Feezible

Users retain full ownership of the content and inputs they submit; BTG explicitly disclaims ownership and takes only a limited service-operation license. This is a clearly user-favorable position.

Users may freely use, copy, modify, and share the outputs and exports for their business, including in client proposals, and outputs already exported remain usable after the plan ends. BTG retains rights only in its own Model Engine, templates, and branding, granting a perpetual license to use them within outputs.

The documents state repeatedly and unambiguously that user data is never used to train, fine-tune, or improve any AI or ML model, and that Feezible does not use AI at all. The vendor commits to updating the policy before introducing any AI feature.

The Privacy Policy provides a detailed retention schedule with concrete timeframes (usage events 90 days, rate-limit IP records 24 hours, billing up to 7 years, backups ~90 days) and a 30-day deletion window after a verified account-deletion request. Users can delete individual items in-app immediately. No formal security audit-log retention obligation (e.g., SOC 2) is claimed, consistent with the vendor holding no such certification.

Data is explicitly never sold or rented, and sharing is limited to a named, purpose-specific list of service providers (Supabase, Stripe, Doteasy, IPinfo, Google Fonts) plus a user's own Firm Workspace and legally required disclosures. The sub-processor list includes purpose, data categories, and location, which is strong transparency.

Users can unsubscribe from marketing/launch emails, delete individual items or their whole account, and the vendor honors Global Privacy Control signals where legally required. Because there is no sale, targeted advertising, or AI training, the policy states there is nothing further to opt out of, which is a positive posture rather than a denial of rights.

BTG explicitly states it holds no independent security certification such as SOC 2 or ISO 27001 and does not claim one, instead relying on certified infrastructure providers (Stripe PCI DSS Level 1, Supabase SOC 2 Type II). It claims alignment with applicable privacy laws (CCPA/CPRA, other state laws, NJ Data Privacy Act, GDPR/UK GDPR, CAN-SPAM) without third-party attestation. The candid denial of certifications and claimed-only privacy alignment place this at moderate risk.

Because the engine is deterministic rather than AI-based, the vendor provides strong transparency: documented formulas in a user guide, a math validation export showing calculation steps on paid plans, and versioning of the engine with a revisions log. No automated decisions with legal effect are made about users.

The Privacy Policy discloses concrete controls: encryption in transit (HTTPS/HSTS) and at rest, database row-level security, salted-hash passwords, private storage buckets, rate limiting, CSP and browser security headers, and a security vulnerability reporting channel. The vendor states no data breach has occurred to date. There is no independent security certification (see Category 7), and no pen-test or bug bounty program is described.

The Privacy Policy states that the same privacy protections apply on every plan (Free, Pro, Lifetime Pro, Firm), with differences being purely functional (e.g., Free plans cannot save/export and keep inputs in-browser only). No tier is used for advertising or AI training, so there is no material data-handling penalty for using the free tier.

BTG states its staff do not read the contents of user scenarios, calibration records, or branding except at the user's request, during security/abuse/Terms investigations, or when legally required. The admin console explicitly does not display saved scenario contents, which is a strong access-limitation commitment.

The policy commits to disclosing data to authorities only when legally required, reviewing each request for legal sufficiency, notifying affected users where permitted, and disclosing only what is required. It states no government request for user data has been received to date. Note the Terms impose mandatory individual arbitration and a class-action waiver, which shapes user litigation options (see the arbitration provisions in the Terms).

Collection is limited and purpose-bound: account details, project/scenario inputs, billing status (card data goes directly to Stripe), coarse city/region/country location, and short-lived IP-based rate-limit records. The vendor explicitly asks users NOT to submit sensitive personal information and states it does not collect SPI for inferring characteristics. IP addresses are collected but not stored alongside usage events, and precise geolocation is disclaimed.

Both documents carry an effective and last-updated date of September 21, 2026 — the same as the analysis date, so they are fully current. The policy coverage matches the shipped product surface: the marketing describes fee validation, sheet count, and staffing outputs from fixed inputs, and both documents accurately describe a deterministic, non-AI model engine with named third-party providers (Stripe, Supabase). The policy also pre-commits to updating before any AI feature launches, closing the AI-coverage gap.

Two documents (Terms of Service and Privacy Policy) were supplied and are internally consistent with each other on ownership, no-sale, no-AI-training, retention, and deletion. They were evidently drafted together, include a defined order of precedence for privacy conflicts, and a Quick Reference table cross-maps claims between them. No contradictions were found.