Privacy Policy

This Privacy Policy explains how Bizzie (“we”, “us”) collects, uses, stores, and discloses personal information in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Bizzie is built for Australian home-service operators and their customers. Your business data (database, accounts and file uploads) is stored in Sydney, Australia; a small number of sub-processors listed in section 4 necessarily operate outside Australia.

1. What we collect (APP 3)

When you use Bizzie we collect:

Account information: name, email address, phone number, ABN, business name, and business address.
Operational data: clients, jobs, time entries, estimates, invoices, expenses, equipment, employees, and any files you upload as part of running your business.
Billing information: payment method details are processed by Stripe. Bizzie stores Stripe customer and subscription identifiers but does not store full card numbers.
Technical metadata: IP address, browser user-agent, and activity logs used for security, abuse prevention, and troubleshooting.
Sign-in and device information: if you sign in with Google or Apple, the name and email address (which may be a private relay address) they share with us; and, if you turn on notifications, a device or browser token used to deliver them.

2. Why we collect it (APP 6)

We use this information to:

Provide and maintain the Bizzie service.
Process subscription payments via Stripe.
Send operational notifications (e.g. job assignment emails, SMS and push notifications).
Meet Australian tax recordkeeping obligations (invoices, GST, BAS).
Prevent fraud and abuse, and respond to security incidents.

3. How we notify you (APP 5)

We collect personal information directly when you sign up, configure your business profile, or use the product. If we ever need to collect personal information from a third party on your behalf, we will tell you who, what, and why.

4. Who we share with (APP 6, APP 8)

We share the minimum personal information required with the following sub-processors and other third parties. Each provider has its own privacy practices; we select providers that meet Australian data-protection expectations.

Supabase (database, authentication, file storage), region ap-southeast-2 (Sydney).
Vercel (application hosting), region syd1(Sydney). Vercel also provides Web Analytics on our public marketing pages. It is cookieless and counts page views and events without following you across sites.
Stripe (subscription billing). For businesses that take payments from their own clients through Bizzie, Stripe Connect processes those payments and the payer and payee details they involve, under Stripe’s own terms and privacy policy.
Resend (transactional email delivery).
ClickSend (SMS delivery).
Upstash (rate limiting metadata, such as counters keyed to an IP address or account identifier).
Google Maps (address search, maps and geocoding): when you type an address or open a map, your browser loads Google’s Maps scripts and contacts Google directly. Google therefore receives your IP address and the address text you type, along with the usual details your browser sends. Some route and geocoding lookups are also made from our servers, which send the address being looked up to Google. Bizzie cookies are not sent to Google, but Google handles what it receives under its own privacy policy.
Sentry (error reporting): authentication cookies, sensitive headers, and request bodies on auth/billing routes are scrubbed before any event leaves our servers.
Google (sign-in): if you choose “Continue with Google”, Google handles that sign-in and tells us your name and email address.
Apple (Sign in with Apple, and Apple Push Notification service): if you sign in with Apple, Apple handles that sign-in and tells us your name and email address (or a private relay address). If you use the iPhone app with notifications on, we send the notification and your device token to Apple so it can deliver it.
Google Firebase Cloud Messaging (Android push notifications): if you use the Android app with notifications on, we send the notification and your device token to Google so it can deliver it.
Browser push services (web notifications): if you turn on browser notifications, the push service run by your browser’s maker (for example Google, Mozilla or Apple) receives your browser’s push address and the notification.
Australian Business Register (ABN lookup): when you look up an ABN, the ABN you enter is sent to the ABR to return the registered business details.
Webhook endpoints you set up: if a business sets up a webhook, Bizzie sends event data (such as job or invoice details) to the web address that business chose. That recipient is the business’s choice and responsibility, not ours.

Session replay. Session replay is off by default. It runs only for a signed-in user who switches it on in Settings, then Security, and you can switch it off there at any time. When it is on, it records how the screen is used to help us fix problems, with all text and inputs masked so the content you see and type is not captured. It is sent to Sentry, named above.

Some of these providers process data outside Australia. Where that happens we rely on contractual safeguards equivalent to APP 8 requirements.

5. Where we store it (APP 11)

Bizzie’s primary database runs in ap-southeast-2 (Sydney, Supabase) and the application is deployed to syd1 (Sydney, Vercel). All traffic is TLS-encrypted in transit. Data is encrypted at rest. Row-Level Security policies ensure one business cannot read or modify another business’s data. File uploads are stored in a private bucket and served via short-lived signed URLs.

6. How long we keep it

Operational data (clients, jobs, invoices, time entries) is retained for 7 years to meet Australian Taxation Office recordkeeping obligations. This includes records of work performed by someone who has since deleted their own Bizzie account: a job history, time entry, or task created by a departed worker or admin is the business’s employment and operational record, kept under the employer’s recordkeeping obligation rather than the individual’s, and that person’s name is replaced with “Former member” wherever it would otherwise be shown. Other personal information is retained for up to 90 days after account closure, after which it is purged from production systems and (within 30 further days) from backups. Security audit logs, which record who did what and when for security and dispute purposes, are kept as a retained security record and are not included in the 90-day purge.

7. Accessing, correcting and deleting your information (APP 12, APP 13)

You can view and edit most personal information, and delete your own account, directly in Bizzie settings (Settings, then Security). What deleting your account does depends on your role: if you are the only owner of a business, it closes the business entirely, cancelling its subscription and revoking everyone’s access immediately, with the retention periods described in section 6 applying from that moment. If you are a worker, an admin, or one of several owners, it deletes your login and personal details immediately while the business’s own records stay, also as described in section 6.

If you signed in with your Apple ID, deleting your account also asks Apple to revoke the sign-in permission you granted Bizzie, through Apple’s own token revocation service, as required by the App Store. This happens automatically as part of the deletion above, but it is not guaranteed. If revocation cannot be completed (for example, because Apple’s service is unreachable at that moment, rejects the request, or we do not hold a token for your account to revoke), your account is still deleted, and the permission may remain until you remove it yourself. You can check or remove it at any time: on an iPhone, open Settings > [your name] > Sign-In & Security > Sign in with Apple, find Bizzie, and remove it there.

For what genuinely remains out-of-app (an export of your data, or a correction to information we hold about you if you are not yourself a Bizzie account holder) contact us at privacy@bizzieapp.com. We respond within 30 days.

8. Data quality (APP 10)

You’re the authoritative source for your business information. We don’t modify records you’ve created except to enforce tenant isolation or to remove clearly malicious content (e.g. virus sentinels in uploaded files).

9. Complaints and escalation

If you believe we’ve mishandled your personal information, please contact privacy@bizzieapp.com first. If the outcome doesn’t satisfy you, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Cookies

Bizzie uses only essential cookies: the ones that keep you signed in and protect your session, and a small number of settings the app needs to display correctly, such as which layout to use for your screen. We do not set advertising or tracking cookies, and our public marketing pages use cookieless analytics. Third-party features you use, such as Google Maps and Stripe, are provided by those companies and may set their own cookies under their own policies.

11. Children

Bizzie is for businesses and is not directed at children. We ask for a date of birth at sign-up only to confirm you meet the minimum age, and we do not keep it.

12. New Zealand users (Privacy Act 2020)

If you use Bizzie in New Zealand, we also handle your personal information in line with the New Zealand Privacy Act 2020 and its information privacy principles, including those on access, correction and disclosure outside New Zealand (IPP 12). You can ask for access to or correction of your information as described in section 7, and you can complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

13. Changes to this policy (APP 1)

If we materially change how we handle personal information, we’ll update this page and notify account owners by email at least 14 days before the change takes effect.

Contact

Bizzie: privacy@bizzieapp.com