GenerateBizPlanPrivacy Policy
On this page
This Privacy Policy explains how GenerateBizPlan (the "Service"), operated by Mill AI, collects, processes, stores, and protects your personal data when you use our free AI tool that generates 1-page Lean Business Canvas PDFs.
We designed this Service with one principle: collect as little data as possible, and tell you exactly what we do with it. This policy complies with the EU General Data Protection Regulation (GDPR / Regulation 2016/679) and the California Consumer Privacy Act (CCPA).
1. Who we are
The data controller responsible for your personal data is:
Mill AI
Email: contact@millai.eu
You can reach our privacy team at contact@millai.eu. We have not appointed a statutory Data Protection Officer (DPO) because our processing does not meet the mandatory criteria under Art. 37 GDPR, but the address above serves as the single privacy contact point.
2. Data we collect
We collect only what we need to generate and deliver your PDF:
2.1 Information you provide
- Email address - mandatory; used exclusively to deliver your generated PDF and, if you opt in, occasional product updates.
- 8 form inputs - text you enter describing your business: business name, industry, problem you solve, target customer, solution, revenue model, 6-month goal, and language preference. This content is sent to an AI processor to generate your canvas.
- Consent signals - timestamped acknowledgment that you have read the AI disclaimer and our Terms of Service, plus an optional separate consent to receive our newsletter.
2.2 Information we collect automatically
- Technical data - IP address (truncated), browser type, device type, referrer URL, timestamp of visit. Used for security, abuse prevention, and aggregated analytics.
- Analytics events - page views, form starts, form submits, PDF generation events. Collected via Google Analytics 4 only if you consent through our cookie banner.
2.3 What we do NOT collect
- We do not collect your name, phone number, payment data, or identity documents. The Service is free and does not require an account.
- We do not use advertising cookies, retargeting pixels, or third-party marketing trackers in the MVP.
- We do not scrape, enrich, or combine your data with third-party profiles.
3. Why we process your data
| Purpose | Data used |
|---|---|
| Generating and delivering your 1-page PDF | Form inputs + email |
| Preventing abuse (prompt injection, spam, scraping) | Technical data, rate-limit signals |
| Sending product updates & cross-sell from Mill AI portfolio | Email (only with explicit opt-in) |
| Improving the Service (aggregated analytics, error logs) | Technical data, GA4 events (consent-based) |
| Complying with legal obligations (tax, GDPR requests) | Minimum necessary records |
4. Legal basis (GDPR Art. 6)
| Processing | Legal basis |
|---|---|
| Generating PDF & delivering by email | Art. 6(1)(b) - performance of a service you requested |
| Preventing abuse & securing the Service | Art. 6(1)(f) - legitimate interest (protecting the Service) |
| Analytics via Google Analytics 4 | Art. 6(1)(a) - consent (via Consent Mode v2) |
| Marketing emails / cross-sell | Art. 6(1)(a) - explicit opt-in consent |
| Tax, accounting, legal compliance | Art. 6(1)(c) - legal obligation |
You can withdraw any consent-based processing at any time without affecting processing that already happened. See Section 8.
8. Your rights
Under GDPR (and equivalent provisions under CCPA for California residents), you have the right to:
- Access - receive a copy of the personal data we hold about you.
- Rectification - correct inaccurate data.
- Erasure ("right to be forgotten") - request deletion.
- Restriction - limit how we process your data.
- Portability - receive your data in a machine-readable format.
- Object - object to processing based on legitimate interest or direct marketing.
- Withdraw consent - at any time, with future effect.
- Lodge a complaint with the President of the Personal Data Protection Office (PUODO, Poland) or your local EU supervisory authority.
- CCPA specific - right to know, right to delete, right to opt out of the "sale" of data (we do not sell data), right to non-discrimination.
To exercise any right, email contact@millai.eu. We respond within 30 days (up to 60 days for complex requests, as allowed by Art. 12(3) GDPR). We will never charge a fee for reasonable requests.
10. Children's privacy
The Service is not intended for children under 16 (GDPR) or under 13 (COPPA, for users in the United States). We do not knowingly collect data from children. If you believe a child has submitted data, contact us and we will erase it.
11. Security
- HTTPS / TLS 1.3 on all traffic.
- Least-privilege access controls; API keys stored in encrypted secret managers.
- Rate limiting, prompt-injection filters, and automated abuse detection.
- Regular security reviews by our internal Security Officer.
- Incident notification within 72 hours for any breach affecting your personal data (Art. 33-34 GDPR).
No system is perfectly secure. If you suspect unauthorized access to your data, contact contact@millai.eu immediately.
12. Cookies
Cookie usage is governed by our separate Cookie Policy. We use Google Consent Mode v2 and load non-essential cookies only after you consent.
13. Changes to this policy
We may update this Privacy Policy to reflect changes in law, technology, or our Service. Material changes will be communicated at least 30 days in advance by email (to subscribers) and via a banner on generatebizplan.com. Continued use of the Service after the effective date of a change constitutes acceptance of the revised policy.
Recipients, retention and transfers
Data required to operate the service may be disclosed to categories of providers responsible for hosting, result generation where applicable, delivery, customer support, security and consent-based analytics. Providers may process data only for documented purposes and under applicable contractual safeguards.
Generation content is kept for up to 24 hours, delivery records for up to 90 days and an unsubscribe email hash for up to 5 years to respect the opt-out. Other data is kept only as long as needed for security, support, legal duties or claims.
Where data is transferred outside the EEA, we use an applicable transfer mechanism and supplementary safeguards where required.
Your data protection rights
Where the GDPR applies and subject to its conditions, you may request access, rectification, erasure, restriction and portability of your data; object to processing; withdraw consent without affecting earlier lawful processing; and lodge a complaint. You also have the rights provided by law in relation to decisions based solely on automated processing that produce legal or similarly significant effects.
Right to complain
Where the GDPR applies, you may lodge a complaint with the competent supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement.
14. Contact
Mill AI - operator of GenerateBizPlan
Email: contact@millai.eu
For data protection matters, please put "PRIVACY" in the subject line so your request is routed promptly.