Privacy Policy

1. Who we are and what this covers

Wildbird, in the United States, is responsible for the BeMySystem website and Banyan Systems workspace at bemysystem.com and is the contact for privacy requests. BeMySystem is our public business website; Banyan Systems is the private operations workspace at /dashboard. This policy describes the public website, inquiries you send us and the current private agency and client workspace: account administration, authorized Meta advertising connections and user-requested AI analysis. If you use a client workspace, its administrators also decide which accounts, business context and users belong there.

This version does not provide automatic daily reports, email/WhatsApp/Slack delivery, campaign editing or social publishing. Future features may require updated disclosures and additional authorization.

2. Information we collect

• Website inquiries: if you choose to email us, we receive the email address, business contact details and message you send. The website has no lead form, tracking pixel or automatic newsletter enrollment. Clicking an email link opens your email app; it does not send a message automatically. Please do not send patient information.
• Account and access information: email address, a password hash (not a readable password), session and invitation records, workspace memberships, roles and access settings.
• Business content: workspace and business names, agent settings, instructions, knowledge you enter, questions, analysis results, revision snapshots and usage records.
• Meta connection data: the authorized Meta identity's ID and name, access credentials, and available ad-account IDs, names, status, currency and time zone. When an authorized user runs an analysis, we retrieve campaign-level aggregate advertising metrics for the last seven days, such as spend, impressions, clicks and available conversion action counts. Account and campaign names can contain information entered by advertisers.
• Operational information: action timestamps, audit records, request information used for security and rate limiting, and provider usage or error status. The app does not intentionally put passwords, access tokens or provider keys in application logs.

Meta access is read-only and limited by the authorizing person's permissions. An administrator must enable the intended accounts in the client workspace. Connecting an identity does not give Banyan access to every Meta account.

3. How information is used and shared

Voluntarily emailed inquiries are used to respond to your request and discuss the business services you asked about. Messages are handled through the receiving email service, outside the Banyan database. This website does not automatically forward inquiries to an AI model or enroll you in a marketing sequence.

We use information to authenticate users, enforce client access, manage connections and agents, retrieve requested advertising aggregates, generate advisory analyses, retain run history, and secure and operate the service.

• Workspace access: authorized members can see information permitted by their role. The agency owner can administer client workspaces. An ordinary client membership does not grant access to other clients.
• Hosting: Hostinger provides the server hosting used to run Banyan and store its database and encrypted backups.
• Meta: authorization and advertising API requests are exchanged with Meta to connect and read the accounts you permit.
• AI processing: when an authorized user starts a run, the selected provider, OpenAI or Anthropic, receives the question, agent instructions, business knowledge and relevant advertising context, including account/campaign identifiers and aggregate metrics. Banyan's server does not include Meta tokens or provider keys in the model prompt. Do not put secrets in knowledge or questions. Provider credentials are used separately for API authentication.

Provider handling, retention and processing locations depend on the selected service and its applicable terms and account settings; this policy does not promise zero retention by providers or US-only storage. Banyan itself does not sell workspace information, use it for advertising targeting, or train or fine-tune models on it. Using an AI provider for inference is distinct from training a model.

Do not enter patient records, protected health information, individual lead records or other sensitive clinical information. Banyan is an administrative tool, not a clinical system or a HIPAA-ready service.

4. Cookies and security

The app uses a necessary session cookie for sign-in, with a 12-hour session lifetime. It does not include advertising trackers or third-party analytics scripts. Security controls include HTTPS, password hashing, server-side access checks and encryption of stored integration credentials. These controls do not eliminate all security risk; ordinary business content in the database is not separately encrypted field by field.

5. Retention and disconnection

Emailed inquiries are retained in the receiving mailbox and handled separately from workspace records. The website does not impose an automatic deletion schedule on that mailbox. Contact us to request access, correction or removal of an inquiry.

Workspace configuration and saved analyses remain in the service until removed through an authorized process. The current version has no automatic age-based purge of business records or run history; it does not automatically delete reports after 90 days.

Disconnecting Meta removes the locally stored connection token and disables its accounts for further analysis. It does not automatically delete account metadata, past reports, agent revision snapshots or audit history. Disconnecting cannot recall information already sent to an AI provider. Provider-side deletion or revocation may require a separate request to that provider.

Encrypted server backups keep the latest 14 snapshots. Manual off-server recovery copies may remain longer and do not have an automatic expiry. A deletion request therefore requires review of active records and relevant recovery copies, not just disconnecting a connection. See the data-deletion instructions for the request process.

6. Your choices and privacy requests

You can ask your workspace administrator to correct information, adjust account selection or disconnect a connection. To request access, correction or deletion of information, contact fran@wildbird.com. Privacy rights and applicable deadlines depend on your circumstances and applicable law. We may need to verify your identity and authority over the requested data before acting; one person's request does not authorize deleting another client's information.

Include your registered email, workspace name and a description of your request. Do not send passwords, API keys, access tokens or patient information. The data-deletion page explains what to request and how to follow up.

7. Changes and contact

Changes to this policy will be published here with an updated date. Questions about BeMySystem or Banyan's data handling can be sent to Wildbird at fran@wildbird.com.