Privacy Policy

Effective October 9, 2026

Bipsy reads your business's financial data in order to tell you where your money is going and what you can do about it. That is the only reason it holds anything. This page explains exactly what it holds, who else sees it, and how to take it back. If you want the short version with your own live numbers in it, that's on the Your data page once you're signed in.

Who we are

Bipsy is operated from California, United States. For questions about this policy, or to exercise any right described below, email privacy@trybipsy.com.

What Bipsy collects

Account information. Your name, email address, and either a password or a Google account identifier. Passwords are stored only as a bcrypt hash — nobody, including whoever operates the servers, can read your password.

Business information. The business name, industry, and location you enter during onboarding. These are used to select the right benchmarks and vendor knowledge, not to identify you to anyone.

Financial data. Transactions, balances, vendor names, card-processing volume and fees. This arrives in one of three ways: a read-only bank connection you authorize through Plaid; a read-only connection to Stripe or Square; or a statement you upload yourself as a PDF, CSV, or image. Bipsy stores the transactions and card-fee figures it derives from these, and the uploaded file's name. The file itself is read to extract them and is not kept.

What you do in the product. The missions you set, the emails Bipsy drafts, which of them you approved, and a log of actions taken on your account.

Basic technical data. Standard server and security logs — IP address, browser, timestamps — kept to operate the service and detect abuse.

Bipsy does not use advertising trackers, does not build a profile of you across other websites, and has no third-party analytics or advertising pixels on the signed-in product.

What Bipsy cannot do

These are limits of the software, not promises about behavior. Bank connections through Plaid are read-only and there is no code path in Bipsy that initiates a payment, transfer, or withdrawal. Bipsy never receives your bank username or password — you enter those with Plaid, and Bipsy receives only a token. If you connect Gmail, the permission requested is send-only: Bipsy can send a message you approved and cannot read your inbox. No email is ever sent from your account without you reading it and clicking send. During the beta, the option to connect Gmail is turned off: you copy a draft or open it in your own email app and send it yourself.

Why Bipsy uses it

To categorize your spending and identify what you pay each vendor; to compare what you pay against published prices and benchmarks; to draft negotiation and cancellation messages for your approval; to answer your questions about your own figures; to operate your account, take payment, and contact you about the service; and to keep the service secure. That is the complete list.

Bipsy does not sell your data and does not share it with data brokers, advertisers, or lenders. Bipsy does not use your financial data to train AI models, and it is not pooled with other customers' data to create products sold to anyone else.

Who else sees it

Bipsy relies on a small number of service providers, each handling a specific part of the job under contract and permitted to use your data only to provide that service:

• Vercel — hosts the application and runs its servers.
• Supabase — provides the database where your account and transactions are stored.
• Plaid — provides the read-only bank connection. Plaid's own privacy policy governs what it holds.
• Stripe — processes your subscription if you choose to pay, and provides the read-only connection if you link a Stripe account. Bipsy never receives or stores your card number.
• Square — provides the read-only connection if you link a Square account.
• Google — provides sign-in if you use it, and send-only Gmail access if you grant it.
• Groq — runs the AI model described below.
• Resend — delivers account email such as verification and password-reset links.

Beyond these, Bipsy discloses data only when you direct it to (for example, an email you approve being sent to a vendor), or where required by law. If Bipsy is ever acquired or merged, your data may transfer as part of that transaction, and you will be told before it does.

How AI is used, and what it sees

Two parts of Bipsy use a large language model, run by Groq through its API:

• Categorizing transactions the rules can't. Most transactions are categorized by Bipsy's own rules. For the ones that aren't, Groq receives the transaction description, whether money came in or went out, and your business type — not amounts, dates, account numbers, or your name.
• Ask Bipsy. Groq receives your question, your business's name, type, location, and size, and the figures Bipsy looks up to answer it, such as vendor names and amounts.

Uploaded statements are read on Bipsy's own servers — text extraction, and character recognition for scans and images — and are not sent to an AI model. Groq states that it does not retain API request data by default, except logs kept for up to 30 days when investigating abuse or problems with its service.

The model is deliberately kept away from the arithmetic: every figure Bipsy shows you is computed by ordinary code from your own transactions. The model categorizes and explains; it does not decide what you are paying. Ask Bipsy is optional: if you don't use it, the only thing the model ever sees is the description of a transaction the rules couldn't categorize.

How it's kept

Connection tokens are encrypted with AES-256-GCM before they are written to the database, so a copy of the database alone does not grant access to your accounts. Passwords are hashed with bcrypt. Sessions are signed, expire after 30 days, and are transmitted only over HTTPS. Access to production systems is limited to those who need it to run the service.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects your data, you will be notified without undue delay.

How long it's kept

Your data is kept while your account is open. Disconnecting a linked account revokes the token at the provider and deletes what that connection imported. Deleting your account removes your data from the live database immediately; encrypted backups roll off within 30 days. Records that must be kept for tax or legal reasons — a payment receipt, for instance — are retained as required by law and for nothing else.

Your rights

You can export everything Bipsy holds about your business as a single JSON file, disconnect any linked account, or delete your data entirely — all from the Your data page inside the product, without emailing anyone or waiting for a support ticket.

If you are in California, the CCPA gives you the right to know what personal information is collected, to have it deleted, to correct it, and not to be discriminated against for exercising those rights. Bipsy does not sell or share personal information as those terms are defined under the CCPA, so there is nothing to opt out of. If you are in the EEA or UK, you have the equivalent rights under the GDPR, including data portability and the right to object — the export and delete controls satisfy most of these directly, and privacy@trybipsy.com handles the rest.

Children

Bipsy is a tool for businesses and is not directed at anyone under 18. Bipsy does not knowingly collect personal information from children.

Changes

If this policy changes in a way that materially affects how your data is used, you will be told by email before the change takes effect, not by a quietly updated date at the top of the page. The effective date above always reflects the current version.

Contact

privacy@trybipsy.com for anything in this policy; support@trybipsy.com for everything else.