Privacy Policy

The roles of the parties depend on the type of data being processed:

• MorPhoe Tech Inc as Controller: For data we collect directly — website visitor data, account registration, billing and payment information, support communications, and platform administration — MorPhoe Tech Inc, a California corporation, is the data controller.
• Customer as Controller, BizNerva as Processor:For data submitted by customers through the platform — employee records, incident reports, compliance documentation, training records, and other workforce data — the customer organization is the data controller and BizNerva acts as a data processor (or "service provider" under the CCPA/CPRA), processing such data solely on the customer's instructions and as described in our Data Processing Agreement.
• Partner Users:Partners accessing client organization data through the platform act under the client organization's authorization. The client organization remains the data controller for its data, and the partner's access is governed by the Partner Agreement and the client organization's settings.

For privacy-related requests, data subject rights, or general support, contact us at contact@biznerva.com.

We collect information that you provide, that we obtain automatically, and from third parties.

2.1 Information you provide

• Account and profile: Name, email address, organization name, job title, role, and password (stored in hashed form).
• Organization data: Company details, industry, size, and other information you provide when setting up or managing your organization.
• Content and documents: Documents, records, training data, incident reports, compliance-related content, and other materials you upload or create within the Services.
• Communications: Messages to support, feedback, and correspondence you send us.
• Payment and billing: Billing address, payment method details (processed by our payment provider; we do not store full card numbers).
• HRIS integration data: If you connect an HRIS provider, we receive employee roster data (names, emails, job titles, departments) via the integration. Sync logs, field mappings, and adoption metrics are stored to operate and improve the integration. HRIS credential tokens are encrypted at rest and revoked upon disconnection or account cancellation.

2.2 Information we collect automatically

• Device and browser data (e.g. IP address, browser type, operating system).
• Usage data (e.g. pages visited, features used, time spent) to operate and improve our Services.
• Log data (e.g. access times, referring URLs) for security and troubleshooting.

2.3 Information from third parties

We may receive information from identity providers (e.g. when you sign in with Google or Microsoft), from your organization administrator, or from partners who refer you, where permitted by law.

We use your information to:

• Provide, operate, maintain, and improve the Services.
• Authenticate you and manage your account and organization.
• Process transactions and send related notices.
• Send service-related and security communications.
• Respond to your requests and provide support.
• Analyze usage to improve our products and user experience.
• Send marketing communications where you have consented or where permitted (you may opt out at any time).
• Comply with legal obligations and protect our rights and the rights of others.
• Enforce our Terms of Service and other policies.

3.1 AI Data Processing

BizNerva uses third-party AI sub-processors to power compliance features. Anthropic provides AI processing for the Compliance Assistant, document review, content classification, and optional OCR of scanned uploads. OpenAI provides vector embeddings used for relevance search across regulatory and organization content, and is a provider for the Pay Transparency job-posting compliance checker (§3.1a). Google AIis a fallback provider for the Pay Transparency checker (§3.1a). Inputs are PII-redacted or stripped of personal identifiers before transmission. Data is sent over encrypted (HTTPS/TLS) connections, and we select providers whose current API terms restrict use of customer-submitted data for model training. The full sub-processor list — including each provider's jurisdiction, processing purpose, and certifications — is at /legal/subprocessors.

3.1a Pay Transparency Compliance Checker

Our job posting compliance checker analyzes job posting text for regulatory compliance with California pay transparency and labor law requirements. The job posting text and a system prompt containing compliance auditing instructions and applicable regulatory context (such as relevant California labor law requirements) are sent to AI providers (OpenAI, Anthropic, or Google AI, depending on availability). No personal identifiers such as names or emails are included. This feature is limited to 5 checks per month per organization. Data is sent over encrypted connections, and providers process it under API terms that currently restrict use of submitted data for model training.

3.1b AI Compliance Assistant

When you use the AI Compliance Assistant, the following data may be sent to our AI sub-processors for analysis:

• Organization context:Organization name, industry, employee count, jurisdiction, operating states, active compliance modules, and compliance posture summary. BizNerva applies pattern-based and field-based redaction to remove personally identifiable information (user IDs, names, emails, phone numbers) before transmission. Redaction is best-effort and is layered with other defensive controls (see "Uploaded documents" below); residual free-text PII may not be caught by patterns alone.
• Compliance data: Summaries of compliance plans, tasks, evidence items, incident records, training records, and regulatory controls relevant to your query. The same pattern-based and field-based redaction is applied to remove personal identifiers from this data before transmission.
• Uploaded documents: When you attach files (PDFs, images, text files), their content is extracted and may be sent to an AI sub-processor for analysis. Before any external transmission, BizNerva applies a multi-layer defensive pipeline that performs (i) structured-pattern redaction of personally identifiable categories (workplace PII, Protected Health Information markers, and student-record markers) at upload time, (ii) narrative-content classification of the redacted text, and (iii) blocking of documents whose classified sensitivity exceeds platform thresholds — including documents flagged as containing SSNs, bank account numbers, passwords, encryption keys, Protected Health Information, or student / minor / pupil records.Free-text narrative content that cannot be pattern-redacted (for example, bare first names or unstructured health/student narratives) is safeguarded by classification rather than upfront redaction. You should remove any remaining sensitive narrative content before upload.Specific patterns, thresholds, and pipeline ordering are intentionally not published. The AI sub-processors that may be invoked at any stage are disclosed at /legal/subprocessors.
• Conversation history: Your recent messages with the AI Assistant (up to 20 messages) are included for conversational context. After 10 messages, older conversation history is automatically summarized to maintain context while reducing data transmitted per request. The summary and recent messages are stored in our database for the duration of the conversation session.

What is NOT sent to AI sub-processors:BizNerva's design does not transmit raw employee records, user authentication credentials, financial/payment data, encrypted PII fields, or internal audit logs to external AI providers as part of standard processing.

Usage is credit-based per your subscription tier. You can review credit costs and usage history within the platform.

We do not control third-party AI providers' data practices beyond their respective API terms and cannot guarantee their compliance with their own terms. We recommend reviewing the privacy policies of our AI sub-processors. See /legal/subprocessors for the canonical list and our Data Processing Agreement for full processing terms.

3.1c Vault AI Review

When you upload compliance documents (permits, certificates, inspection reports, policies, etc.) to any compliance module, you may optionally request AI-powered analysis for audit readiness and document relevance verification.

We use a hybrid retrieval approach (vector relevance search combined with full-text search) to provide context-aware compliance guidance and reviews. Text extraction depends on the mode you select at the point of review:

• PII-Safe mode: text is extracted locally on the platform. Scanned PDFs and images that lack a text layer return empty text in this mode, with no vision-model call. No raw file bytes are sent to any external AI provider during extraction.
• Quality mode: text-layer PDFs and plain-text files are extracted locally; scanned PDFs and images are extracted via an AI sub-processor disclosed at /legal/subprocessors. In this mode, raw image bytes reach the AI sub-processor for OCR. Choose PII-Safe mode if you want zero raw-byte exposure to an external provider during extraction.

After extraction (and regardless of mode), the same defensive pipeline described in §3.1b applies before any external AI call: structured-pattern redaction at the category level, narrative-content classification, and blocking when classified sensitivity exceeds platform thresholds. Free-text narrative content that cannot be pattern-redacted is safeguarded by classification rather than upfront redaction.

AI analysis is currently user-initiated — you choose between Quick Analysis or Deep Analysis, with the credit cost clearly displayed before each action. Document content is not sent to external AI providers as part of standard document processing; transmission occurs when you take an action that triggers analysis (such as Quick or Deep Analysis), or when a future feature you have enabled does so with prior notice. Each plan tier includes a monthly credit allowance for AI features; additional credits are only required if you exceed your included allowance.

3.1d Email Transport

Transactional and notification emails (account verification, invitation, password reset, deadline reminders, etc.) are delivered via Google Workspace as the SMTP relay. Recipient email addresses and message content (which may include your name, your organization name, and action links) transit through Google's SMTP infrastructure. Under our Google Workspace agreement, message content is not used for advertising. See /legal/subprocessors for the canonical sub-processor entry.

3.2 File Security Scanning

Files uploaded to the Platform — including evidence documents, compliance records, document templates, and AI Assistant attachments — are scanned for viruses, malware, and dangerous content before being stored or processed. Files are transmitted over encrypted (TLS 1.2+) connections to Cloudmersive, a security scanning service provider. Per Cloudmersive's published API terms, the scanning API is stateless and files are not retained after the scanning transaction is completed; BizNerva relies on Cloudmersive's representation of this behavior and does not independently control their infrastructure. Under our agreement with Cloudmersive, file content is not used for model training or any purpose beyond malware detection. See our Subprocessors page for the canonical list and Data Processing Agreement for full processing terms.

Files that fail security scanning (malware detected, dangerous active content such as macros or embedded scripts, or corrupted/mismatched file formats) are rejected and not stored. You will receive a clear notification explaining why the file was rejected and what steps you can take (such as re-exporting the file or scanning it locally with antivirus software).

Legal basis (EEA/UK): We process personal data based on contract performance, consent, legitimate interests (e.g. security, product improvement), and legal obligation, as applicable.

We may share your information with:

• Service providers: Hosting, analytics, email, payment processing, security scanning, and support tools, under contract and only for the purposes we specify.
• Your organization: If you use the Services through an organization, admins may see account and usage information for that organization.
• Legal and safety: When required by law, to protect rights and safety, or to respond to valid legal process.
• Business transfers: In connection with a merger, sale, or acquisition, subject to the same privacy commitments.

We do not sell your personal information. We do not share it for cross-context behavioral advertising in a way that qualifies as a "sale" or "share" under the CCPA/CPRA, except as required by law. Please see our Do Not Sell or Share My Personal Information page for additional details.

Your information may be transferred to and processed in the United States and other countries where our service providers operate. For transfers from the EEA, UK, or Switzerland, we rely on adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms. You may request details relevant to your jurisdiction by contacting contact@biznerva.com.

We implement technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security assessments. No method of transmission or storage is 100% secure; we encourage you to use strong passwords and protect your account.

In the event of a data breach that may affect your personal information, we will notify you and applicable regulatory authorities as required by law, without undue delay after becoming aware. Specific notification timelines vary by jurisdiction: GDPR requires notification to supervisory authorities within 72 hours where feasible; California law (Civil Code § 1798.82, SB 446) requires notification within the timeframes specified by statute. See our Data Processing Agreement for detailed breach notification procedures.

This section describes retention of your personal data — the data BizNerva holds about you as an individual user (account, login activity, conversation history, etc.). For retention of customer-uploaded compliance records, the post-cancellation export window mechanics, and the Controller's regulatory retention obligations, see DPA §11 — Data Retention and Deletion (the canonical source).

Personal data BizNerva holds about you:

• Account & profile data: Retained while your account is active; anonymized within 30 days of a confirmed deletion request.
• Login attempts: 1 year (partitioned monthly). IP addresses and user agents are anonymized after 1 year for data minimization (GDPR Art. 5(1)(c)).
• Security events & activity timeline: 3 years (SOC 2 CC7.2 audit trail). IP addresses and user agents on security events are anonymized after 1 year.
• Audit logs (administrative actions): 7 years (audit trail of administrative actions taken on your account/organization). Retained as monthly partitions and dropped automatically once a partition is fully past the 7-year cutoff.
• Password reset codes: Automatically purged after 1 day.
• Expired invitations: Automatically purged after 90 days.
• AI Compliance Assistant conversations: Conversation history and summaries are retained while your account is active and deleted as part of your account or organization data upon cancellation or deletion.
• Billing & invoice records: 7 years (IRS record-keeping requirements). See DPA §11 for the breakdown of authoritative records (held by Stripe and Mercury) versus our internal webhook event records.

Customer-uploaded compliance records (your organization's data):

When your organization uploads compliance records (training records, incident reports, evidence vault files, regulatory filings, etc.), BizNerva acts as a data processorand your organization is the controller. Following cancellation or non-renewal, your organization's compliance data is retained for 60 daysto allow export, then permanently deleted. The full retention terms — including the export-window reminder cadence, the Controller's regulatory retention floors (OSHA, NERC CIP, FCA, FLSA, BSA, and others), and BizNerva's processor obligations under GDPR Art. 28 — are governed by DPA §11.

Depending on where you live, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal and contractual exceptions.
• Restriction: Request restriction of processing in certain circumstances (e.g. while accuracy is contested).
• Portability: Request a portable copy of your data in a machine-readable format (where applicable).
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where we rely on consent, you may withdraw it at any time.
• Complaint: Lodge a complaint with a supervisory authority (e.g. in your country of residence).

8.1 California Residents (CCPA/CPRA)

Under the CCPA/CPRA, California residents have the right to know, delete, correct, opt out of the sale or sharing of personal information, limit the use of sensitive personal information, and to non-discrimination for exercising these rights.

Nonprofit customers.Nonprofit organizations organized and operated for charitable, educational, religious, or similar purposes are generally not "businesses" within the meaning of Cal. Civ. Code §1798.140(d) and therefore may be exempt from the CCPA/CPRA consumer-rights obligations described in this section. If you are administering a BizNerva account on behalf of a nonprofit organization, consult your own counsel to confirm which of the rights and obligations in this section apply to your organization. The security and privacy-by-design commitments elsewhere in this policy (e.g., encryption, access controls, tenant isolation, retention policy) apply to all customers regardless of CCPA/CPRA applicability.

Sensitive Personal Information."Sensitive Personal Information" (as defined under the CPRA, Cal. Civ. Code § 1798.140(ae)) may include, where applicable to your use of the Services: account login credentials (email in combination with password), workplace injury and incident details (collected through OSHA and WVPP compliance modules), and financial information (payment method details processed by our payment provider). We collect and use Sensitive Personal Information only as reasonably necessary and proportionate to provide the Services, ensure security, detect and prevent fraud, perform analytics, and comply with legal obligations. We do not use Sensitive Personal Information for purposes that would require offering a right to limit its use beyond those permitted by law.

We do not sell or share personal information for cross-context behavioral advertising. We acknowledge the Global Privacy Control (GPC) signal at the edge layer; because we do not sell or share personal information, the signal does not change how we process your data. For full details and a structured table of personal information categories, see our Do Not Sell or Share My Personal Information page.

We will acknowledge your request within ten (10) business days and provide a substantive response within forty-five (45) calendar days of receiving your verified request, as required by California law.

To exercise your rights, contact us at contact@biznerva.com. We may need to verify your identity and, where applicable, verify requests submitted by an authorized agent. You may also use in-product settings where available (e.g. profile, data export, account deletion).

We use cookies and similar technologies for authentication, security, preferences, and analytics. You can control cookies through your browser settings. Some features may not work correctly if you disable certain cookies. We do not use third-party tracking cookies or cross-site advertising cookies.

BizNerva uses Vercel Analytics, a privacy-focused, cookieless analytics service that does not use tracking cookies or collect personally identifiable information. No cookie consent is required for this service. We do not use third-party advertising cookies, cross-site tracking, or retargeting technologies.

We use Google reCAPTCHA v3 on our contact and signup forms to protect against automated abuse. reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google for analysis. This data is used solely for anti-abuse purposes and is governed by Google's Privacy Policy. No personal information is shared with Google through reCAPTCHA beyond what is necessary for bot detection.

BizNerva is a business platform intended exclusively for adults. All users must be at least 18 years of age. We require age confirmation during account creation and do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at contact@biznerva.com and we will promptly delete it.

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. For material changes, we will provide additional notice (e.g. email or in-app notice) where required by law. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

For questions about this Privacy Policy or our privacy practices, or to exercise your rights, contact us at contact@biznerva.com.