Privacy Policy

Last updated: 24 June 2026

Effective: 24 June 2026 — Prepared in accordance with the Data Protection Act 2017 (Mauritius)

OuBiznes.mu is operated by OuBiznes, a sole-trader business registered in Mauritius (“we”, “us”, “our”). This Privacy Policy explains how we collect, use, store, and protect personal data when you use our free AI-powered tools for Mauritian SMEs at oubiznes.mu.

By creating an account or using our services, you consent to the practices described in this policy. If you disagree, please do not use the platform.

1. Data Controller

OuBiznes
Quatre Bornes, Republic of Mauritius
Email: contact@oubiznes.mu

2. Personal Data We Collect

We collect only what is necessary to operate the service:

Account data: email address and hashed password (or Google OAuth identity) when you register.
Business profile: business name, type, WhatsApp number, location, and display name — only if you choose to complete your profile.
AI tool inputs: text you enter into our generators (business descriptions, product lists, etc.). These are sent to Google’s Gemini API to generate content and are not stored beyond your session unless you explicitly save a site.
Generated websites: HTML and associated data for sites you choose to save (“My Sites”).
Usage logs: IP address hash (one-way, non-reversible), tool name, and timestamp, stored to enforce fair-use rate limits.
Technical data: browser type, device, page views, and error logs collected automatically via Vercel infrastructure.

We do not collect: payroll data, VAT transaction amounts, employee personal data, or payment card details.

3. Legal Basis for Processing

Consent (DPA 2017 s.45): you consent by creating an account and agreeing to these terms.
Legitimate interests (DPA 2017 s.45(1)(f)): rate-limit enforcement, fraud prevention, and platform security.
Contract performance (DPA 2017 s.45(1)(b)): delivering the AI tools you requested.

4. How We Use Your Data

Authenticate you and manage your account.
Generate AI content using the text you provide.
Store and display sites you have saved.
Enforce usage limits per tool (3 generations / 24 h on the free tier).
Send transactional emails (password reset, email confirmation) via Supabase’s email service.
Improve platform reliability and debug errors.

We do not sell, rent, or trade your personal data to any third party.

5. Third-Party Processors

We use the following sub-processors. Each operates under its own privacy terms:

Supabase Inc. (USA / EU) — database, authentication, and file storage. Privacy policy
Google LLC — Gemini AI API (content generation) and optional Google OAuth sign-in. Privacy policy
Vercel Inc. (USA) — hosting and edge network. Privacy policy
ElevenLabs — text-to-speech for the ReadAloud feature (no data retained per their terms). Privacy policy
Cloudflare Turnstile — invisible bot-protection on the BRN Lookup tool. Turnstile performs browser-side verification with no personal data stored. See the Cloudflare Turnstile Privacy Addendum.

6. International Data Transfers

Some processors (Supabase, Vercel, Google) may process data outside Mauritius. Where personal data is transferred to countries without an equivalent level of protection, we rely on standard contractual clauses or the processor’s own adequacy frameworks in accordance with section 46 of the DPA 2017.

7. Data Retention

Account data: retained until you delete your account.
Saved sites: retained until you delete your account or individual sites.
Usage logs (IP hash): retained for 90 days, then deleted automatically.
Error logs: retained for 30 days on Vercel.

8. Your Rights Under the DPA 2017

Under the Data Protection Act 2017 (Mauritius), you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data via your profile page.
Erasure — delete your account and all associated data at oubiznes.mu/dashboard/delete-account.
Portability — request an export of your data in a common format.
Object — object to processing based on legitimate interests.
Restrict — request that we limit processing while a dispute is resolved.
Lodge a complaint — with the Data Protection Office of Mauritius at dataprotection.govmu.org.

To exercise any of these rights, email us at contact@oubiznes.mu. We will respond within 30 days.

9. Cookies and Local Storage

We use cookies strictly necessary for authentication (Supabase session tokens) and language preference storage. We do not use advertising or tracking cookies. No third-party analytics scripts are embedded.

10. Security

Passwords are hashed by Supabase using bcrypt and never stored in plain text. All traffic is encrypted over HTTPS. Access to the database is restricted by row-level security (RLS) policies that limit each user to their own data. We conduct periodic security reviews.

11. Children

OuBiznes is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact us and we will delete the account promptly.

12. Changes to This Policy

We may update this policy as the platform evolves. Material changes will be communicated by email or via a notice on the platform. The “Last updated” date at the top of this page indicates when the most recent revision was made.

13. Contact

OuBiznes
Quatre Bornes, Republic of Mauritius
Email: contact@oubiznes.mu