Privacy Policy

Scope and contact

This policy applies from October 4, 2026 to the public content, diagram examples, accounts, and early access Workspace at bizthinkframe.com. “We” means the operator of BizThinkFrame, who is responsible for handling personal information and related requests for this site.

Send privacy questions or data requests to hello@bizthinkframe.com. Third-party websites and services have their own privacy notices.

Information we handle

• Browsing and security: Network requests involve your IP address, browser or device information, access time, page path, and error information. These help us deliver pages, maintain security, and investigate faults. Our application logging configuration removes query strings. Please keep sensitive information out of search terms and shared links.
• Accounts and sign-in: Your email address, display name, email verification status, account ID, and creation date. Sign-in sessions also involve your IP address, browser information, and session expiry. Verification codes are stored as hashes rather than readable codes. If you sign in with Google, we receive basic identity details, such as your email address, name, and profile picture, and the information needed to link your sign-in. We do not request access to Gmail or Google Drive content.
• Early access applications: The use case you submit, your linked account and email address, review status, timestamps, and necessary records of administrative actions.
• AI usage records: Your account ID, request time, selected framework, model, processing status, and usage. These records help us limit duplicate requests, manage usage, and investigate problems.
• Contact emails: Your sender address, subject, message, and any attachments you choose to provide, so we can handle feedback, support, and data requests.

Local drafts and AI processing

Your Workspace material, diagrams, and edits, along with the public SWOT example, are saved in the current browser. Signing in identifies your account and access permissions; it does not automatically back up your drafts to the cloud. Signing out does not delete local drafts. Clearing site data or changing browsers or devices may make them unavailable. Export important work regularly.

Local organization and manual editing take place in your browser. When a user with AI access chooses to generate a result, the selected material—either the full text or a selection—along with framework information and the parameters needed for generation is sent through our server to an online AI service. The result returns to the browser and can be saved as a draft. Our AI request records do not store your source text, prompts, or generated content.

Only submit material you are authorized to process. Avoid passwords, verification codes, identity documents, unauthorized personal information, and confidential business information. Separating drafts by account is not device encryption. Other people using a shared device may be able to access its browser data.

Purposes and grounds for processing

We use this information to provide sign-in, maintain account details, manage early access, carry out AI generation you request, answer emails, prevent abuse, and protect the service. We do not sell your personal information. We have not added advertising trackers or behavioral ad targeting to this site.

Where applicable law requires a legal basis, information needed to provide the service you request is processed to perform our service agreement. Security, abuse prevention, and service maintenance rely on necessary and reasonable legitimate interests, taking your rights into account. Legally required retention or disclosure relies on legal obligations. We will explain other uses that require consent and ask for that consent separately. You can withdraw it; withdrawal does not affect the lawfulness of earlier processing.

Service providers and data locations

We use Cloudflare for hosting, security, account data storage, email, and AI processing. We use Google for sign-in authentication and to receive contact emails.

These services may process information outside your country or region. We do not currently offer an option to keep all processing within a single region. Processing across regions is subject to applicable law and the providers’ safeguards. See the Cloudflare Privacy Policy, Workers AI data usage information, and Google Privacy Policy.

We share relevant information only for the service purposes described above, to meet legal obligations, or to handle necessary security incidents. We do not publish your contact emails or drafts.

Retention and deletion

• Local content: Remains in the current browser until you delete documents, clear site data, or the browser clears its storage. We cannot remotely recover or erase these local copies.
• Sign-in: Verification codes expire after 5 minutes. Sessions last 7 days and may renew during use. Expiry means a code or session can no longer authenticate you; it does not mean every related database record is deleted at that moment.
• AI metadata: Requests made more than 93 days ago are removed in batches when subsequent AI requests trigger cleanup. We do not promise that all records are deleted exactly on day 93.
• Accounts, applications, and support records: There is currently no single automatic deletion period. We retain these records for as long as needed to provide account services, handle applications or feedback, and protect security. You can request deletion by email. We will verify your identity, assess what needs to be retained, and tell you the outcome.
• Logs and backups: Retained according to platform settings and necessary security, troubleshooting, or legal requirements. After online data is deleted, copies in restricted backups may remain until the platform’s retention period ends.

Your choices and rights

You can read public content without an account. On your account page, you can change your display name and sign out of the current device or other devices. You can delete local documents in the Workspace or clear site data as described in Cookies & Storage. We do not currently offer a self-service account deletion button.

Depending on applicable law, you may have rights to access, copy, correct, or delete personal information; restrict or object to certain processing; transfer your data; and withdraw consent. Send your request from the email address linked to your account and explain what you want us to do. We will ask only for information needed to verify your identity and handle the request, and respond within the time required by applicable law. If we cannot fulfill a request, we will explain why and describe available options.

An account deletion request does not automatically delete files you have already saved or exported on your devices. If you disagree with the outcome, you may also complain to the data protection or other competent authority in your location.

Security and minors

We use HTTPS, protected sign-in cookies, server-side access checks, and request limits. OAuth tokens are encrypted in storage. No online service can guarantee absolute security. Report unusual activity or a possible data breach through the security contact on our Contact page.

This site is intended for people able to use it independently for work and learning; it is not directed at children. Minors should use it with a guardian’s guidance and in line with local requirements. Contact us if you believe a child has provided personal information without the necessary authorization.

Policy updates

We will publish changes here and update the date. If we introduce new uses of data, cloud storage, or other significant changes to how information is handled, we will provide notice in the relevant features and obtain separate consent where required by law.