Privacy summary
Bizoo is a local business discovery and community platform. People can discover businesses, create personal or business profiles, post content, message other users, request quotes, review businesses, attend events, run promotions, and use advertising or billing tools.
We collect what the product needs
Public content is visible
No raw card storage
Adults only
Canada and the United States
No sale of personal information
Information we collect
| Category | Examples from Bizoo | Why it matters |
|---|---|---|
| Account and authentication | Email address, password hashes, email verification records, login attempts, sign-in provider identifiers (for example a Google account ID), session identifiers, API key prefixes and scopes, 2FA settings, trusted devices, backup-code hashes, account deletion archives, and a record of which version of our Terms and Privacy Policy you accepted, when, and how (including the IP address and browser details used at that moment), together with your confirmation that you are 18 or older. We delete these records when your account deletion is finalized. | Create and secure accounts, verify email ownership, prevent unauthorized access, support account recovery, audit sensitive account events, and keep proof of the terms you agreed to. |
| Profiles, public sources, and preferences | Personal and business profile names, usernames, avatars, cover images, visibility settings, notification preferences, language, currency, profile counts, location settings, optional date of birth and gender, business category and contact details. For platform-created unclaimed listings, we may collect licensed public business names, categories, public storefront addresses, exact map coordinates, websites, source identifiers, confidence values, update times, and license metadata. | Show profiles, create and maintain unclaimed business listings, provide source attribution, process corrections and claims, personalize settings, and power local discovery. |
| Business content and marketplace activity | Products, services, promotions, events, quote requests, prices, categories, tags, business hours, social links, reviews, business replies, saved promotions, reports, and engagement counts. | Operate Bizoo as a business discovery, quote, review, social, events, and promotions platform. |
| Verification data | Registration numbers, tax IDs where required, legal business names, signer names and authority details, contact email and phone, uploaded documents, issuing jurisdictions, expiry dates, attestation timestamp and IP address, staff review notes. | Confirm business legitimacy, signer authority, fraud prevention, platform trust, auditability, and legal compliance. |
| Messaging, notifications, and support | Conversation membership, messages, attachments and filenames, read status, reactions, blocked users, spam reports, push notification tokens, notification settings, support requests, feedback, screenshots, and file metadata. | Deliver messages and notifications, investigate abuse, handle customer service, and improve Bizoo. |
| Device, location, and security data | IP address, user agent, browser, operating system, device type, language, approximate location derived from IP address, device location if you choose to share it, and security signals used to detect abuse such as repeated failed logins. | Security, fraud prevention, location-based discovery, and abuse prevention. |
| Analytics and advertising data | With your consent: IP prefix, referrer domain, page path, public landing type, limited campaign parameters such as utm_source, utm_medium and utm_campaign, session grouping, and feature usage. For ads: impressions, clicks, conversions, cost and billing metrics, and fraud signals. | Consented analytics, referral and campaign measurement, product improvement, ad delivery and measurement, and billing. |
We may also collect information from users who invite or message you; from licensed public or open business datasets such as Overture Maps and public business registries; and from payment processors, sign-in providers, verification providers, infrastructure providers, analytics systems, and anti-abuse tools used to operate Bizoo. When you sign in with Google, we receive your verified email address and Google account identifier. We do not initially import business contact email, descriptions, photos, ratings, reviews, hours, or social links into platform-created listings. Businesses and affected people may ask us to correct, suppress, or remove inaccurate or inappropriate public-source information.
How we use information
- Provide Bizoo features, including discovery, profiles, search, posts, reviews, messaging, quotes, events, promotions, ads, billing, notifications, and support.
- Create, verify, secure, and recover accounts, including email verification, two-factor authentication, trusted-device controls, activity logs, and API key management.
- Display public profile and business information according to the visibility choices and product settings selected by users.
- Review business verification submissions, confirm signer authority, detect fraud or misrepresentation, and maintain an audit trail of trust and safety decisions.
- Process advertising campaigns, ad approvals, impressions, clicks, conversions, campaign budgets, billing transactions, invoices, refunds, and performance reports.
- Personalize discovery, language, currency, notifications, content ordering, and local relevance. We do not build advertising profiles from private messages, verification documents, or payment card data.
- Detect spam, fake reviews, harassment, prohibited content, abuse, security incidents, and policy violations.
- Respond to customer service, feedback, privacy requests, legal requests, disputes, tax, accounting, compliance, and regulatory obligations.
- Develop, debug, analyze, and improve Bizoo, including privacy-conscious analytics using aggregated, de-identified, or minimized data where practical.
Consent and choices
We process personal information only for the purposes in this policy. Depending on the situation, we rely on your consent, on what is necessary to provide a service you asked for, on our legitimate business purposes, or on legal obligations. We collect only what we need for those purposes.
Product necessity
Some information is required to provide the service you request, such as account credentials, profile data, message delivery, quote requests, billing records, and security logs. If you do not provide it, we cannot offer that part of Bizoo.
Opt-in choices
These are off until you turn them on: analytics cookies, marketing cookies, marketing email, device location, and push notifications (which also need your device's permission). Optional profile fields, public visibility choices, and verification attestations are likewise your choice.
Legal and safety obligations
We may process or preserve information to comply with law, respond to lawful requests, protect rights, prevent fraud, enforce policies, and keep records required for audits, taxes, payments, or disputes.
Withdrawing consent
You can change your cookie, notification, privacy, and marketing settings at any time. Withdrawing consent does not affect processing that already happened and may limit features that depend on that data, such as optional cookies, location-based discovery, or verification.
Marketing consent and commercial email
Sharing and service providers
- With other Bizoo users and visitors when you publish profile information, business listings, reviews, posts, promotions, events, quote details, or other public content.
- With message recipients and conversation members when you send messages, attachments, reactions, or quote communications.
- With service providers that process information on our behalf, listed in the table below.
- With verification, fraud prevention, trust and safety, legal, accounting, compliance, or professional advisers when needed to review submissions or protect the platform.
- With public authorities, courts, law enforcement, regulators, or private parties when we believe disclosure is legally required or reasonably necessary to protect rights, safety, security, or legal claims.
- In a business transaction such as a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. If personal information is transferred, the recipient must honour this policy or give you notice and a choice.
- With your direction or consent, including when you connect third-party services, use Google sign-in, share links, or ask us to disclose information.
We require service providers to use personal information only to provide services to us, to protect it appropriately for its sensitivity, and not to sell it. The list reflects how Bizoo operates at the date of this policy, and we update it when providers or categories change.
Service providers we use
| Purpose | Provider or type | Information involved | Notes |
|---|---|---|---|
| Hosting, content delivery, and file storage | Cloudflare (network proxy, CDN, and object storage) and our hosting infrastructure | All traffic to and from Bizoo, uploaded images, videos, and documents | Needed to operate Bizoo. |
| Email delivery | Transactional email provider | Email address, message content for account, security, billing, and notification emails | Needed to operate Bizoo. |
| Payments | Stripe | Billing contact details, payment method data entered with Stripe, transaction records | Used only for paid features, when payments are enabled. Card numbers go to Stripe, not Bizoo. |
| Sign-in | Verified email address and Google account identifier | Only if you choose Google sign-in. | |
| Push notifications | Expo, Apple, and Google push services | Device push token, notification text | Only if you enable push notifications on the mobile app. |
| Error and performance monitoring | Sentry | Technical error data with personal identifiers removed or masked where possible | Needed to keep Bizoo reliable. |
| Product analytics | PostHog | Page views, feature usage, session grouping | Only if you accept Analytics cookies. |
| Advertising | Google AdSense | Cookie identifiers, IP address, page and device data | Only when AdSense is enabled and you accept Marketing cookies. |
| Maps and place lookup | OpenStreetMap Nominatim and licensed open datasets such as Overture Maps | Location text you type into search may be sent to turn it into coordinates | Used for location-based search. |
| Business verification | Staff review; third-party verification providers if we enable them | Verification documents and details described above | Today verification is reviewed by Bizoo staff. If we enable an outside provider, we will update this policy before we do. |
Ads, analytics, and cookies
Bizoo uses necessary cookies and similar storage for login, security, CSRF protection, language, and remembering your cookie choice. Functional, analytics, and marketing technologies are off by default and are used only if you turn them on in the cookie settings. With your consent, Bizoo may use analytics to understand feature usage and performance, and may use advertising technologies to measure ad impressions and clicks and to support business advertising. When Google AdSense is enabled, it loads only after you accept Marketing cookies.
- Ad creators can target campaigns by placement, audience, location, category, budget, schedule, and bid model as supported by the ads manager.
- Ad measurement may include page URL, placement, device type, IP address, user agent, referrer, impression, click, conversion, cost, billable status, and fraud signals. Identifying details such as IP address and user agent are removed from ad tracking records after 90 days; billing totals are kept.
- We do not knowingly use sensitive verification documents, private messages, payment card data, or precise identity evidence to build advertising profiles.
- Global Privacy Control: if your browser sends a Global Privacy Control signal, Bizoo treats it as a request not to use Marketing cookies, keeps them off, and does not show you personalized advertising technology. We do not respond differently to "Do Not Track" browser settings beyond that, because there is no common standard for them.
- You can change your choices at any time in the Cookie Policy settings and through your browser settings. Clearing your browser data may reset them.
Payments and billing
Billing/Payments coming soon.
Business users may maintain billing accounts for advertising and related paid features. Bizoo records balances, transactions, budgets, deposits, refunds, invoices, Stripe customer and payment identifiers, payment method brand, last four digits, expiry month and year, currency, billing status, and related metadata. Full card numbers and CVV codes are handled by Stripe and are not stored by Bizoo.
Billing records may be retained for tax, accounting, fraud prevention, dispute, refund, compliance, and audit purposes even after an account or profile is closed.
Business verification
Verification information can be more sensitive than ordinary profile data. We use it to evaluate whether a business is real, whether the submitting person can act for that business, whether documents are consistent with the requested jurisdiction and entity type, and whether the submission raises fraud, safety, legal, or compliance concerns.
- Verification status may be approved, rejected, cancelled, expired, under review, or sent back for more information.
- Verification does not guarantee service quality, licensing compliance, financial condition, user safety, or future business conduct.
- Authorized staff and trusted providers may access verification files only for review, security, fraud prevention, legal compliance, support, or dispute purposes. Access to verification files is logged and monitored for unusual activity.
- Verification records may be retained longer than ordinary profile data when needed for auditability, fraud prevention, legal claims, or compliance. Retention periods are in the table below.
Public areas and messages
Search and AI discovery
Eligible public business profiles, posts, events, and promotions may be crawled, indexed, linked to, cached, or summarized by search engines and AI-assisted search services. Bizoo can publish crawler preferences but cannot control how an independent third party handles content it has already accessed.
Personal profile choice
A personal profile is excluded from public search discovery by default. Search eligibility requires a public profile, substantive public activity, and the separate 'Appear in public search' setting. Making a profile public does not by itself opt it into search indexing.
Profile view insights
A profile owner can see a short list of accounts that recently viewed their profile. If you visit someone else's profile while signed in, your display name may appear in that list. Your name is withheld — the entry shows as a private viewer instead — when your profile is private and you do not follow them, when either of you has blocked the other, or when you turn off the "Appear in profile view insights" setting on your own profile. Turning that setting off does not hide the visit itself: it still counts toward that profile's total view count, without identifying you. Repeat visits within a short window count once. Bizoo never shows a viewer's IP address to the profile owner.
Catalogs and reviews
Product, service, and standalone review pages remain usable inside Bizoo but are not intended as standalone search-index entities. Public catalog and review information may still appear within an eligible business profile or other public context.
Archived public pages
Completed or cancelled events and expired or cancelled promotions may remain publicly accessible and may remain in search results for a limited configurable period so prior links and accurate status information continue to work. They are removed from active discovery sitemaps when no longer current.
Messages
Direct messages and attachments are intended for conversation participants. Messages are not end-to-end encrypted: Bizoo can technically access them and may process them to deliver the feature, detect abuse, handle reports, comply with law, or troubleshoot support issues. We do not read messages as a matter of routine.
Reviews
Reviews, helpfulness votes, spam signals, moderation decisions, and business responses may be used to protect review integrity and enforce policies against fake, misleading, or abusive reviews.
Deleted content
Deleted content may disappear from public views but can remain in backups, logs, moderation records, archived deletion records, legal holds, or dispute records for a limited period, as described under Retention.
Account deletion and recovery
When you request account deletion, Bizoo immediately removes your public account presence from normal views, signs out sessions, revokes access tokens where supported, stops ordinary notifications, disables login, and starts a 30-day recovery window. During that window, the same email address, phone number, sign-in identity, and username cannot be reused to create a new account.
| Area | Deletion behavior |
|---|---|
| Recovery window | You can cancel deletion within 30 days through the recovery flow or privacy support. After the window, ordinary account personal information is purged or anonymized unless a permitted hold applies. |
| Public content | Posts, comments, replies, reviews, and similar public records may become tombstoned or anonymized so conversations, ratings, and business-history context remain understandable. |
| Messages | Messages are removed from the deleting user's mailbox, but other participants may keep their copies. Reported, unsafe, or legally held messages may be sealed and access-limited. |
| Events, promotions, quotes, and transactions | Events may be cancelled or transferred, promotions and saved promotions may be tombstoned, and quotes, invoices, redemptions, payments, refunds, disputes, and tax records remain where needed for integrity and compliance. |
| Unverified business profiles | Unverified business profiles may be closed from profile management. We remove public visibility and then purge or anonymize ordinary profile data after the applicable workflow unless a safety, fraud, billing, dispute, legal, or backup-retention reason applies. |
| Verified business profiles | Verified business deletion requires review. Public contact details can be removed, but verification decisions, business identity history, reviews, transactions, disputes, chargebacks, and fraud signals may be retained where permitted. |
| Backups | Deleted data may remain in backups until they expire, which takes up to 180 days. If backup data is restored, deletion jobs are re-applied before the restored data is used. |
- Profile closure is different from account deletion: the required personal profile stays active unless the account itself is deleted, while eligible business profiles can request closure from profile management.
- Deletion may pause only for the minimum records needed for legal holds, law-enforcement preservation, child-safety obligations, safety investigations, fraud prevention, billing, tax, disputes, security compromise, or verified-business review.
- For fraud prevention, Bizoo may keep normalized HMAC hashes of identifiers such as email, phone, sign-in subject, business registration number, tax ID, legal name, address, domain, or verification signer instead of retaining raw values.
- If we detect signs that a deletion request may come from a compromised account, we may place a security hold, notify current and prior contact channels where practical, and require identity verification before recovery.
- You can contact privacy support to appeal, recover during the grace window, ask about a hold, or request access, correction, deletion, or another privacy right.
Retention
We keep information only as long as reasonably necessary for the purposes in this policy, including service delivery, account integrity, safety, fraud prevention, billing, tax, audit, support, legal compliance, disputes, backups, and enforcement. When a purpose ends, we delete or anonymize the information, or, where that is not practical, keep it securely and do not use it until deletion is possible. These are our default periods; a legal hold, active abuse or fraud case, dispute, or legal requirement can lengthen them.
| Record type | Default retention |
|---|---|
| Active account, profile, listing, and content records | While the account or profile is active. Deleted accounts follow the Account deletion section. |
| Account recovery snapshot | 30 days after a deletion request, then purged or anonymized unless held. |
| Backups | Up to 180 days (daily 7 days, weekly 28 days, monthly 180 days). |
| Messages | Until a participant deletes them or their account is deleted. We do not automatically expire messages. |
| Notifications | 30 days. |
| Login attempt records | 90 days. |
| Account activity and security audit logs | 90 days to 12 months depending on the log; longer only for active abuse, fraud, safety, or legal cases. |
| Profile view and post viewer records | 90 days. Aggregate view counts are kept. |
| Ad tracking records | Identifying details (IP address, user agent) removed after 90 days. Billing totals are kept under the billing schedule. |
| Consented analytics events | 13 months. |
| Privacy request logs | 3 years, minimized to proof of compliance and response history. |
| Billing, tax, and payment ledger | 7 years or the legally required period, with payment tokens detached where practical. |
| Verification documents (current process) | 2 years after closure or revocation unless a law, fraud, dispute, or safety hold applies. |
| Verification documents (ownership claims and transfers) | Approved cases 90 days after approval, rejected cases 365 days after rejection, abandoned cases 30 days. The case record and audit trail remain. |
| Derived business identity hashes and verification decisions | 7 years after closure by default, longer only for confirmed fraud, legal hold, or required compliance. |
| Moderation and abuse records | 2 years by default; severe safety, child-safety, law-enforcement, or litigation records follow the legal hold process. |
Staff access to deletion, verification, legal, safety, and fraud records is role-based, logged, and limited to authorized work. Sensitive actions such as legal-hold release, verified-business transfer, fraud override, early purge, or high-risk account restoration need independent approval by a second authorized staff member whenever more than one is available; otherwise they are recorded with a reason and reviewed afterwards.
Security and incidents
We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization.
- Encryption in transit (HTTPS) for traffic to Bizoo.
- Passwords are stored only as salted hashes. Two-factor authentication, trusted-device controls, session management, and sign-in and password-change alerts are available.
- Protections against automated and abusive access, including login lockouts, rate limits, and request-origin checks.
- Role-based staff access with audit logging, extra confirmation for sensitive staff actions, and monitoring of access to verification documents.
- Payment card data is handled by Stripe and is not stored by Bizoo.
If something goes wrong
Your privacy rights and choices
Wherever you live, you can ask us for access to the personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you gave. You can download a copy of your data from account settings, and you can delete your account from account settings. Depending on where you live you may also have the rights below.
Rights by region
Canada (PIPEDA and provincial laws)
Access to your personal information and to information about how we use and disclose it; correction of inaccurate information; withdrawal of consent, subject to legal and contractual restrictions and reasonable notice; and the right to complain to us and to the Office of the Privacy Commissioner of Canada or your provincial regulator.
Quebec
In addition: the right to receive your computerized personal information in a structured, commonly used technological format, and to ask us to share it with another organization you name; the right to ask us to stop disseminating, or to de-index, personal information where the law allows; the right to be told when a decision is made exclusively by automated processing, to learn the principal factors, and to have a person review it; and the right to complain to the Commission d'accès à l'information du Québec. Bizoo's Privacy Officer is named below.
California and other U.S. states
Depending on your state: the right to know and access, correct, delete, and obtain a portable copy of your personal information; to opt out of sale, of sharing for cross-context behavioural advertising, of targeted advertising, and of profiling; to limit certain uses of sensitive personal information; and to not be discriminated against for using your rights. Several states, including California, Colorado, Connecticut, and Texas, also require us to honour opt-out preference signals such as Global Privacy Control, which we do.
California categories and disclosures
In the past 12 months we collected the categories described under "Information we collect": identifiers; personal records such as name, address, and phone; commercial information such as transactions; internet and network activity; geolocation; photos and files; professional information about businesses; and inferences used for relevance and personalization. We also process sensitive personal information: account log-in credentials, government and tax identifiers inside verification documents, device location if you share it, and message contents. We use sensitive personal information only to provide Bizoo, secure it, and run verification, not to infer characteristics about you, so there is no separate right to limit. We disclose personal information to the service providers and recipients listed above, and, only if you turn on Marketing cookies, identifiers and internet activity to advertising technology providers. We do not sell personal information, including that of people under 18, and we offer no financial incentives for personal information.
- Use account and profile settings to update many profile, visibility, notification, cookie, and preference choices.
- Some information cannot be deleted immediately where we need it for security, fraud prevention, billing, legal compliance, disputes, backups, or another legitimate purpose. When we decline part of a request, we tell you why.
- Marketing email can be stopped through unsubscribe links, in account settings, or by contacting support. Transactional, security, account, and service messages may continue where necessary.
- We will not discriminate against you for exercising rights required by applicable privacy law.
How to make a request
- Email us at the address below with "Privacy Request" in the subject and tell us what you want. You can also use the self-service export and deletion tools in account settings.
- We may need to confirm that you are the account holder, for example by asking you to respond from your account email or sign in. We ask only for what we need to confirm identity and do not use it for anything else.
- An authorized agent can make a request for you with your written permission; we may check directly with you.
- We respond within 30 days in Canada and within 45 days in the United States. If we need more time, we tell you why before the period ends, and for U.S. requests we may extend by a further 45 days.
- If you live in a U.S. state that gives you the right to appeal and we decline your request, reply to our decision within 60 days with "Privacy Appeal" in the subject. We answer within 45 days. If we deny your appeal, you can contact your state attorney general.
Send privacy requests to support@bizoo.co.
Questions and complaints
If you have a question or a concern about how Bizoo handles personal information, tell us first. We will acknowledge your complaint within 5 business days, investigate it, and reply with our findings, and with any changes we make, within 30 days. Complaints are reviewed by a person who was not involved in the decision you are complaining about wherever that is possible.
Canada
You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you live in Quebec, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca); in Alberta or British Columbia, to that province's Information and Privacy Commissioner.
United States
You can contact your state attorney general or consumer protection office, and the U.S. Federal Trade Commission (reportfraud.ftc.gov). In California you can also contact the California Privacy Protection Agency (cppa.ca.gov).
Eligibility, transfers, changes, and contact
Eligibility and children
Where your information is processed
Availability
Privacy Officer
We may update this Privacy Policy as Bizoo changes or as laws, providers, or features evolve. We post the new version on this page with its date. For material changes, we also tell you by email or in the app before they take effect, and where the law requires your consent to a new use, we ask for it.
Questions or requests can be sent to support@bizoo.co. For terms that govern use of the platform, see the Terms of Use.