Privacy Policy | BizzyBot

This explains how BizzyBot LLC (“BizzyBot,” “we,” “us”) collects, uses, and shares personal information when you use the Service.

1. Information we collect. You provide: account info (first name, email, and a salted-hashed password), the business-plan content you enter (idea, notes, names, entity/state selections, cost estimates, journal entries), and, if you buy a plan, limited payment details via our payment processor (we don't store full card numbers). Only if you accept our privacy banner, we collect basic usage and device events in our own system to understand which pages and features help people. These events can connect a homepage visit to a trial, an account and verified payment or subscription activity. We do not record your screen or session replay. We store your progress in your browser. If you use the survey features, form links or Bookings, the people you invite or send a link to may submit responses or book appointments through the Service; see Information about your customers below. We don't want sensitive data (health, biometric, precise location, race, religion, sexual orientation, citizenship): please don't enter it or collect it from respondents. One exception: the optional team map lets your team save work locations, including a home or base address a teammate chooses to share, so crews can plan jobs and travel. Enter only what your team is comfortable sharing (a city or ZIP works fine). Map locations can be edited or deleted at any time, and a teammate's home pin is removed when they leave the team or delete their account. Team owners and admins may also keep an employee record for each teammate, which can include up to two emergency contacts (a name, relationship, phone, and email entered by the teammate or an admin), an hourly wage or a salary if one is recorded, and, if someone is deactivated, a short reason. Enter emergency contact details only with that person's knowledge. The record is visible to the team's owner and admins, except pay, which is visible only to the owner, lead admins, and admins the owner designates. The record is included in that teammate's data export, and is deleted with their team membership or account.

QuickBooks Online connection. If a workspace owner connects QuickBooks Online, we access the company name, customer names and email addresses, and invoice identifiers, dates, totals, balances and currency to show them to authorized workspace owners in BizzyBot. Owners can also prepare a private invoice draft for saved work, select a QuickBooks customer and product or service, and explicitly confirm creation of a non-taxable USD invoice for a US QuickBooks company. Taxable or more complex invoices must be completed in QuickBooks. QuickBooks may automatically email a newly created invoice according to the company settings; the owner is asked to acknowledge that possibility before creation. Sending an invoice from BizzyBot requires a separate confirmation of the recipient email. BizzyBot does not process the customer payment or determine accounting or tax treatment. We store company identification, connection timestamps and encrypted access and refresh tokens on our server. Customer, product or service, and invoice lists are fetched when requested and held temporarily in browser memory. Unpublished invoice drafts stay in the current tab and are not saved in shared workspace progress, documents, task attachments, surveys, or browser storage. To prevent duplicate operations and retain the result of a request, we store encrypted invoice operation details, including the selected customer and recipient email, line amount and quantity, dates, provider result, and a reference to the saved task or project. These service-only records are separate from shared work and can be accessed through the integration only by the initiating workspace owner under the same connection. Invoice references open the owner's QuickBooks account; they are not public customer payment links. We do not use this accounting data for advertising or unrelated analytics. Disconnecting deletes the stored connection and pending consent credentials and asks Intuit to revoke access. Invoice operation records remain on our server after disconnect so an uncertain request is not silently forgotten; reconnecting does not make records from the old connection available under the new one. If revocation cannot be confirmed, remove BizzyBot in QuickBooks Connected Apps. Deleting the connected owner's account or the workspace deletes the local connection and its stored invoice operation records. Permanently deleting the linked work record also deletes its local operation records. These actions do not delete your QuickBooks records or guarantee remote revocation. You can also revoke access directly in QuickBooks. Our hosting and database service providers process the information needed to operate this connection.

Google Calendar connection. If you choose to connect a Google account, we receive your Google account email and permission to list calendars you subscribe to and read event titles, descriptions, locations, dates and times, and meeting links from the calendars you select. We keep a bounded server-side cache of selected events so they can appear in BizzyBot and block unavailable booking times. For each selected calendar, you choose whether event details stay visible only to you or may be shown to authorized members of the current BizzyBot workspace. Events marked Only me still contribute a busy interval to availability, but their title, notes, location, link, calendar name, and guest list are not disclosed to teammates. If you turn on calendar sync, we send meeting details and guest email addresses you enter in BizzyBot to Google so Google can create or update events on calendars you own, notify attendees, and, when requested, create a unique Google Meet link. We store your Google account email, connection preferences, selected calendars, cached event data, identifiers for Google events created from BizzyBot, and an encrypted OAuth refresh token needed to keep the connection working. Temporary access tokens are used only to make the Google Calendar requests you authorize.

Profile photo and the mobile app. If you add a profile photo, we keep two copies of it in a private storage area: a small square of 256 pixels that your teammates see beside your name, and a copy of at most 1,024 pixels so you can adjust the crop later. Both are re-encoded before upload, which removes camera details such as the location a photo was taken. The photo is visible to you and the teammates who can see your name, it is included in your data export, you can remove it at any time, and it is deleted with your account. The BizzyBot app for iOS and Android is the same Service for an existing account: it asks for camera or photo library access only when you choose to take or pick a photo, uses what you choose for that photo alone, and loads no advertising or measurement tools.

Free trial and news list. If you start a one-week free trial, we record the account it belongs to and when it starts and ends, so we can end it on time and tell you once when it is over. If you tick the box to receive small business and work management news, we add your email address to that list, with the date and the place you signed up (for example the free-trial window). We use it only to send that news. The box is never ticked for you, signing up is never required for an account, a trial or a purchase, and you can leave the list at any time with the unsubscribe link in any issue or by emailing customer@bizzybot.com.

In-app support messages and reports. BizzyBot's owner can message you inside the Service about your account or about a report you sent, and you can reply there. Those messages are stored with your account, together with the reports you send through Report an issue, and are visible to the BizzyBot owner, including after the owner closes a conversation. A closed conversation leaves your Bizzy Chat; a later message from the owner starts a new one. They are included in your data export and erased with your account.

Zoom connection. If you connect your Zoom account, we receive your Zoom user and account identifiers, email address and display name. We store those details, connection status and dates, granted permissions, and encrypted access and refresh tokens on our server. When you choose Zoom for a calendar meeting or booking, we send the meeting title, notes or booking-question answers, date, time, duration and time zone to Zoom to create or update the meeting in the connected host's account. A booking's title may include the host and company names. We retain the meeting identifier and join link with the calendar event or booking and show or send the link to the people involved through the features you enable. A booking's meeting identifier and join link are removed 12 months after the appointment, together with the guest's details. If Google Calendar sync is also enabled, the Zoom link is included in that calendar event. This integration does not collect Zoom meeting recordings, transcripts, audio or video. We use Zoom connection data only to provide and secure these features, not for advertising, unrelated analytics or AI model training. Our hosting and database providers process it to operate the connection. You can disconnect in BizzyBot's Zoom settings: we delete the local connection and pending authorization credentials and ask Zoom to revoke access. If revocation cannot be confirmed, remove BizzyBot in your Zoom account. If an owner or admin removes the Zoom module from a workspace, we disconnect each member's Zoom connection the same way, unless that member still uses Zoom in another BizzyBot workspace. Deleting your BizzyBot account also deletes its local Zoom connection and asks Zoom to revoke access. Disconnecting or deleting your account does not automatically delete meetings already created in Zoom or meeting details retained in BizzyBot calendar events and bookings; those records follow their own deletion controls. A verified Zoom deauthorization notice removes the stored connection. You can reconnect by authorizing Zoom again.

Microsoft Teams connection. If you connect a Microsoft 365 work or school account, we receive your Microsoft user and organization identifiers, email address or sign-in name, and display name. We store those details, connection status and dates, granted permissions, and encrypted access and refresh tokens on our server. When you choose Microsoft Teams for a calendar meeting or booking, we send the meeting title, date, time and duration to Microsoft to create or update the meeting in the connected host's Microsoft 365 account. A booking's title may include the host and company names. We retain the meeting identifier and join link with the calendar event or booking and show or send the link to the people involved through the features you enable. A booking's meeting identifier and join link are removed 12 months after the appointment, together with the guest's details. If Google Calendar sync is also enabled, the Microsoft Teams link is included in that calendar event. This connection does not access your email, calendar, files, Microsoft Teams chats, recordings or transcripts. We use Microsoft connection data only to provide and secure these features, not for advertising, marketing, unrelated analytics or AI model training. Our hosting and database providers process it to operate the connection. You can disconnect in BizzyBot's Microsoft Teams settings: we delete the stored connection, tokens and account details. Disconnecting does not remove the permission you gave BizzyBot in your Microsoft account. To remove it as well, open https://myapps.microsoft.com and revoke BizzyBot's permissions there; if your organization's administrator approved BizzyBot for everyone, only that administrator can remove it, in the Microsoft Entra admin center. If an owner or admin removes the Microsoft Teams module from a workspace, we disconnect each member's Microsoft Teams connection the same way, unless that member still uses Microsoft Teams in another BizzyBot workspace. Deleting your BizzyBot account also deletes its Microsoft Teams connection. Disconnecting or deleting your account does not automatically delete meetings already created in Microsoft Teams or meeting details retained in BizzyBot calendar events and bookings; those records follow their own deletion controls. If Microsoft stops accepting our access, we mark the connection as needing to be reconnected. You can reconnect by authorizing Microsoft Teams again.

Webex connection. If you connect your Webex account, we receive your Webex user identifier, email address and display name, and your Webex organization identifier when Webex provides one. We store those details, connection status and dates, granted permissions, and encrypted access and refresh tokens on our server. When you choose Webex for a calendar meeting or booking, we send the meeting title, date, time, duration and time zone to Webex, a Cisco service, to create or update the meeting in the connected host's Webex account. A booking's title may include the host and company names. We retain the meeting identifier and join link with the calendar event or booking and show or send the link to the people involved through the features you enable. A booking's meeting identifier and join link are removed 12 months after the appointment, together with the guest's details. If Google Calendar sync is also enabled, the Webex link is included in that calendar event. This connection does not collect Webex recordings, transcripts, messages, audio or video. We use Webex connection data only to provide and secure these features, not for advertising, unrelated analytics or AI model training. Our hosting and database providers process it to operate the connection. You can disconnect in BizzyBot's Webex settings: we delete the stored connection, tokens and account details. Disconnecting does not remove the permission you gave BizzyBot in your Webex account. To remove it as well, revoke BizzyBot's access in your Webex account settings. If an owner or admin removes the Webex module from a workspace, we disconnect each member's Webex connection the same way, unless that member still uses Webex in another BizzyBot workspace. Deleting your BizzyBot account also deletes its Webex connection. Disconnecting or deleting your account does not automatically delete meetings already created in Webex or meeting details retained in BizzyBot calendar events and bookings; those records follow their own deletion controls. If Webex stops accepting our access, we mark the connection as needing to be reconnected. You can reconnect by authorizing Webex again.

Information about your customers (bookings and forms). If you use Bookings or form links, your customers can book an appointment with you or answer a form through a link you share. We store what they enter on your behalf. For a booking that is their name, email address, phone number if you require one, service address if the appointment is a site visit, time zone, the appointment time, their answers to the questions you wrote and to the built-in question about what they want to discuss, and a record of the notice they saw and when. For a form it is their answers. Their IP address is used only to limit abuse of the link and is not stored with the booking.

You decide to collect this information and what it is for. We are your service provider and process it only to run these features for you: saving it, showing it in your workspace, and sending your customer confirmation, reminder, reschedule and cancellation emails through our email delivery provider. If you have connected a Google account and turned on calendar sync or Google Meet, the appointment and your customer's email address are also sent to Google as a calendar event. If the business enables Zoom for the appointment, the meeting details and booking-question answers are sent to Zoom and the join link is shared as described above. If the business enables Microsoft Teams or Webex for the appointment, the meeting title and the appointment's date and time are sent to Microsoft or to Webex to create the meeting, and the join link is shared as described above. Otherwise it goes only to the providers that host and run BizzyBot, or to legal or safety recipients when the law requires. We do not sell it, share it, or use it for advertising.

We keep it until you delete or cancel it, and 12 months after the appointment we automatically remove the name, email address, phone number, address, answers and any meeting link; only the fact that an appointment happened stays. When your account closes, this information is deleted with it (Section 7).

If you are a business's customer and want to see, change or delete what you entered, contact the business that sent you the link; it can do that in BizzyBot, and we help it. If you contact us instead, we cannot act on our own, because we hold the information for that business: we will point you to it and act when it asks us to.

2. How we use it. To provide and operate the Service, save and sync your progress, process payments and manage subscriptions (including renewal reminders and receipts), respond to support, secure the Service and prevent abuse, understand and improve usage, and comply with law. Google Calendar data is used only to provide the connected calendar, availability, event-sync, and Google Meet features you choose to enable. We do not use Google Calendar data for advertising, unrelated analytics, or profiling, and we do not sell it. If you asked for small business and work management news, we also use your email address to send it.

3. How we share it. We do not sell your personal information for money. We use advertising and measurement tools, currently the Meta (Facebook/Instagram) Pixel, that set cookies and send limited activity (such as page views and purchases) to those platforms to measure and improve our ads; under some U.S. state privacy laws this counts as “sharing” for cross-context behavioral advertising, which you can opt out of (see Section 5). Whether these tools load depends on where you are: in regions that require consent first (including the EEA, the UK, and Switzerland), they load only if you accept our cookie/consent banner; elsewhere, including the United States, they may load when you visit, and you can turn them off at any time with the “Privacy choices” control in the site footer or in Settings. Your choice is saved so you are not asked again. We do not sell or share respondent data. We do not sell Google user data or transfer Google Calendar data to advertising platforms. We disclose Google Calendar data only to service providers acting on our behalf when necessary to operate and secure the connection, when you direct us to share an event with its attendees, or when disclosure is required for legal or safety reasons. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. If your team uses the map, addresses you save are sent once to our address-lookup provider to place the pin, and when you open the map the background imagery loads from our map-tile provider, which receives your device's IP address as part of serving it. We share personal information only with service providers under contract (hosting, database, payment processing, email, analytics, address lookup and map display for the team map), with legal or safety recipients when required by law, or with a successor in a business transfer.

4. Third-party AI tools. If you choose to use independent AI tools we link to, you do so under their terms and privacy policies; we don't control or receive what you send them.

5. Do Not Track and Global Privacy Control. If your browser sends a Global Privacy Control (GPC) “do not sell/share” signal, we treat it as an opt-out of the advertising tools that “share” data (such as the Meta Pixel): they stay off and advertising cookies stay declined, in every region, even if you accepted the banner. Analytics tools that only measure how the Service is used may still run under the regional rules in Section 3 unless you turn them off with the “Privacy choices” link. There's no industry-standard response to DNT; our product-analytics tool does not record your activity when your browser sends DNT, and other tools do not currently respond to it.

6. Your choices and rights. You can review and update your account information and business-plan content in the Service; delete your account and associated data from Settings (or by emailing customer@bizzybot.com), except records we must keep by law, and except that if you own a shared workspace that other people are working in you close the workspace rather than deleting your account on its own, because deleting it would delete their work too (see Section 7 for what happens then and when); opt out of marketing email using the unsubscribe link in any marketing message (we honor opt-outs within 10 business days; transactional messages like receipts and password resets aren't marketing); leave the small business and work management news list at any time the same way, or by emailing customer@bizzybot.com; manage respondent data, which we delete when your account closes; and mark individual calendar events and tasks Private, which keeps them off your teammates' screens, keeps them out of any transfer to a manager, and stops anyone else being added to them. Older records of other types that were marked Private before this control was narrowed keep those protections. Section 7 explains what happens to Private items if you leave a company workspace. You can disconnect Google Calendar at any time from Calendar or Settings. Disconnecting asks Google to revoke the token and deletes the stored Google connection credentials, account email, preferences, calendar selections, and imported event cache from BizzyBot. Events already created in Google Calendar and meetings already saved in BizzyBot remain in their respective systems until you delete them there. Deleting your BizzyBot account also deletes the stored Google connection and asks Google to revoke the token. If an owner or admin removes the Google Calendar module from a workspace, each member's Google connection is disconnected the same way, unless that member still uses Google Calendar in another BizzyBot workspace or in their personal workspace; for them, only that workspace's calendar selections and imported events are removed. Depending on where you live, you may have additional rights (access, correction, deletion, portability, opt-out): email customer@bizzybot.com to exercise them.

7. Data retention. We keep personal information for as long as your account exists. Closing your account is what ends that, it warns you first, and you can undo it. Leaving a company workspace is different: the work you own there is either transferred to your manager and removed from your account, or, if you marked it Private, destroyed. That is set out at the end of this section, and it cannot be undone.

Leaving your account alone. We do not delete accounts for being unused. There is no period of inactivity after which your account or your work is removed, so if you do not sign in for a year, or two, or longer, everything is still there when you come back. Deleting your account is something you choose to do, and you can do it at any time from Settings or by emailing customer@bizzybot.com. If you own a shared workspace that other people are working in, you close the workspace instead, which is what the next paragraph describes.

Closing your account. If you shut your account down from Settings, everything stays live for you and your team until the end of the period you have already paid for. After that the workspace becomes read only: you and your team can still open and export everything, and nobody can change it. 30 days later the workspace and the data it shares are deleted from the live Service and cannot be restored through ordinary Service controls. You can cancel the shutdown at any point before that deletion date. Respondent data you collected is deleted along with the account.

Leaving a company. Work you do in a company workspace belongs to the company. If you leave a company workspace or are removed from one, the work you own there that is not marked Private is transferred to your manager. If you have no manager, or your manager has already left, it goes to the person who owns the workspace. This covers your documents, your folders, your archived documents, your forms, and your tasks and projects, including tasks and projects you created for yourself on your own list. The transfer is a move, not a copy: exactly the work that goes to your manager is removed from your account, so you do not keep company work after you leave. You keep your account itself, work that belongs to somebody else stays with them, and if there is nobody to transfer the work to then nothing is transferred and nothing is removed. If you use the Service on your own, without a company workspace, none of this applies to you.

Anything you marked Private is deleted from the live workspace instead and cannot be restored through ordinary Service controls. When you leave a company workspace or are removed from one, everything you marked Private in that workspace is deleted from the live workspace, including your own copy of it. It is not transferred to your manager or archived for ordinary use, and cannot be recovered through ordinary Service controls. Current Private controls are available only for calendar events and tasks. The same deletion rule also continues to cover older private projects, templates, documents, folders, notes, messages and contacts that still carry the legacy flag. It is limited to the workspace you left: if you also belong to another company workspace, what you marked Private there is untouched, and if you use the Service on your own without a company workspace, nothing you mark Private is deleted this way. So everything you own in the workspace you left takes one of two paths and never both: what is not marked Private is transferred to your manager and removed from your account, and what is marked Private is deleted outright and nobody receives it. Please choose what to mark Private with this in mind.

The news list. Your entry on the small business and work management news list stays until you unsubscribe or ask us to remove it, and it is deleted with your account.

Restricted disaster-recovery backups may retain previously deleted information until their normal expiry. These copies are not available for ordinary customer restoration. Before a restored copy returns to service, known deletions and access revocations made after its snapshot must be reapplied.

When we delete an account we keep a record that we deleted it, and when, as evidence that we honored this policy. Records we must keep longer by law are the exception: for example, auto-renewal consent and transaction records for at least 3 years or 1 year after termination, whichever is longer.

8. Security. We use reasonable safeguards including encryption in transit, hashed passwords, access controls, and server-side encryption for stored Google OAuth refresh tokens and Zoom, Microsoft Teams and Webex access and refresh tokens. No method is perfectly secure. If a breach affecting your personal information occurs, we'll notify you and authorities as required by applicable state law.

9. Children. The Service is for users 18 and older. We don't knowingly collect personal information from children under 13; contact customer@bizzybot.com and we'll delete it.

10. Changes. We may update this policy and will post a new effective date, with additional notice for material changes where required.

11. Contact. BizzyBot LLC · customer@bizzybot.com (mailing address available on request).