regulatory inquiries, and government demands
Protecting against fraud, misuse, unauthorized access, and illegal activity
Managing disputes, chargebacks, and legal proceedings

3.5 Communication and Notifications

Sending transactional communications (account confirmations, billing statements, service updates)
Notifying you of system maintenance, security incidents, or service changes
Responding to support requests and customer inquiries
Sending product updates, feature announcements, and educational content (with consent)

3.6 Marketing and Business Development

Sharing anonymized case studies, testimonials, or success metrics (with consent)
Sending marketing communications about relevant products, features, or services
Identifying partnership and integration opportunities
Conducting market research and customer satisfaction surveys (with consent)

3.7 Security and Fraud Prevention

Detecting, preventing, and investigating fraud, abuse, and unauthorized access
Protecting the security and integrity of our platform and Services
Enforcing our terms of service and other agreements
Investigating security incidents and data breaches

4. Consent and Legal Basis for Processing

4.1 Consent Mechanisms

We obtain your consent where required by law through:

Execution of a Master Service Agreement or Data Processing Addendum that acknowledges data processing
Account creation and Service activation
Explicit opt-in for marketing communications and non-essential data processing
Cookie and tracking technology consent where required by law
Consent forms for sensitive use cases (e.g., model training, data sharing with third parties)

4.2 Other Legal Bases

Depending on your jurisdiction and our relationship, we may process data based on:

Performance of Contract: Processing necessary to fulfill our Services and meet contractual obligations
Legitimate Interests: Analytics, security, fraud prevention, platform improvements, and business operations
Legal Compliance: Processing required by law, regulation, or legal authority
Data Subject Consent: Explicit consent for marketing, model training, or other non-essential processing

4.3 Withdrawal of Consent

You can withdraw consent for marketing communications or non-essential processing at any time by:

Updating your account preferences
Clicking the unsubscribe link in marketing emails
Contacting us using the information in Section 14

Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

5. How We Share Information

5.1 General Policy

We do not sell Business Partner or Customer personal data. We may share information in the following situations:

5.2 Service Providers and Vendors

We share data with trusted third-party service providers and vendors necessary to operate the BizNetAI platform and Services, including:

Cloud Infrastructure Providers: AWS, Google Cloud, or other hosting providers where your data is stored and processed
Payment Processors: Payment gateways and processors for transaction processing (PCI-DSS compliant; we do not transmit full payment card details)
E-Commerce Integration Partners: Shopify, WooCommerce, marketplace APIs, and other platforms you authorize integration with
Analytics Providers: Analytics, monitoring, and logging services
Customer Support Tools: Help desk, ticketing, and communication platforms
AI and ML Service Providers: Third-party AI/ML platforms used to enhance our Services (data is anonymized or de-identified where possible)
Email and Communication Services: Email delivery, SMS, and notification services
Legal and Compliance Services: Lawyers, accountants, compliance consultants, and auditors as needed

All service providers are contractually bound by confidentiality agreements and data processing terms.

5.3 Legal Compliance and Government Requests

We may disclose your information if:

Required by law, regulation, legal process, or valid government or regulatory inquiry
Necessary to comply with court orders, subpoenas, or official investigations
Required to respond to law enforcement requests or national security inquiries
Reasonably believed necessary to protect our rights, privacy, safety, or property
Necessary to protect the rights, safety, or property of our Business Partners, Customers, or the public

We will provide notice of legal requests where permitted by law.

5.4 Business Transactions

In the event of a merger, acquisition, financing, asset sale, bankruptcy, or similar transaction involving ConsumerGenie Corporation or the BizNetAI Services:

Customer and Business Partner data may be transferred as part of the transaction
Any successor organization would be bound by substantially similar privacy protections
You will be notified of any material change in data handling practices

5.5 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data without restriction. This includes:

Market trends and benchmarking data
Platform usage statistics and performance metrics
AI model improvements based on de-identified data
Industry research and competitive analysis

5.6 Platform Integration Partners

If you authorize integration with third-party e-commerce platforms or services (e.g., Shopify, WooCommerce), customer data necessary for that integration will be shared with the integrated platform according to their privacy policies. You are responsible for reviewing third-party privacy policies and terms.

5.7 Your Customers' Data

You acknowledge that you control customer data (such as order information, contact details, and purchase history) that flows through our Services. We process this data as your data processor or service provider. You are responsible for obtaining necessary consent from your customers for their data to be processed through our Services. You must maintain appropriate privacy notices and terms with your customers regarding data sharing with BizNetAI. We will assist you with data subject requests and compliance to the extent required by applicable law and our Data Processing Addendum.

6. Cookies and Tracking Technologies

6.1 Use of Cookies

We use cookies and similar tracking technologies (including web beacons, pixels, and local storage) to:

Remember user preferences, login status, and account settings
Measure platform performance, usage patterns, and user behavior
Deliver personalized features and recommendations
Prevent fraud and enhance security
Conduct analytics and understand customer needs

6.2 Types of Cookies

Essential Cookies: Required for platform functionality (login, security, API access)
Analytics Cookies: Used to measure platform performance and user behavior
Preference Cookies: Remember your settings and preferences
Marketing Cookies: Used to deliver relevant marketing content (consent required where required by law)

6.3 Cookie Consent and Management

Essential cookies are deployed automatically for platform functionality
Non-essential cookies require your consent where required by law (e.g., EU/EEA, UK)
You can manage or disable cookies through your browser settings
You can opt out of analytics and marketing cookies by contacting us or adjusting preferences
Third-party cookies may be set by service providers or integration partners

6.4 Tracking and Do Not Track

Our Services currently do not respond to browser 'Do Not Track' signals. You can instead use our cookie settings or your browser's controls to manage tracking technologies.

7. Data Retention

7.1 Retention Principles

We retain Business Partner, Customer, and transactional data only as long as necessary for the purposes described in this Policy or as required by law. Retention periods vary based on data type and legal requirements.

7.2 Specific Retention Periods

| Data Type | Retention Period | Purpose | |-----------|------------------|---------| | Account Information (business contacts, credentials) | Duration of business relationship + 3-7 years | Contractual obligations, legal compliance, audit trails | | Transaction and Order Data | Minimum 7 years | Tax compliance, dispute resolution, financial records | | API Logs and Technical Data | 90 days - 1 year | Security, performance monitoring, troubleshooting | | Customer Data (your end customers) | As directed by you; minimum 90 days | Service delivery, compliance | | AI Training Data | Duration agreed in writing; default 90 days to 2 years | Model improvement, with ability to purge on request | | Usage Analytics (aggregated) | 2-3 years | Business intelligence, platform optimization | | Support and Communication Records | 2-3 years | Dispute resolution, service improvement | | Payment and Billing Records | 7 years | Tax compliance, financial audit, dispute resolution | | Security and Compliance Logs | 1-3 years | Fraud detection, security incident investigation |

7.3 Deletion and Purging

Upon account termination or Business Partner request, we will delete or de-identify your data within 30-90 days, except where we are required to retain it by law or contract
You can request deletion of specific data by contacting us
Some data may be retained in aggregated or de-identified form indefinitely
Archived backups may retain data longer but are segregated and not accessible for routine business purposes

8. International Data Transfers

8.1 Data Transfer Framework

ConsumerGenie Corporation is a U.S.-based Delaware corporation. Our Services and data infrastructure may be located in the United States and other countries where we or our service providers operate (including AWS regions in the US, EU, and other jurisdictions).

By using our Services, you acknowledge that your data may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have different data protection laws than your jurisdiction.

8.2 Data Transfer Safeguards

For Business Partners and Customers in regions with data transfer restrictions (such as the EU/EEA, UK, or Canada), we implement appropriate safeguards permitted by law, including:

Standard Contractual Clauses (SCCs): EU-approved clauses for transfers from the EU/EEA to the US and third countries
Binding Corporate Rules (BCRs): Where applicable
Adequacy Decisions: Relying on official adequacy determinations (e.g., EU-US Data Privacy Framework)
Your Consent: Explicit consent to international transfers where required
Data Processing Agreements (DPAs): Including EU GDPR compliance terms, UK DPA compliance, and PIPEDA compliance

8.3 Your Responsibility

You are responsible for:

Ensuring you have authority to transfer data to us
Obtaining necessary consents from your customers for international data transfers
Complying with local data localization requirements
Informing your customers about international data transfers

9. Sensitive Data Handling

9.1 Data Minimization

We practice data minimization and collect only the personal data necessary to provide the BizNetAI Services. We do not knowingly collect or process sensitive personal information such as:

Health or medical data
Racial or ethnic origin information
Political opinions or affiliations
Religious or philosophical beliefs
Trade union membership
Genetic or biometric data
Criminal records or offenses

9.2 Exceptions

If sensitive data is incidentally collected through customer transaction data processed via our Services:

We will process it only as necessary to provide the Services
We will implement enhanced security measures
We will not use it for profiling or automated decision-making without consent
You must ensure customer consent for processing sensitive data

9.3 Payment Information Security

Payment data is processed by PCI-DSS compliant third-party payment processors. We:

Do not collect or store full credit card numbers, CVV codes, or sensitive authentication data
Transmit payment information securely using encryption (TLS 1.2 or higher)
Tokenize payment data for recurring transactions
Follow industry-standard payment card security practices
Do not store unnecessary payment-related data

9.4 Customer Data Classification

If you process customer personal data through our Services, you must:

Classify data appropriately (public, internal, confidential, restricted)
Implement access controls commensurate with data sensitivity
Notify us of any sensitive or regulated data (e.g., health, financial)
Obtain necessary customer consents for data processing and sharing
Comply with applicable data protection regulations in your jurisdiction

10. Data Security

10.1 Security Measures

We implement appropriate administrative, technical, and physical safeguards to protect your data from unauthorized access, disclosure, alteration, destruction, or misuse, including:

Technical Controls:

Encryption in transit (TLS 1.2+ for all data transfers) and at rest (AES-256 or equivalent)
Secure API authentication (OAuth 2.0, API keys, mutual TLS)
Network segmentation and firewalls
Intrusion detection and prevention systems
Regular security scanning and vulnerability assessments
Secure code development and deployment practices

Administrative Controls:

Role-based access control (RBAC) with least privilege principles
Employee background checks and security training
Confidentiality agreements and data handling policies
Audit trails and access logging
Incident response and breach notification procedures
Vendor security assessments and contracts

Physical Controls:

Secure data center facilities with restricted access
Surveillance and alarm systems
Backup and disaster recovery procedures
Environmental controls (power, cooling, humidity)

10.2 Security Limitations

While we implement robust security measures, no system is completely secure. We cannot guarantee absolute protection against all threats. You are responsible for:

Protecting your API keys, credentials, and authentication tokens
Implementing strong passwords and multi-factor authentication
Monitoring your account for unauthorized activity
Reporting security concerns immediately

10.3 Data Breach Notification

In the event of a confirmed data breach or security incident:

We will notify affected Business Partners and Customers without undue delay and, where feasible, not later than 72 hours
We will provide details of the breach, affected data, and mitigation measures
We will cooperate with regulatory authorities and law enforcement as required
We will provide guidance on protective measures and credit monitoring (if applicable)

11. Your Rights and Choices

11.1 General Rights

Depending on your jurisdiction and applicable law, you may have rights to:

Access: Request copies of your personal data we hold
Correction/Rectification: Correct inaccurate or incomplete data
Deletion/Erasure: Request deletion of your data (subject to legal retention requirements)
Restriction: Request limiting how we use your data
Data Portability: Request your data in a portable, structured format
Objection: Object to certain types of processing (e.g., marketing, profiling)
Withdraw Consent: Withdraw consent for non-essential processing at any time
Appeal: Challenge certain automated decision-making

11.2 How to Exercise Your Rights

To exercise any of these rights, contact us using the information in Section 15. We will:

Verify your identity and authorization to make the request
Respond within 30 days (or as required by applicable law)
Provide information at no cost (except for clearly excessive or repetitive requests)
Explain any limitations or exceptions to your request

11.3 Limitations and Exceptions

We may decline or limit requests where:

Necessary to comply with legal obligations or contractual obligations
Required for security, fraud prevention, or law enforcement
Necessary to protect rights of others
The request is frivolous, vexatious, or abusive
Compliance would be technically infeasible

12. Regional-Specific Rights and Requirements

12.1 European Economic Area (EEA) and United Kingdom

Legal Basis for Processing: We process your data based on contract performance, legitimate interests (analytics, security, service improvements), or your consent.

Your GDPR/UK GDPR Rights:

Right of access to your personal data (Article 15 GDPR)
Right to rectification of inaccurate data (Article 16 GDPR)
Right to erasure ("right to be forgotten") under certain conditions (Article 17 GDPR)
Right to restrict processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
Right to object to processing on grounds of legitimate interests or direct marketing (Article 21 GDPR)
Right not to be subject to automated decision-making (Article 22 GDPR)
Right to lodge a complaint with your national supervisory authority

Data Protection Impact Assessments (DPIA): For high-risk processing, we conduct DPIAs and will share relevant findings upon request.

International Transfers: We rely on Standard Contractual Clauses, EU-US Data Privacy Framework, and similar mechanisms for lawful transfers outside the EEA/UK.

Supervisory Authorities:

EEA: Your national data protection authority (e.g., Ireland DPC, France CNIL, Germany BfDI)
UK: Information Commissioner's Office (ICO)

12.2 Canada (PIPEDA and Provincial Privacy Laws)

Legal Framework: We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and equivalent provincial privacy laws (Quebec Law 25, British Columbia PIPA, Alberta PIPA, etc.).

Your Rights:

Right to access your personal information
Right to request correction of inaccurate information
Right to challenge our compliance with PIPEDA
Right to be informed of collection, use, and disclosure of your information
Right to opt-out of marketing communications

Accountability: We maintain Privacy Impact Assessments (PIAs) for significant new initiatives and can provide summaries upon request.

Cross-Border Transfers: Data transfers to the US are governed by our Data Processing Addendum and cross-border transfer safeguards consistent with PIPEDA principles.

Supervisory Authority:

Office of the Privacy Commissioner of Canada (OPC)
Provincial Privacy Commissioners (e.g., Alberta Information and Privacy Commissioner)

12.3 United States

State Privacy Laws: We comply with applicable U.S. state privacy laws, including:

California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
Virginia Consumer Data Protection Act (VCDPA)
Colorado Privacy Act (CPA)
Connecticut Data Privacy Act (CTDPA)
Utah Consumer Privacy Act (UCPA)
Delaware Personal Data Privacy Act (DPDPA)
Montana Consumer Data Privacy Act (MCDPA)

Your Rights (varies by state):

Right to know what personal information is collected and used
Right to delete personal information
Right to correct inaccurate information
Right to opt out of targeted advertising, sales/sharing of personal information, and profiling
Right to data portability
Right to non-discrimination for exercising privacy rights

Important Note: We do not "sell" personal information in the California/legal sense. We do not share information for monetary consideration. We may "share" data with service providers for business purposes, which may constitute "sharing" under CCPA/CPRA definitions.

Supervisory Authorities:

California Attorney General (CCPA/CPRA)
Relevant state attorneys general (VCDPA, CPA, CTDPA, UCPA, DPDPA, MCDPA)
Federal Trade Commission (FTC)

12.4 Other Regions

Residents of countries or regions with data protection laws (including but not limited to Brazil LGPD, Australia Privacy Act, Singapore PDPA, Hong Kong PDPO, etc.) have rights under local law. Contact us to exercise your rights, and we will comply where applicable law requires.

13. Privacy Complaints and Dispute Resolution

13.1 Lodging a Complaint with Us

If you believe we have violated your privacy rights or mishandled your data:

Contact our Privacy Officer using the information in Section 15
Provide details of the complaint, including dates and specific concerns
We will investigate your complaint and respond within 30-60 days
We will document the complaint, investigation, and resolution

13.2 Escalation to Regulatory Authorities

If you are unsatisfied with our response or believe we have violated applicable privacy law, you may lodge a complaint with the relevant data protection authority:

EEA/UK:

Your national data protection authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany)

Canada:

Office of the Privacy Commissioner of Canada
Provincial Privacy Commissioner (e.g., Alberta IPC)

United States:

Relevant state attorney general or privacy regulator
Federal Trade Commission (FTC) at reportfraud.ftc.gov
California Attorney General (for CCPA/CPRA violations)

Other Regions:

Your local data protection authority or regulatory body

13.3 Dispute Resolution

For disputes arising from this Privacy Policy or our data handling practices, you may:

Attempt informal resolution with our Privacy Officer
Pursue formal dispute resolution procedures outlined in your Service Agreement or Master Service Agreement
Exercise rights under applicable privacy law (complaint to regulatory authorities)
Pursue arbitration or litigation as permitted by applicable law and your Service Agreement

14. Changes to This Privacy Policy

14.1 Policy Updates

We may update this Privacy Policy periodically as our Services evolve, business practices change, or legal requirements change. We will:

Post the revised Privacy Policy on our website with an updated "Last Updated" date
Update the "Effective Date" if material changes apply
Notify you of material changes via email (if we have your contact information) or prominent notice on our website
Obtain your consent for material changes where required by law

14.2 Effective Date

The current version is effective as of the "Effective Date" listed above. Continued use of the Services after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact:

ConsumerGenie Corporation
Data Protection and Privacy Officer

Email: info@consumergenie.net
Phone: (by appointment)

Mailing Address:
16192 Coastal Highway
Lewes, Delaware 19958
USA

Response Time:
We typically respond to privacy inquiries within 5-10 business days. Formal requests for data access, deletion, or correction will be addressed within 30 days (or as required by applicable law).

Version: 1.0
Last Updated: Jan 01 2026
Effective Date: Jan 01 2026

This Privacy Policy was adapted for BizNetAI B2B Services and incorporates industry-standard privacy protections, international data transfer safeguards, and comprehensive rights for enterprise Business Partners and Customers.