Bizby Privacy Policy

Effective Date: February 22, 2026

1. Introduction

This Privacy Policy explains how Bizby ("we", "us", or "our") collects, uses, discloses, and protects your personal information when you use our service. Bizby is a Canadian company and all data processing is governed by Canadian law.

1.1 PIPEDA Compliance

Bizby is committed to complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 Fair Information Principles. This policy is structured to address each of those principles: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use, Disclosure, and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

1.2 Accountability

Bizby has designated a privacy officer who is responsible for our compliance with this policy and with PIPEDA. For all privacy-related inquiries, requests, or complaints, contact:

Privacy Officer
Email: privacy@bizby.ca

2. Information We Collect and Why

We collect personal information only for the purposes identified below, and we inform you of those purposes at or before the time of collection:

• Account Information (name, email address): Collected to create and manage your account, authenticate your identity, and communicate with you about your account and service updates.
• Payment Information (processed by Stripe): Collected to process subscription payments. Bizby does not store credit card numbers; payment data is handled by our payment processor, Stripe, under their own privacy and security policies.
• Board and Workspace Content (boards, sticky notes, drawings, uploaded files): Collected to provide the core collaboration service. Your content is stored to enable real-time collaboration, version history, and board persistence.
• Usage Data (features used, interaction patterns, session information): Collected to maintain, improve, and optimize the Bizby service.
• Cookies and Tracking Technologies: Used as described in Section 4 below.

2.1 Consent

By creating an account and using Bizby, you consent to the collection, use, and disclosure of your personal information as described in this policy. Where required, we obtain separate explicit consent:

• AI Features: When you use AI-powered features (such as summarization, translation, or poll creation), your board content is processed by our AI provider. By activating an AI feature, you consent to this processing. AI processing occurs in Canada (see Section 7.1).
• Analytics Cookies: Optional analytics cookies require your explicit opt-in consent through our cookie banner.

You may withdraw your consent at any time by contacting privacy@bizby.ca, subject to legal or contractual restrictions. We will inform you of the implications of withdrawal.

2.2 Limiting Collection

We collect only the personal information that is necessary for the purposes we have identified. We do not collect information indiscriminately, and we do not deceive or mislead individuals about the reasons for collecting their information.

3. How We Use Information

We use your information only for the purposes for which it was collected:

• Provide, maintain, and improve the Bizby collaboration platform
• Process payments and manage subscriptions
• Communicate with you about your account and service updates
• Analyze usage patterns to improve our service
• Comply with legal obligations

We will not use your personal information for purposes other than those identified without first obtaining your consent.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. You can control cookie preferences through our cookie banner that appears on your first visit.

4.1 Types of Cookies We Use

• Necessary Cookies: Essential for the website to function properly. These cannot be disabled as they are required for authentication, security, and basic functionality.
• Analytics Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously. These are optional and require your consent.

4.2 Managing Your Cookie Preferences

You can manage your cookie preferences at any time by:

• Clicking "Cookie Settings" in the footer of our website
• Adjusting your browser settings to block or delete cookies
• Opting out of targeted advertising through industry opt-out tools

Please note that blocking necessary cookies may affect the functionality of our service.

5. Sharing of Information

We do not sell your personal information. We may share your information with:

• Service Providers (Sub-Processors): Third-party companies that help us operate Bizby, listed in Section 9.1. These providers are contractually obligated to protect your data.
• Legal Requirements: When required by law, court order, or government request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets. You will be notified of any such change.

6. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes for which it was collected:

• Active Accounts: Your account information and board content are retained for as long as your account is active.
• Account Deletion: When you delete your account, we will delete your personal information and board content within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).
• Cookie Preferences: Stored in your browser until you clear them or change your preferences.
• Usage Data: Anonymized and aggregated usage data may be retained indefinitely for analytics purposes.

6.1 Data Accuracy

We take reasonable steps to ensure that your personal information is accurate, complete, and up to date. You can update your profile information at any time through your account settings. If you become aware that information we hold about you is inaccurate, please contact us at privacy@bizby.ca to request a correction.

7. Data Security

We protect your personal information with technical and organizational safeguards appropriate to the sensitivity of the information:

• Encryption at Rest: All stored data is encrypted using AES-256 encryption on Google Cloud infrastructure.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Access Controls: Firebase Security Rules enforce granular read/write permissions based on authentication and request context.
• Authentication: Firebase Authentication provides secure sign-in with protection against credential stuffing and brute-force attacks. Enterprise customers can configure SSO (SAML 2.0 / OIDC) to delegate authentication to their identity provider, including MFA enforcement.
• Audit Logging: Enterprise accounts include an immutable audit trail covering authentication events, board operations, member management, and SSO configuration changes.
• Infrastructure Security: Google Cloud provides enterprise-grade security including VPC isolation, DDoS protection, and continuous monitoring.

7.1 Canadian Data Residency

All Bizby data is processed and stored in Canada. Specifically:

• Data at Rest: All user data, board content, and account information is stored in the Google Cloud northamerica-northeast1 (Montreal) region.
• Backend Processing: All Cloud Functions are deployed exclusively in the Montreal (northamerica-northeast1) region.
• AI Processing: AI features (summarization, translation, tone adjustment, poll creation, and other AI-powered tools) are processed via Azure OpenAI deployed in Canada East. No board content is sent to US-based AI services.
• Real-Time Collaboration: Cloudflare Workers and Durable Objects are configured with an Eastern North America (enam) placement preference, biasing compute toward Canadian data centers (Toronto, Montreal, Vancouver). Real-time sync data is transient and not persisted at the edge.
• Enterprise Real-Time Collaboration: For Enterprise customers, live collaboration is served from dedicated infrastructure hosted on Fly.io in Toronto, Canada, so real-time session and socket data stays within Canada rather than transiting the global edge network. This data is transient and not persisted after a session ends.

8. Your Rights and Choices

Under PIPEDA, you have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal obligations.
• Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions.
• Opt-Out: Opt out of marketing communications and targeted advertising.
• Data Portability: Request your data in a portable format.

To exercise any of these rights, contact us at privacy@bizby.ca. We will respond to your request within 30 days.

8.1 Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, Bizby will:

• Notify the Office of the Privacy Commissioner of Canada as required by PIPEDA.
• Notify affected individuals as soon as feasible, including information about the breach, the risks, and steps they can take to protect themselves.
• Maintain records of all breaches involving personal information.

8.2 Challenging Compliance

You have the right to challenge Bizby's compliance with PIPEDA. To do so:

1. Contact our Privacy Officer at privacy@bizby.ca. We will investigate and respond within 30 days.
2. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

9. Data Residency and Sub-Processors

Bizby is designed to keep your data in Canada. We do not transfer your personal information or board content outside of Canada for storage or processing, with the exception of payment processing through Stripe (see below).

9.1 Sub-Processors

We use the following third-party service providers to operate Bizby:

* Stripe processes payment data (credit card information) in the United States. Bizby does not store credit card numbers. Only transaction identifiers are retained in our Canadian infrastructure. ** SendGrid processes transactional emails (account verification, notifications) in the United States. Only email addresses and notification content are transmitted. No board content is sent via email.

10. Children's Privacy

Bizby is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@bizby.ca.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" at the top indicates when the policy was last revised. For material changes, we will provide notice via email or a prominent notice within the service before the changes take effect. Continued use of Bizby after changes means you accept the updated policy.

12. Contact

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights under PIPEDA, contact us at:

Privacy Officer
Email: privacy@bizby.ca

General Support
Email: support@bizby.ca