Privacy Policy

Effective date: July 13, 2026

This Privacy Policy explains how PDJ Tax Experts LLC ("BizTrip", "we", "us") collects, uses, and shares personal information when you use the BizTrip website and application (the "Service"). We are the data controller for personal information processed through the Service.

1. Information we collect

• Account information: name, email address, password hash, and authentication provider identifiers.
• Business travel and financial data you provide: trips, itineraries, expenses, merchants, amounts, categories, mileage, notes, and business profiles.
• Bank account and transaction data: if you connect a bank account through Plaid, we import the account name and balance and the transaction history of the accounts you connect (date, amount, merchant, and Plaid’s category), starting with the previous 90 days, so you can match expenses to trips. You enter your bank credentials in Plaid’s own interface — BizTrip never sees or stores them.
• Receipt images: uploaded receipts that our AI processes to extract merchant, date, amount, tax, and category information.
• Location data: collected only during user-initiated mileage logging (start/stop drives). We do not track your location in the background.
• AI conversation history: the questions you ask the BizTrip assistant and the answers it returns, stored to give you continuity across sessions.
• Basic usage data: feature usage, device type, crash and performance logs, and approximate location derived from IP for security.
• Payment metadata: subscription tier, status, and Stripe customer identifiers. We never see or store full card numbers — those are handled by Stripe.

2. How we use your information

• To provide the Service — power trips, expenses, mileage, receipts, exports, and the AI assistant on your own data.
• AI processing solely to serve you. Your data is processed by AI models to answer your questions and organize your expenses. Your financial data is not used to train AI models for others.
• Payments are processed by Stripe — we never see full card numbers.
• Service notifications (renewals, receipts, security alerts) and, with consent, product updates.
• Security, fraud prevention, and abuse detection.
• Legal, tax, and accounting compliance.

What we do NOT do: We do not sell your personal information. We do not use your data for advertising. We do not use your financial or receipt data to train AI models for other customers.

3. Sharing with your accountant / advisor

Sharing with an accountant, tax advisor, or bookkeeper is opt-in, read-only, and revocable at any time from Settings. You will receive notifications when an advisor views your data or downloads exports. Revoking access takes effect immediately.

4. Service providers we use

• Supabase — database, authentication, and file storage, hosted in the United States. Data is protected by row-level security, and receipt images live in private storage buckets accessed via short-lived signed URLs.
• Google Sign-In — if you choose “Continue with Google” on the web, the sign-in happens with Google directly from the page: Google receives your IP address and the fact that you are signing in to BizTrip, and shares your Google account’s name, email address and profile picture with us to create or match your BizTrip account. Nothing else about your account is sent to Google.
• Stripe — payment processing, subscription management, and invoicing.
• Anthropic (Claude) — receives the content BizTrip needs to interpret on your behalf. In practice that means: receipt images you scan (sent as image data so the model can read the merchant, amount, tax and category),expense and trip details supplied as context when you use the AI assistant or Quick Add purpose suggestions, and, for advisor accounts, client summaries. Processing happens in the United States.
• OpenAI — receives voice note audio when you record one, solely to transcribe it to text. Voice audio is not sent anywhere else, and no voice data is sent unless you record a note. Processing happens in the United States. Recordings are stored only until you delete the note — deleting a voice note removes its audio from our storage immediately.
• Plaid — connects your bank so BizTrip can import transactions. You enter your bank credentials in Plaid’s own interface; BizTrip never sees or stores them. Plaid returns account names and balances and the transaction history of the accounts you connect (date, amount, merchant and Plaid’s category), which BizTrip stores so you can match expenses to trips. The initial import covers the previous 90 days. Only accounts you explicitly connect are read; disconnecting one removes it at Plaid and stops further syncing. Plaid has its own privacy policy governing what it does with the data it holds about you, including where it processes and how long it retains it.
• RevenueCat — manages subscriptions purchased through the Apple App Store or Google Play. It receives your BizTrip account identifier and the purchase and renewal records the store reports, so entitlements stay correct across your devices. It does not receive receipts, bank data, trips or expenses. Card details are never sent to it or to us; those stay with Apple or Google.
• Flight data providers (currently AeroDataBox and Aviationstack) — receive the flight number and date of a flight you add, in order to return its schedule, status and airport details. They receive no personal information: not your name, not your email, and nothing that identifies the traveller.
• Resend — delivers internal operational alerts to BizTrip staff (for example, that a background job has stopped running). Those alerts can contain an account identifier and a truncated error message; they are scrubbed of credentials and never carry receipts, bank data or the contents of your records.
• Providers are used through their commercial APIs. Per Anthropic’s and OpenAI’s published API terms, inputs submitted this way are not used to train their general models, and each states a limited retention window for abuse monitoring before deletion. BizTrip does not control those retention windows. (Provider terms change; this description should be re-confirmed at each release.)
• Confirmation, password-reset and other account emails are sent by Supabase (above) to the address you signed up with.
• Map, location and place-lookup providers. These are contacted from your device, so each one also sees your IP address:
  • BigDataCloud — receives the coordinates of a place you are at or have added, to turn them into a city and country name.
  • Photon (Komoot) — receives what you type when you search for a place, to return matching addresses.
  • OSRM — receives the start and end coordinates of a route, to return the driving distance and path.
  • OpenFreeMap — serves the map tiles, so it receives the area of the map you are looking at.
  • Open-Meteo — receives coordinates to return the weather there.
  • ipapi.co — receives your IP address and returns an approximate city, used only to guess your region before you grant location permission.
  None of these receive your name, email or account identifier, and none of them are given your receipts, expenses or bank data.
• NHTSA vPIC (a United States government service) — receives a vehicle VIN you enter, to fill in its make, model and year.
• Apple Push Notification service and Google Play services — deliver push notifications to your device. They receive the notification’s text and a device token.
• Google Fonts — serves the app’s typeface, and therefore sees your IP address when a page loads.
• Intuit QuickBooks — not yet enabled. When you connect it, it will receive the expenses you choose to export. Nothing is sent to Intuit unless you connect an account and start an export.
• Legal, tax, and accounting advisers under confidentiality, and authorities where required by law.

5. Retention and deletion

We retain your account and trip data for as long as your account is active. When you delete your account, we remove your personal data within 30 days, except where we must retain limited records for legal, tax, accounting, or fraud-prevention purposes (for example, invoice records held by Stripe).

6. Your rights (CCPA / GDPR and similar laws)

Subject to applicable law, you have the right to access, correct, export, and delete your personal information, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with your data-protection authority. California residents have additional rights under the CCPA, including the right to know and the right to delete; we do not sell personal information. You can exercise most rights from account settings or by emailing us at team@getbiztrip.com.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us and we will delete it.

8. Security

We use appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), encryption at rest, row-level security in the database, private storage buckets with signed URLs, hardened authentication, and access controls with audit logging. No system is perfectly secure — please keep your credentials safe and enable strong authentication.

9. International transfers

Your data is stored and processed in the United States. Where personal data is transferred from outside the US, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Cookies

We use strictly necessary cookies to keep you signed in and to remember preferences, plus limited analytics cookies to understand aggregate usage. You can manage cookies through your browser settings.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in-app or by email.

12. Contact

PDJ Tax Experts LLC · BizTrip · team@getbiztrip.com (placeholder support address — will be updated at go-live)

See also our Terms of Service and Refund Policy.