Privacy Policy

Overview

Cookies

bizvoid uses strictly necessary cookies for authentication (always on — they cannot be disabled without breaking login), and marketing cookies only with your consent on our public pages (see below).

These cookies are set by our authentication provider (Supabase) and are classified as strictly necessary under GDPR Article 6(1)(b) — processing necessary for the performance of a contract. No consent is required to set them, but we disclose them here for transparency.

Marketing cookies (consent only). If you click Accept all cookies on our cookie banner, our public marketing pages load the Meta (Facebook) Pixel, the TikTok Pixel, and the Google Ads tag, which set advertising cookies and share limited event data — for example page views — with Meta, TikTok, and Google to measure our advertising. These are not set unless you consent, are never loaded in the logged-in app, and you can withdraw consent at any time by choosing Necessary cookies only on the banner or clearing your browser cookies.

With the same consent, we may also send conversion events (for example a completed purchase) to Meta server-side via its Conversions API to measure our advertising. Your email is hashed (SHA-256) before it is sent — Meta does not receive it in readable form — and each event is de-duplicated so it is only counted once. We send these events only if you have accepted marketing cookies.

If you complete a purchase and have accepted marketing cookies, we also report that conversion to Google Ads — the plan and amount charged only, no other account or personal data — to measure our advertising. This is not set unless you consent.

Data we collect

• Email address and password hash (for account authentication)
• Subscription and billing data (via Stripe — we do not store card numbers)
• Usage data: zip scans, audits, and pitches performed (for credit accounting)
• Optional profile fields: name, agency name, phone, website (for AI pitch generation)

Google Sign-In. If you create an account or sign in using Google, we receive your email address, name, profile picture URL, and Google account identifier from your Google profile. We use this solely to create and authenticate your BizVoid account and to display your name and avatar within the application. We do not use Google user data for advertising, do not sell it, and do not share it with third parties except our infrastructure providers acting on our behalf. This data is retained for the life of your account and permanently deleted within 30 days of account deletion. You can delete your account at any time from Settings, or by emailing support@bizvoid.com. You may also revoke BizVoid’s access at any time via your Google Account permissions page.

How results are displayed over time

Scan results, website audits, generated pitches, and similar results you generate in the app remain in your account and gradually fade in the interface after 30 days, so more recent results stand out visually. This fading is a display convention only — it does not delete anything, does not affect any saved-item limit your plan allows, and does not change how long we retain the underlying data. Your data remains available for as long as your account is active, or until you delete your account (see “Your rights” below).

Third-party services

• Supabase — authentication and database (EU/US servers)
• Stripe — payment processing
• OpenRouter / Google — AI inference for pitch and audit features
• Google Places / PageSpeed APIs — business and website data lookup
• Meta (Facebook) Pixel — advertising measurement on our public pages, loaded only with your consent
• TikTok Pixel — advertising measurement on our public pages, loaded only with your consent
• Google Ads — advertising measurement on our public pages plus purchase conversion reporting after checkout, loaded only with your consent

We do not use Google Analytics or Intercom. The Meta and TikTok Pixels, and Google Ads conversion reporting, are used solely to measure our own advertising, only after you consent, and never inside the logged-in app.

Bizvoid's Own Advertising Accounts

This section describes BizVoid’s own read-only access to its own Google Ads campaign data, via a separate Google Cloud project — it involves no end-user data and is unrelated to Google Sign-In above.

Our internal operations dashboard (BizVoid Ops) accesses campaign performance and spend data from a single Google Ads account owned by BizVoid LLC via the Google Ads API. This access is strictly read-only and used exclusively for internal analytics displayed to authorized BizVoid team members. Google Ads data is not shared with BizVoid customers, third parties, or advertisers, and is not used for profiling or advertising purposes. It is retained only as long as needed for internal reporting.

Data Protection

BizVoid LLC implements the following measures to protect sensitive data, including data accessed via the Google Ads API through BizVoid Ops:

• Encryption in transit and at rest. All data transmitted between our services, third-party APIs (including Google Ads), and our database is encrypted using industry-standard TLS. Data stored in our database is encrypted at rest using the security infrastructure provided by our cloud database provider (Supabase / PostgreSQL with AES-256 encryption).
• Access controls. Access to sensitive data, including Google Ads data accessed via BizVoid Ops, is restricted to authorized BizVoid team members and administrators. Access is protected by strong authentication requirements including two-factor authentication (2FA). All administrative access is logged and auditable.
• Credential management. API credentials, OAuth tokens, and other secrets used to access third-party services (including Google Ads) are stored as environment variables in secure production infrastructure and never committed to source code. Access to production credentials is restricted to authorized administrators.
• Data minimization. BizVoid Ops requests only the minimum scope of Google Ads API access necessary for its function (https://www.googleapis.com/auth/adwords), used solely for reading campaign performance and spend data. We do not request or use additional Google API scopes beyond what is required.
• Data retention and deletion. Google Ads data accessed through BizVoid Ops is retained only as long as needed for internal reporting purposes. Cached data is subject to a 30-day maximum retention period consistent with the Google Maps Platform / Google Ads API caching requirements. Users may request deletion of their personal data at any time by contacting admin@bizvoid.com.
• Incident response. In the event of a security incident affecting user data, BizVoid LLC will notify affected users and, where required by law, regulatory authorities within the timeframes required by applicable data protection regulations.
• Third-party access. Data accessed via the Google Ads API is not shared with third parties, resold, or used for advertising or profiling purposes. It is used exclusively for internal analytics displayed to authorized BizVoid team members.

Creator Program

BizVoid runs a separate creator program in which independent contractors produce content featuring BizVoid and may be compensated for it. Creators are not BizVoid customers, and this Privacy Policy does not cover the personal data BizVoid collects about them. That is covered by the Creator Privacy Notice published on ops.bizvoid, our internal operations application, where creators log in to submit content and track payouts.

Your rights

Under GDPR and CCPA, you have the right to access, correct, or delete your personal data. You can permanently delete your account and all of your data yourself at any time from Settings → Account → Delete account. This is immediate and irreversible: it cancels any active subscription and permanently removes your data, and it cannot be undone. To exercise any other right, or if you prefer we handle the deletion, contact us at support@bizvoid.com.

Changes to this policy

We may update this policy as the product evolves. Material changes will be communicated via email or an in-app notice. Continued use after changes constitutes acceptance.