This explains what Your Business Mind holds about you, why, and what you can do about it. It is written to be read, not to be survived.
1.Who is responsible
Krrisp Pty Ltd, a business registered in New South Wales, Australia, decides how and why the information described here is handled. Where the law calls that a controller, we are it.
For the notes and documents you store, you decide what goes in. If they contain information about other people, you are responsible for having the right to hold it.
2.What we hold
Your sign-in details. Your email address, and either a password we never store in readable form or the fact that you sign in through another provider.
Your notes and documents. Everything you write, import or upload: titles, contents, how they are filed and the links between them. A document you upload is read to suggest notes; the notes you approve are what we keep.
Your conversations. What you ask the assistant and what it answers, in the app and on Telegram if you connect it.
Phone calls. If you speak to your assistant by phone, the call is handled by our voice provider. We keep a record of each call (when, how long) so your minutes can be counted.
Your settings. The name and voice you chose for the assistant, and which models you selected for which task.
Your AI credential. Held encrypted so it can be used on your behalf. It is never displayed again, to you or to anyone, and never sent back to your browser.
Connected accounts. If you connect Google, Microsoft 365 or Telegram, we hold an encrypted access credential for it. See clause 5.
Billing records. If you buy a plan or a voice pack, your payment is taken by our payment provider. We hold your plan, its status and a customer reference. We never see or store your card number.
Referral details. If you arrive through an affiliate's link, we record which affiliate referred you, so they can be credited.
Usage records. Counts of what the service did for you, for instance that a website was read or how many voice minutes were used, so limits and costs can be applied fairly.
Product usage steps. Which steps of the app you have reached, for instance that you connected your AI or asked your first question, so we can see where people get stuck. These are linked to an anonymous account number, recorded by our product-analytics provider without cookies, and never include your notes, conversations, documents or anything you type.
Support tickets. If you report a problem, we keep your report, its reference and its status, so you can see where it stands.
Error reports. When something breaks, technical details of the fault are sent to our error-monitoring provider. These never include your notes, conversations, documents, credentials, email address or internet address.
Network information. Your internet address is used briefly, in memory, to apply rate limits. It is not stored against your account.
3.Why we hold it
To give you the service you asked for: to sign you in, to keep your notes, to answer your questions from them, to carry out what you confirm in connected accounts, to bill you, to apply limits, and to fix faults. Where the law requires a lawful basis, ours is the performance of our agreement with you, and our legitimate interest in keeping the service working and secure.
4.Where it is held
Your notes, documents and account records are stored in Sydney, Australia. The servers that process your requests run in Singapore and Sydney, so information passes through Singapore on its way to and from storage.
Your AI provider, and some of the organisations that help us run the service, operate in other countries, in particular Singapore and the United States. Where information leaves Australia, we rely on the protections in our arrangements with them.
5.Who receives it
The AI provider you choose. This is the significant one. When you ask a question, the parts of your notes relevant to it are sent to the provider whose account you connected, under your agreement with them. We do not choose them and we do not control what they do with what they receive. Notes you mark as sensitive are held back until you unlock them with your PIN in the app; once unlocked, a sensitive note relevant to your question is sent like any other. Sensitive notes are never used on phone calls.
Connected accounts. If you connect Google, the assistant can read your email, calendar, spreadsheets and documents when you ask it to, and see the names (not the contents) of files in your Drive. If you connect Microsoft 365, it can read your email and calendar. Email is only ever drafted, never sent. Anything that would change your calendar, spreadsheets or documents waits for you to confirm it first.
The website you nominate. If you ask us to read a web address, our website-reading provider fetches pages from it.
Organisations that help us operate. Hosting and storage, payments, email, voice calls, voice-note transcription, error monitoring, product analytics and support. They act on our instructions and may use what they hold only to provide their service to us. If you have a legitimate need for the names of these organisations, for instance a security or compliance review, write to us and we will deal with it directly.
Where the law requires it. If we are compelled by a valid legal process, or where it is necessary to protect someone from harm.
6.What we never do
We do not sell your information. We do not use your notes, conversations or documents to train any model, ours or anyone else's. We do not read your notes to build a profile of you, and we do not use them for advertising. We do not run advertising on the service.
7.Cookies
The app uses cookies that are needed to keep you signed in. The website sets two small cookies, and only when you arrive through a tagged link: one when you come through an affiliate's link, so the affiliate can be credited if you sign up (it lasts 60 days), and one recording which channel the link came from, for example a group we shared it in, so we know where people heard about us (it lasts 30 days). Neither identifies you. The website also uses Google Analytics, which sets its own cookies to count visits and see which pages and links people use. It tells us how many people came and from where, not who they are; we never send it your name, email or anything you type into a form. If you visit from the UK, the European Union or Switzerland, those analytics cookies are switched off and Google receives only anonymous counts without them. We do not use advertising cookies. The app itself uses no analytics cookies.
The website's forms are protected from bots by Cloudflare Turnstile, which checks signals from your browser when you use a form. Cloudflare handles that check under its own privacy policy, and it does not set advertising cookies.
8.How long we keep it
Your notes, settings and connected-account credentials are kept until you delete them or close your account. Conversations are kept until you clear them or close your account. Usage records are kept for up to twenty-four months so limits and costs can be reconciled. Records of decisions you were asked to make are kept for ninety days after you make them. Support tickets are kept until you close your account. Billing records are kept as long as tax law requires.
You can close your account from within the service. Doing so cancels any paid plan, and removes your notes, your conversations, your settings, your stored AI and connected-account credentials and your sign-in identity. We do not keep a shadow copy afterwards, and the deletion cannot be reversed.
Backups are held for a short period as protection against failure, and anything deleted disappears from them as they age out.
9.Your rights
Wherever you are, you can ask us what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Most of that you can do yourself inside the service, immediately.
Depending on where you live you may also have the right to object to or restrict certain handling, to withdraw consent, to receive your information in a portable form, and to complain to a data-protection authority. In Australia that is the Office of the Australian Information Commissioner; in the United Kingdom the Information Commissioner's Office; in the European Union your national authority. We would rather you told us first.
We do not discriminate against anyone for exercising a privacy right.
10.Security
Access to your data requires your sign-in. Credentials are stored encrypted and have no path back to a browser. Requests are rate limited. Data is separated by account at the database level rather than only in application code. More on our security page.
No system is beyond compromise, and we do not claim otherwise. If a breach affects you and the law requires that you be told, we will tell you.
11.Children
The service is for business use and is not directed at anyone under 16. We do not knowingly hold information about children. If you believe we have, tell us and we will remove it.
12.Changes
We may update this policy. The date at the top shows when it last changed, and a material change will be made visible in the service rather than only posted here.
13.Contact
For anything in this policy, including a request about your information, write to support@yourbusinessmind.ai.