# Business Architecture OS privacy, control, and limitations

Source status: public BAOS website, Terms of Service, Privacy Policy, and Refund Policy observed August 19, 2026. The current legal policies display an effective date of August 19, 2026. The legal pages control if this summary differs from them.

## Information BaOS may collect

Depending on the engagement, the public Privacy Policy describes collection of:

- contact and company information;
- selected departments and workflows;
- business processes, owners, tools, examples, instructions, and review requirements;
- materials the client chooses to provide;
- completed workflow-audit CSV files and related delivery materials;
- transaction and refund status made available by Stripe;
- scheduling information received through Cal.com;
- ordinary technical, security, and diagnostic logs;
- communications and support requests.

BaOS does not receive or store the client's full payment-card number.

## Prohibited or highly sensitive information

The public site and policy tell clients not to submit passwords, API keys, tokens, payment-card numbers, health records, government identifiers, or other highly sensitive information unless an appropriate handling process has been expressly agreed.

Secrets and credentials should remain outside the delivered workspace.

## AI use and human control

BaOS helps define context, responsibilities, and review boundaries. It does not guarantee AI output or a business result.

AI output may be incomplete, inaccurate, or unsuitable. Humans remain responsible for important business decisions, final approvals, and lawful use of information.

Customer intake files are not used to train an AI model. The Privacy Policy states that BaOS does not sell personal information or use customer business files for unrelated advertising.

## Providers

The public Privacy Policy identifies providers used to operate the service, including:

- Stripe for payment processing;
- Cal.com for scheduling;
- Vercel for hosting and private file storage;
- Resend for transactional email.

If a client uses the delivered workspace with ChatGPT, Claude, or another AI provider, that provider's terms and privacy practices also apply to information submitted there.

## Storage, retention, and deletion

The Privacy Policy says uploaded customer files are stored in a private Vercel Blob store connected to verified paid access.

Information is retained as reasonably necessary to deliver and support the engagement, maintain transaction and tax records, resolve disputes, enforce agreements, and meet legal obligations. Handoff does not automatically delete intake files.

Clients may request access, correction, or deletion through support. Some records may be retained for contractual, security, tax, dispute, or legal reasons.

No transmission or storage system can be guaranteed completely secure.

## Refund-related access

When Stripe confirms a full refund, the customer portal becomes read-only, further uploads and scheduling are disabled, and BaOS attempts to cancel an active booking. Existing portal records may remain for transaction, support, and legal recordkeeping.

## Controlling sources

- Terms: https://www.learnbaos.com/terms
- Privacy: https://www.learnbaos.com/privacy
- Refunds: https://www.learnbaos.com/refunds
- Support: support@learnbaos.com