Back to home

Legal

Privacy Policy

This policy explains what Bizoo collects, why we collect it, how we share it, how long we keep it, and the rights and choices available to people who use Bizoo in Canada and the United States.

Last updated: October 12, 2026

On this page

Privacy summary

Bizoo is a local business discovery and community platform. People can discover businesses, create personal or business profiles, post content, message other users, request quotes, review businesses, attend events, run promotions, and use advertising or billing tools.

We collect what the product needs

We collect account, profile, content, messaging, verification, billing, advertising, support, device, security, location, and analytics information only where it supports the platform purposes described below.

Public content is visible

Public profiles, business listings, reviews, promotions, events, posts, and public interactions may be visible to other users, search engines, and anyone who visits Bizoo.

No raw card storage

Payment card processing is handled by Stripe. Bizoo stores billing records, Stripe identifiers, card brand, last four digits, and expiry metadata, but not full card numbers or security codes.

Adults only

Bizoo is for people who are 18 or older. It is not directed to children or teenagers, and we do not knowingly collect personal information from anyone under 18. See "Eligibility, transfers, and contact" below.

Canada and the United States

Bizoo is offered to people in Canada and the United States. It is not offered to, or directed at, people in the European Economic Area, the United Kingdom, or Switzerland. We extend the access, correction, and deletion rights described below to everyone who uses Bizoo, wherever they are.

No sale of personal information

Bizoo does not sell personal information for money. Advertising technology that you accept through our cookie settings (for example Google AdSense, when it is enabled) can amount to "sharing" for cross-context behavioural advertising or "targeted advertising" under some U.S. state laws. That technology is off until you turn on Marketing cookies, and you can turn it off again at any time. Bizoo also treats a Global Privacy Control (GPC) browser signal as a request to keep Marketing cookies off.

Information we collect

CategoryExamples from BizooWhy it matters
Account and authenticationEmail address, password hashes, email verification records, login attempts, sign-in provider identifiers (for example a Google account ID), session identifiers, API key prefixes and scopes, 2FA settings, trusted devices, backup-code hashes, account deletion archives, and a record of which version of our Terms and Privacy Policy you accepted, when, and how (including the IP address and browser details used at that moment), together with your confirmation that you are 18 or older. We delete these records when your account deletion is finalized.Create and secure accounts, verify email ownership, prevent unauthorized access, support account recovery, audit sensitive account events, and keep proof of the terms you agreed to.
Profiles, public sources, and preferencesPersonal and business profile names, usernames, avatars, cover images, visibility settings, notification preferences, language, currency, profile counts, location settings, optional date of birth and gender, business category and contact details. For platform-created unclaimed listings, we may collect licensed public business names, categories, public storefront addresses, exact map coordinates, websites, source identifiers, confidence values, update times, and license metadata.Show profiles, create and maintain unclaimed business listings, provide source attribution, process corrections and claims, personalize settings, and power local discovery.
Business content and marketplace activityProducts, services, promotions, events, quote requests, prices, categories, tags, business hours, social links, reviews, business replies, saved promotions, reports, and engagement counts.Operate Bizoo as a business discovery, quote, review, social, events, and promotions platform.
Verification dataRegistration numbers, tax IDs where required, legal business names, signer names and authority details, contact email and phone, uploaded documents, issuing jurisdictions, expiry dates, attestation timestamp and IP address, staff review notes.Confirm business legitimacy, signer authority, fraud prevention, platform trust, auditability, and legal compliance.
Messaging, notifications, and supportConversation membership, messages, attachments and filenames, read status, reactions, blocked users, spam reports, push notification tokens, notification settings, support requests, feedback, screenshots, and file metadata.Deliver messages and notifications, investigate abuse, handle customer service, and improve Bizoo.
Device, location, and security dataIP address, user agent, browser, operating system, device type, language, approximate location derived from IP address, device location if you choose to share it, and security signals used to detect abuse such as repeated failed logins.Security, fraud prevention, location-based discovery, and abuse prevention.
Analytics and advertising dataWith your consent: IP prefix, referrer domain, page path, public landing type, limited campaign parameters such as utm_source, utm_medium and utm_campaign, session grouping, and feature usage. For ads: impressions, clicks, conversions, cost and billing metrics, and fraud signals.Consented analytics, referral and campaign measurement, product improvement, ad delivery and measurement, and billing.

We may also collect information from users who invite or message you; from licensed public or open business datasets such as Overture Maps and public business registries; and from payment processors, sign-in providers, verification providers, infrastructure providers, analytics systems, and anti-abuse tools used to operate Bizoo. When you sign in with Google, we receive your verified email address and Google account identifier. We do not initially import business contact email, descriptions, photos, ratings, reviews, hours, or social links into platform-created listings. Businesses and affected people may ask us to correct, suppress, or remove inaccurate or inappropriate public-source information.

How we use information

  • Provide Bizoo features, including discovery, profiles, search, posts, reviews, messaging, quotes, events, promotions, ads, billing, notifications, and support.
  • Create, verify, secure, and recover accounts, including email verification, two-factor authentication, trusted-device controls, activity logs, and API key management.
  • Display public profile and business information according to the visibility choices and product settings selected by users.
  • Review business verification submissions, confirm signer authority, detect fraud or misrepresentation, and maintain an audit trail of trust and safety decisions.
  • Process advertising campaigns, ad approvals, impressions, clicks, conversions, campaign budgets, billing transactions, invoices, refunds, and performance reports.
  • Personalize discovery, language, currency, notifications, content ordering, and local relevance. We do not build advertising profiles from private messages, verification documents, or payment card data.
  • Detect spam, fake reviews, harassment, prohibited content, abuse, security incidents, and policy violations.
  • Respond to customer service, feedback, privacy requests, legal requests, disputes, tax, accounting, compliance, and regulatory obligations.
  • Develop, debug, analyze, and improve Bizoo, including privacy-conscious analytics using aggregated, de-identified, or minimized data where practical.

Sharing and service providers

  • With other Bizoo users and visitors when you publish profile information, business listings, reviews, posts, promotions, events, quote details, or other public content.
  • With message recipients and conversation members when you send messages, attachments, reactions, or quote communications.
  • With service providers that process information on our behalf, listed in the table below.
  • With verification, fraud prevention, trust and safety, legal, accounting, compliance, or professional advisers when needed to review submissions or protect the platform.
  • With public authorities, courts, law enforcement, regulators, or private parties when we believe disclosure is legally required or reasonably necessary to protect rights, safety, security, or legal claims.
  • In a business transaction such as a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. If personal information is transferred, the recipient must honour this policy or give you notice and a choice.
  • With your direction or consent, including when you connect third-party services, use Google sign-in, share links, or ask us to disclose information.

We require service providers to use personal information only to provide services to us, to protect it appropriately for its sensitivity, and not to sell it. The list reflects how Bizoo operates at the date of this policy, and we update it when providers or categories change.

Service providers we use

PurposeProvider or typeInformation involvedNotes
Hosting, content delivery, and file storageCloudflare (network proxy, CDN, and object storage) and our hosting infrastructureAll traffic to and from Bizoo, uploaded images, videos, and documentsNeeded to operate Bizoo.
Email deliveryTransactional email providerEmail address, message content for account, security, billing, and notification emailsNeeded to operate Bizoo.
PaymentsStripeBilling contact details, payment method data entered with Stripe, transaction recordsUsed only for paid features, when payments are enabled. Card numbers go to Stripe, not Bizoo.
Sign-inGoogleVerified email address and Google account identifierOnly if you choose Google sign-in.
Push notificationsExpo, Apple, and Google push servicesDevice push token, notification textOnly if you enable push notifications on the mobile app.
Error and performance monitoringSentryTechnical error data with personal identifiers removed or masked where possibleNeeded to keep Bizoo reliable.
Product analyticsPostHogPage views, feature usage, session groupingOnly if you accept Analytics cookies.
AdvertisingGoogle AdSenseCookie identifiers, IP address, page and device dataOnly when AdSense is enabled and you accept Marketing cookies.
Maps and place lookupOpenStreetMap Nominatim and licensed open datasets such as Overture MapsLocation text you type into search may be sent to turn it into coordinatesUsed for location-based search.
Business verificationStaff review; third-party verification providers if we enable themVerification documents and details described aboveToday verification is reviewed by Bizoo staff. If we enable an outside provider, we will update this policy before we do.

Ads, analytics, and cookies

Bizoo uses necessary cookies and similar storage for login, security, CSRF protection, language, and remembering your cookie choice. Functional, analytics, and marketing technologies are off by default and are used only if you turn them on in the cookie settings. With your consent, Bizoo may use analytics to understand feature usage and performance, and may use advertising technologies to measure ad impressions and clicks and to support business advertising. When Google AdSense is enabled, it loads only after you accept Marketing cookies.

  • Ad creators can target campaigns by placement, audience, location, category, budget, schedule, and bid model as supported by the ads manager.
  • Ad measurement may include page URL, placement, device type, IP address, user agent, referrer, impression, click, conversion, cost, billable status, and fraud signals. Identifying details such as IP address and user agent are removed from ad tracking records after 90 days; billing totals are kept.
  • We do not knowingly use sensitive verification documents, private messages, payment card data, or precise identity evidence to build advertising profiles.
  • Global Privacy Control: if your browser sends a Global Privacy Control signal, Bizoo treats it as a request not to use Marketing cookies, keeps them off, and does not show you personalized advertising technology. We do not respond differently to "Do Not Track" browser settings beyond that, because there is no common standard for them.
  • You can change your choices at any time in the Cookie Policy settings and through your browser settings. Clearing your browser data may reset them.
Review the Cookie Policy

Payments and billing

Billing/Payments coming soon.

Bizoo is not currently accepting online payments or collecting card details. Businesses may run ads only with non-refundable advertising credits issued by authorized Bizoo staff. Payment and cash-refund provisions apply only if a paid billing flow is later explicitly made available in the product.

Business users may maintain billing accounts for advertising and related paid features. Bizoo records balances, transactions, budgets, deposits, refunds, invoices, Stripe customer and payment identifiers, payment method brand, last four digits, expiry month and year, currency, billing status, and related metadata. Full card numbers and CVV codes are handled by Stripe and are not stored by Bizoo.

Billing records may be retained for tax, accounting, fraud prevention, dispute, refund, compliance, and audit purposes even after an account or profile is closed.

Business verification

Verification information can be more sensitive than ordinary profile data. We use it to evaluate whether a business is real, whether the submitting person can act for that business, whether documents are consistent with the requested jurisdiction and entity type, and whether the submission raises fraud, safety, legal, or compliance concerns.

  • Verification status may be approved, rejected, cancelled, expired, under review, or sent back for more information.
  • Verification does not guarantee service quality, licensing compliance, financial condition, user safety, or future business conduct.
  • Authorized staff and trusted providers may access verification files only for review, security, fraud prevention, legal compliance, support, or dispute purposes. Access to verification files is logged and monitored for unusual activity.
  • Verification records may be retained longer than ordinary profile data when needed for auditability, fraud prevention, legal claims, or compliance. Retention periods are in the table below.
Review the Verification Policy

Public areas and messages

Search and AI discovery

Eligible public business profiles, posts, events, and promotions may be crawled, indexed, linked to, cached, or summarized by search engines and AI-assisted search services. Bizoo can publish crawler preferences but cannot control how an independent third party handles content it has already accessed.

Personal profile choice

A personal profile is excluded from public search discovery by default. Search eligibility requires a public profile, substantive public activity, and the separate 'Appear in public search' setting. Making a profile public does not by itself opt it into search indexing.

Profile view insights

A profile owner can see a short list of accounts that recently viewed their profile. If you visit someone else's profile while signed in, your display name may appear in that list. Your name is withheld — the entry shows as a private viewer instead — when your profile is private and you do not follow them, when either of you has blocked the other, or when you turn off the "Appear in profile view insights" setting on your own profile. Turning that setting off does not hide the visit itself: it still counts toward that profile's total view count, without identifying you. Repeat visits within a short window count once. Bizoo never shows a viewer's IP address to the profile owner.

Catalogs and reviews

Product, service, and standalone review pages remain usable inside Bizoo but are not intended as standalone search-index entities. Public catalog and review information may still appear within an eligible business profile or other public context.

Archived public pages

Completed or cancelled events and expired or cancelled promotions may remain publicly accessible and may remain in search results for a limited configurable period so prior links and accurate status information continue to work. They are removed from active discovery sitemaps when no longer current.

Messages

Direct messages and attachments are intended for conversation participants. Messages are not end-to-end encrypted: Bizoo can technically access them and may process them to deliver the feature, detect abuse, handle reports, comply with law, or troubleshoot support issues. We do not read messages as a matter of routine.

Reviews

Reviews, helpfulness votes, spam signals, moderation decisions, and business responses may be used to protect review integrity and enforce policies against fake, misleading, or abusive reviews.

Deleted content

Deleted content may disappear from public views but can remain in backups, logs, moderation records, archived deletion records, legal holds, or dispute records for a limited period, as described under Retention.

Account deletion and recovery

When you request account deletion, Bizoo immediately removes your public account presence from normal views, signs out sessions, revokes access tokens where supported, stops ordinary notifications, disables login, and starts a 30-day recovery window. During that window, the same email address, phone number, sign-in identity, and username cannot be reused to create a new account.

AreaDeletion behavior
Recovery windowYou can cancel deletion within 30 days through the recovery flow or privacy support. After the window, ordinary account personal information is purged or anonymized unless a permitted hold applies.
Public contentPosts, comments, replies, reviews, and similar public records may become tombstoned or anonymized so conversations, ratings, and business-history context remain understandable.
MessagesMessages are removed from the deleting user's mailbox, but other participants may keep their copies. Reported, unsafe, or legally held messages may be sealed and access-limited.
Events, promotions, quotes, and transactionsEvents may be cancelled or transferred, promotions and saved promotions may be tombstoned, and quotes, invoices, redemptions, payments, refunds, disputes, and tax records remain where needed for integrity and compliance.
Unverified business profilesUnverified business profiles may be closed from profile management. We remove public visibility and then purge or anonymize ordinary profile data after the applicable workflow unless a safety, fraud, billing, dispute, legal, or backup-retention reason applies.
Verified business profilesVerified business deletion requires review. Public contact details can be removed, but verification decisions, business identity history, reviews, transactions, disputes, chargebacks, and fraud signals may be retained where permitted.
BackupsDeleted data may remain in backups until they expire, which takes up to 180 days. If backup data is restored, deletion jobs are re-applied before the restored data is used.
  • Profile closure is different from account deletion: the required personal profile stays active unless the account itself is deleted, while eligible business profiles can request closure from profile management.
  • Deletion may pause only for the minimum records needed for legal holds, law-enforcement preservation, child-safety obligations, safety investigations, fraud prevention, billing, tax, disputes, security compromise, or verified-business review.
  • For fraud prevention, Bizoo may keep normalized HMAC hashes of identifiers such as email, phone, sign-in subject, business registration number, tax ID, legal name, address, domain, or verification signer instead of retaining raw values.
  • If we detect signs that a deletion request may come from a compromised account, we may place a security hold, notify current and prior contact channels where practical, and require identity verification before recovery.
  • You can contact privacy support to appeal, recover during the grace window, ask about a hold, or request access, correction, deletion, or another privacy right.

Retention

We keep information only as long as reasonably necessary for the purposes in this policy, including service delivery, account integrity, safety, fraud prevention, billing, tax, audit, support, legal compliance, disputes, backups, and enforcement. When a purpose ends, we delete or anonymize the information, or, where that is not practical, keep it securely and do not use it until deletion is possible. These are our default periods; a legal hold, active abuse or fraud case, dispute, or legal requirement can lengthen them.

Record typeDefault retention
Active account, profile, listing, and content recordsWhile the account or profile is active. Deleted accounts follow the Account deletion section.
Account recovery snapshot30 days after a deletion request, then purged or anonymized unless held.
BackupsUp to 180 days (daily 7 days, weekly 28 days, monthly 180 days).
MessagesUntil a participant deletes them or their account is deleted. We do not automatically expire messages.
Notifications30 days.
Login attempt records90 days.
Account activity and security audit logs90 days to 12 months depending on the log; longer only for active abuse, fraud, safety, or legal cases.
Profile view and post viewer records90 days. Aggregate view counts are kept.
Ad tracking recordsIdentifying details (IP address, user agent) removed after 90 days. Billing totals are kept under the billing schedule.
Consented analytics events13 months.
Privacy request logs3 years, minimized to proof of compliance and response history.
Billing, tax, and payment ledger7 years or the legally required period, with payment tokens detached where practical.
Verification documents (current process)2 years after closure or revocation unless a law, fraud, dispute, or safety hold applies.
Verification documents (ownership claims and transfers)Approved cases 90 days after approval, rejected cases 365 days after rejection, abandoned cases 30 days. The case record and audit trail remain.
Derived business identity hashes and verification decisions7 years after closure by default, longer only for confirmed fraud, legal hold, or required compliance.
Moderation and abuse records2 years by default; severe safety, child-safety, law-enforcement, or litigation records follow the legal hold process.

Staff access to deletion, verification, legal, safety, and fraud records is role-based, logged, and limited to authorized work. Sensitive actions such as legal-hold release, verified-business transfer, fraud override, early purge, or high-risk account restoration need independent approval by a second authorized staff member whenever more than one is available; otherwise they are recorded with a reason and reviewed afterwards.

Security and incidents

We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization.

  • Encryption in transit (HTTPS) for traffic to Bizoo.
  • Passwords are stored only as salted hashes. Two-factor authentication, trusted-device controls, session management, and sign-in and password-change alerts are available.
  • Protections against automated and abusive access, including login lockouts, rate limits, and request-origin checks.
  • Role-based staff access with audit logging, extra confirmation for sensitive staff actions, and monitoring of access to verification documents.
  • Payment card data is handled by Stripe and is not stored by Bizoo.

If something goes wrong

Bizoo keeps a written incident-response procedure and a register of privacy and security incidents, including those that did not require notice. If an incident involving personal information creates a real risk of significant harm (the Canadian federal standard), a risk of serious injury (the Quebec standard), or otherwise triggers a U.S. state breach-notification law, we will notify the people affected and the regulators the law requires, as soon as feasible. Our notices explain what happened, what information was involved, what we are doing about it, what you can do to protect yourself, and how to contact us. We keep breach records for at least 24 months.

Your privacy rights and choices

Wherever you live, you can ask us for access to the personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you gave. You can download a copy of your data from account settings, and you can delete your account from account settings. Depending on where you live you may also have the rights below.

Rights by region

Canada (PIPEDA and provincial laws)

Access to your personal information and to information about how we use and disclose it; correction of inaccurate information; withdrawal of consent, subject to legal and contractual restrictions and reasonable notice; and the right to complain to us and to the Office of the Privacy Commissioner of Canada or your provincial regulator.

Quebec

In addition: the right to receive your computerized personal information in a structured, commonly used technological format, and to ask us to share it with another organization you name; the right to ask us to stop disseminating, or to de-index, personal information where the law allows; the right to be told when a decision is made exclusively by automated processing, to learn the principal factors, and to have a person review it; and the right to complain to the Commission d'accès à l'information du Québec. Bizoo's Privacy Officer is named below.

California and other U.S. states

Depending on your state: the right to know and access, correct, delete, and obtain a portable copy of your personal information; to opt out of sale, of sharing for cross-context behavioural advertising, of targeted advertising, and of profiling; to limit certain uses of sensitive personal information; and to not be discriminated against for using your rights. Several states, including California, Colorado, Connecticut, and Texas, also require us to honour opt-out preference signals such as Global Privacy Control, which we do.

California categories and disclosures

In the past 12 months we collected the categories described under "Information we collect": identifiers; personal records such as name, address, and phone; commercial information such as transactions; internet and network activity; geolocation; photos and files; professional information about businesses; and inferences used for relevance and personalization. We also process sensitive personal information: account log-in credentials, government and tax identifiers inside verification documents, device location if you share it, and message contents. We use sensitive personal information only to provide Bizoo, secure it, and run verification, not to infer characteristics about you, so there is no separate right to limit. We disclose personal information to the service providers and recipients listed above, and, only if you turn on Marketing cookies, identifiers and internet activity to advertising technology providers. We do not sell personal information, including that of people under 18, and we offer no financial incentives for personal information.

  • Use account and profile settings to update many profile, visibility, notification, cookie, and preference choices.
  • Some information cannot be deleted immediately where we need it for security, fraud prevention, billing, legal compliance, disputes, backups, or another legitimate purpose. When we decline part of a request, we tell you why.
  • Marketing email can be stopped through unsubscribe links, in account settings, or by contacting support. Transactional, security, account, and service messages may continue where necessary.
  • We will not discriminate against you for exercising rights required by applicable privacy law.

How to make a request

  • Email us at the address below with "Privacy Request" in the subject and tell us what you want. You can also use the self-service export and deletion tools in account settings.
  • We may need to confirm that you are the account holder, for example by asking you to respond from your account email or sign in. We ask only for what we need to confirm identity and do not use it for anything else.
  • An authorized agent can make a request for you with your written permission; we may check directly with you.
  • We respond within 30 days in Canada and within 45 days in the United States. If we need more time, we tell you why before the period ends, and for U.S. requests we may extend by a further 45 days.
  • If you live in a U.S. state that gives you the right to appeal and we decline your request, reply to our decision within 60 days with "Privacy Appeal" in the subject. We answer within 45 days. If we deny your appeal, you can contact your state attorney general.

Send privacy requests to support@bizoo.co.

Questions and complaints

If you have a question or a concern about how Bizoo handles personal information, tell us first. We will acknowledge your complaint within 5 business days, investigate it, and reply with our findings, and with any changes we make, within 30 days. Complaints are reviewed by a person who was not involved in the decision you are complaining about wherever that is possible.

Canada

You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you live in Quebec, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca); in Alberta or British Columbia, to that province's Information and Privacy Commissioner.

United States

You can contact your state attorney general or consumer protection office, and the U.S. Federal Trade Commission (reportfraud.ftc.gov). In California you can also contact the California Privacy Protection Agency (cppa.ca.gov).

Eligibility, transfers, changes, and contact

Eligibility and children

You must be at least 18 years old to create a Bizoo account or use Bizoo while signed in. Bizoo is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We ask you to confirm your age when you sign up and we do not accept a date of birth that shows you are under 18. If we learn that an account belongs to someone under 18, we close it and delete the personal information, except where the law requires us to keep something. If you believe a person under 18 is using Bizoo, tell us at the address below.

Where your information is processed

Bizoo and its service providers may process and store information in Canada, the United States, and other countries where our service providers operate. Laws in those places may differ from the laws where you live, and courts and authorities there may be able to access the information. Before we use a provider outside your province or state for personal information, we assess the sensitivity of the information, the purpose, the protections in place, and the legal regime in the destination, and we require contractual protections from the provider.

Availability

Bizoo is offered to people in Canada and the United States and is not directed to people in the European Economic Area, the United Kingdom, or Switzerland. If you are elsewhere and use Bizoo, we handle your information under this policy and give you the access, correction, and deletion rights above.

Privacy Officer

Bizoo's Chief Executive Officer serves as Privacy Officer and is responsible for Bizoo's compliance with applicable privacy laws, including Quebec's Act respecting the protection of personal information in the private sector. Contact Bizoo's Privacy Officer with any question, concern, or complaint about how we handle personal information at support@bizoo.co.

We may update this Privacy Policy as Bizoo changes or as laws, providers, or features evolve. We post the new version on this page with its date. For material changes, we also tell you by email or in the app before they take effect, and where the law requires your consent to a new use, we ask for it.

Questions or requests can be sent to support@bizoo.co. For terms that govern use of the platform, see the Terms of Use.