Privacy Policy

1. Information We Collect

When you interact with the BizFlow application, we collect only the minimal data required to provide decentralized invoice settlement and audit verification:

• Public Wallet Address: Used to associate your session with your business organization.
• Organization Profile: Business name, country, optional contact email, and optional social links provided during onboarding.
• Payable Data: Supplier names, remittance wallet addresses, purchase orders, goods receipts, and invoice line items entered into your organization.
• Cryptographic Hashes: SHA-256 hashes of invoices, 3-way match outputs, and policy evaluations.

2. How We Use Your Information

Your information is used solely to provide invoice reconciliation, execute deterministic policy checks, formulate advisory AI payment recommendations, and verify on-chain receipts.

We do not sell, rent, monetize, or share your business data with data brokers or advertising networks.

3. Multi-Tenant Cryptographic Isolation

Every query and mutation in BizFlow is strictly scoped to the authenticated organization. Session tokens are signed with HMAC-SHA256 and stored in secure, HttpOnly, SameSite=Lax cookies. One business organization cannot view, query, or modify another organization's suppliers or invoices.

4. On-Chain Transparency & Blockchain Invariants

Please note that transactions broadcast to the Arc network (such as USDC transfers and AuditAnchor contract interactions) are inherently public, transparent, and immutable on the blockchain.

Public verify pages (such as /verify/[id]) display only sanitized cryptographic proofs (hashes and timestamps) and never disclose raw vendor contact details or confidential internal notes to unauthenticated viewers.

5. Data Retention & Erasure

Off-chain business data stored in the database can be reviewed and managed within your settings portal. However, on-chain transaction records and audit anchor events published to the Arc blockchain cannot be altered or removed.