Your work. Clear boundaries.

What bizzsteps™ collects

Hosted sign-in supplies an account identifier and email, used to separate your records and check administrator access. You may provide a first name, business name, idea, operating ZIP code/country/region/city, activities, checklist notes, budget estimates, saved explanations, named chat conversations and their questions/answers, brainstorm ideas and results, organization access requests, lesson notes, and account references. A first name and business name can be working names; do not enter a home address.

Plans stay in the current tab until you choose account saving. Saved plans and account references are stored on the server, separated by user identifier, workspace, and selected business. Multiple businesses can belong to one sign-in. No passwords, recovery codes, government IDs, payment card numbers, grades, rosters, disability details, or other student education records are needed. Do not enter them.

How data is used and shared

U.S. ZIP lookup sends only the entered ZIP code to Zippopotam.us to suggest a city and state. You can enter these manually instead. Optional tips and paid consulting use external checkout or booking pages; no payment card details are collected by bizzsteps.

Data supports your plan and requested features. The product owner and active partner administrators can edit their own organization’s appearance, published wording, graphics, support links, and reviewed organization guides. The editor keeps one previous publication for undo. Partner admins can view topic feedback only after at least three people have rated that topic, using each person’s latest rating; the application does not give them an interface to read private plans or account references. Authorized infrastructure operators may have operational access. When organization join-code or closed enrollment is enabled, server-side membership checks protect that brand’s application features. The product owner and designated partner administrators can see account email, membership role, join date, and access status within the relevant brand and can approve, remove, or restore members. Only the product owner can assign partner administrators. Organization editors cannot change other brands or access private student plans or chat history. Added emails are held as pending approvals until the matching signed-in person chooses to join; no invitation email is sent automatically. Signed-in users can request organization access. Administrators see the requesting email and note and can approve or decline; approval grants member eligibility and the person must still join. Access requests are included in personal export/deletion. A shared join code does not verify university affiliation, grant access to private student plans, or replace university SSO.

The site has no advertising pixels, behavioral advertising, analytics SDKs, or automatic external font downloads. Hosting and sign-in providers may process IP addresses, browser information, cookies, and security logs under their own policies. Current infrastructure includes OpenAI Sites/sign-in and Cloudflare hosting/database services. External links are opened only when you select them; embedded videos contact YouTube’s privacy-enhanced service when opened.

AI and voice are optional

The OpenAI integration is configured. Live answers depend on provider availability and API billing. You opt in once for AI across your signed-in account and can revoke permission in Privacy settings. A question sends its text, limited business context (country, region, county, city, industry, scope, and proposed structure), and up to six recent turns from the selected business conversation, capped at 12,000 characters of prior messages, to OpenAI. Brainstorming sends the idea and location you enter for current web research. Private checklist notes, login references, and unrelated conversations/businesses are excluded. Requests set store:false; provider retention and security processing still depend on applicable provider terms. This setting is not a promise of zero retention.

Successful AI questions, answers, source links, and dates are saved automatically to your private account in the selected business and workspace. Open Conversations to continue, rename, or delete a conversation. Only recent turns of that selected conversation accompany later questions; unrelated history is excluded. Chats do not train shared guidance. Failed requests are not added to history. You can also save an explanation into your learning library. Optional feedback stores a topic and helpfulness rating, linked to your user identifier for access/deletion, not the question or answer. Your latest private helpfulness rating in this workspace can make later answers use smaller steps and a concrete example. You can override this using the answer-style selector. The portal can prioritize next steps using your own checklist progress, budget gaps, and recent topic feedback. These are per-user rules, not model training. Published organization guides may accompany new AI questions, and recent messages from the selected conversation may also accompany a question. Guides are hidden after 180 days until an admin reviews them again. Brainstorm results contain qualitative research judgments and hypothetical income calculations, not measured success probabilities or verified average owner income. Up to 20 recent ideas are shown; retained records can be exported or deleted in data controls. Usage counters enforce a shared 30-request daily allowance across chat, brainstorming, businesses, and brands. Voice dictation uses your browser’s speech service, which may send audio to its provider. bizzsteps™ does not record audio. You approve dictation, review the transcript, and separately choose whether to send it. Read aloud uses the browser’s speech synthesis service. Third-party business integrations are not connected; no authorization is inferred from an account link.

Your controls and retention

Open Settings → Privacy & data controls to export all saved bizzsteps™ records across workspaces or delete them from active application storage. You can edit each business plan, remove login references and brainstorm results, rename or delete conversations, and turn AI off. Clearing the tab removes its in-memory plan and current conversation without deleting saved server records or chat history. Sign out before leaving a shared computer. Downloaded exports remain wherever you save them.

Saved records currently remain until you delete them; an automatic inactivity expiration is not configured. Deletion removes active membership and its email record. If an administrator has removed your access, a minimal denial record (account identifier, brand, and access status, with email and join date erased) remains to prevent rejoining with a shared code. Current enrollment attempt counters remain through their rate-limit window; expired counters are cleaned during subsequent enrollment or deletion requests. Deletion does not erase your ChatGPT account, external service accounts, or provider backups/security logs. Their retention periods and contractual erasure process must be confirmed before institutional use. To ask about privacy, access, correction, deletion, or institutional review, contact annarice2023@gmail.com. Applicable rights depend on your location and the relevant controller. No personal data sales or targeted advertising are implemented in this application.

bizzsteps™ is intended for adults aged 18 and older. It is not offered for children or K–12 student records in this release. Minors should not submit personal information.

A resource, not professional advice

Guidance and AI answers may be incomplete, outdated, or incorrect. Rules depend on your location, activities, and circumstances. Links and suggested steps are starting points, not endorsements, filings, or a guarantee of compliance. Completing a checklist does not certify legal compliance or guarantee business results. You remain responsible for decisions, filings, payments, and deadlines.

Only add information you are authorized to use. Do not upload sensitive student records, credentials, or unlawful content. You retain responsibility for your business material. Organization concepts are demonstrations and do not imply affiliation, endorsement, or university approval.

University review status

Institutional approval pending. This application has baseline technical safeguards. It is not certified as FERPA, GDPR, COPPA, or university compliant. Do not upload education records or use it as an official university student system before completing institutional review.

Implemented in this release

• Server-verified identity and administrator checks; saved plans and account references scoped by user and workspace.
• Same-origin checks for writes, parameterized database queries, optimistic plan versioning, request size limits, no-store responses, restricted browser permissions, and security headers.
• No persistent private-plan cache in the browser; data export and authenticated deletion; explicit AI and microphone choices.
• No ads/tracking SDKs or auto-loaded external fonts; no passwords or provider credentials in the account organizer.

Required before student deployment

• Identify the operating legal entity, privacy controller, university responsibilities, permitted purposes, and applicable jurisdictions.
• Complete FERPA school-official/direct-control review where relevant, a data processing agreement, approved subprocessors, data residency and international transfer terms, and deletion/backup retention commitments.
• Establish institution-verified membership, institution SSO requirements, role-based staff access and tenant isolation. Join-code and closed enrollment provide per-brand application membership checks, but shared codes do not verify institutional affiliation and institution-specific SSO is not configured. Partner-admin roles manage membership only; they do not grant access to private plans.
• Agree on retention limits, consent/legal basis, data rights handling, incident response and breach notification, audit logs, access reviews, disaster recovery and independent security assessment.
• Review accessibility evidence, procurement questionnaires such as HECVAT, and any local or state student-privacy obligations. Review AI and speech providers separately before activation.

Reference materials: U.S. Department of Education: service provider responsibilities; European Commission: GDPR principles.

Public reviews

If you choose to publish a review, your display name, star rating, review text, and update date are shown to visitors. Your sign-in email is not published with your review. You can edit or remove your review from Reviews & help. Reviews are included in account data export and deletion. Questions sent by email are handled separately in Anna’s email inbox.