Privacy Policy

Overview

Some features use AI from other companies, mainly Google's Gemini. We say what each one sends and to whom under AI features, and list every company that processes personal data for us on our sub-processors page. We do not use your data to train AI models. The features that send a client's ad data or a client's agent activity to an AI are off until someone turns them on.

Cookies

bizvoid uses strictly necessary cookies for authentication (always on: they cannot be disabled without breaking login), functional cookies that remember which payout page you picked and which link brought you here, and marketing and analytics cookies only with your consent on our public pages (see below).

The two sb-* cookies are set by our authentication provider (Supabase) and are classified as strictly necessary under GDPR Article 6(1)(b): processing necessary for the performance of a contract. No consent is required to set them, but we disclose them here for transparency.

Functional cookies. bv_stripe_dest is set only when you pick a payout page on our /stripe/account page, and is sent only to /stripe pages. It holds nothing but the name of the page you picked, and we do not use it for tracking or advertising.

bv_utm and bv_aff are set only when you arrive through one of our campaign links or an affiliate's link. They are first-party, read only by bizvoid, and never shared with advertising networks. If you sign up, the campaign and the affiliate code are kept with your account; if you pay with an affiliate's code, that affiliate earns a commission on your plan payments for 12 months. They see only your first name and plan, never your email or what you do in bizvoid.

So that no affiliate is paid for buying their own plan, we compare an account that paid with an affiliate's code with that affiliate's own: the email addresses (the account's, and the billing or Link email used to pay), the IP addresses recorded when each signed up, first visited, applied or paid, and the fingerprint Stripe gives the card or bank account used (a code that tells two cards apart without showing the card number), or for Apple Pay and Google Pay the card's brand, last four digits and expiry date. A match only holds that commission until we review it. Nothing from this check is shared with the affiliate.

Marketing cookies (consent only). If you click Accept all cookies on our cookie banner, our public marketing pages load the Meta (Facebook) Pixel and the TikTok Pixel, and turn on advertising cookies for the Google Ads tag. These set advertising cookies and share limited event data (for example page views) with Meta, TikTok, and Google to measure our advertising. The Google tag itself is present on our public pages before you choose, under Google Consent Mode. Until you accept, Google gets only cookieless signals, for example that a page was viewed or a purchase was completed. No cookies are set, and Google cannot use these signals to identify you across sites. Advertising cookies come only after you accept. None of these tags are loaded in the logged-in app, apart from the Google tag on the short page you pass through after checkout (see below). You can withdraw consent at any time: click Cookie settings (also in the footer of most of our public pages) and choose Necessary cookies only. If you had accepted, the page reloads without the Meta and TikTok Pixels, and the Google tag goes back to sending only cookieless signals. Cookies already set stay in your browser until they expire or you clear them.

With the same consent, we may also send conversion events (for example a completed purchase) to Meta server-side via its Conversions API to measure our advertising. Your email is hashed (SHA-256) before it is sent (Meta does not receive it in readable form), and each event is de-duplicated so it is only counted once. We send these events only if you have accepted marketing cookies.

When you complete a purchase, the short page you pass through after checkout reports that conversion to Google Ads to measure our advertising: the amount charged, its currency and the payment's order number, and no other account or personal data. If you have not accepted marketing cookies, it goes as a cookieless signal, as described above. If you have, Google can also use its advertising cookies to link it to the ad you clicked.

Analytics cookies (consent only). Our public pages also use Google Analytics, through the same Google tag, to count visits and see how people use those pages, for example which pages they view. Until you accept, it sets no cookies and Google gets only the cookieless signals described above. If you click Accept all cookies, Google Analytics sets two cookies: _ga, which tells one browser apart from another, and _ga_S3S78VV0CW, which keeps track of your visit. Each lasts 2 years, counted from your last visit. Google Analytics is turned off in the logged-in app, and you can withdraw consent with Cookie settings, as above.

Email communications

When you create a bizvoid account, we send a small number of onboarding and account emails to help you get started and to let you know about relevant plan options and offers. These are sent directly by bizvoid, not through the marketing cookies described above, and do not depend on cookie consent.

Every one of these emails includes an unsubscribe link, and unsubscribing takes effect immediately. Transactional emails tied to your account or billing (for example a receipt or a password reset) are not affected by unsubscribing, since they are not marketing.

Data we collect

• Email address and password hash (for account authentication)
• Subscription and billing data (via Stripe: we do not store card numbers; to let you pick a saved card we read its brand, last four digits and expiry from Stripe when you pay)
• Usage data: zip scans, audits, and pitches performed (for credit accounting)
• Optional profile fields: name, agency name, phone, website (for AI pitch generation)
• If you invoice your own clients: your connected Stripe account identifier, its country, currency, and payment status, plus each invoice's amount, description, billing contact, and whether it was paid. We do not receive your identity documents or bank details. See Client billing & Stripe Connect.
• If your agency lets you add money to your agents from your client portal, and you do: the amount, when you paid, which wallet it went to, and the Stripe payment and checkout references. See Paying for your agents from a client portal.
• If you track what your own customers owe with Payment follow-up: their names, emails, invoices and payments, and their phone numbers while text reminders are on. See Payment tracking and Payment follow-up.
• If you connect a client business's Meta (Facebook and Instagram) ad account on its Ads tab: the access Meta gives bizvoid (stored encrypted), the permissions it granted, the ad account and business portfolio you picked, a log of the campaign changes made from bizvoid and, if the client has an ads agent, its reports and proposed changes for up to 90 days. See Meta ads connection.
• If you connect a client business's Google Ads account on its Ads tab: the refresh token Google gives bizvoid (stored encrypted), the scopes it granted, the ID of the Google account that connected it, the Google Ads account and manager account you picked, a log of the campaign changes made from bizvoid and, if the client has an ads agent, its reports and proposed changes for up to 90 days. See Google Ads connection.
• If you connect a client business's TikTok ad account on its Ads tab: the access token TikTok gives bizvoid (stored encrypted), the permissions it granted, the ID of the TikTok for Business user that connected it, the ad account you picked, a log of the campaign changes made from bizvoid and, if the client has an ads agent, its reports and proposed changes for up to 90 days. See TikTok ads connection.
• If the agency owner turns on creative analysis for a client: who turned it on, when, and the permission statement they confirmed, and the notes Gemini writes about that client's ads, which we keep for up to 12 months. See Creative analysis.
• If an agency turns on the AI chat for a client and the client agrees to it on their client portal: whether they agreed and when, what they ask it, what it answers, and any thumbs up or down and notes they give. The chat itself is kept for 90 days, then deleted. See Chat with your agents on a client portal.
• If you rate or comment on an AI's work: your taps (such as thumbs up or down), any note you write with contact details removed, and what the AI learned from them for your account. See Learning from your feedback.
• If you, or a client business on its bookings link, tell us that bizvoid was added as a Manager on the business's Google Business Profile: when, who said so (your bizvoid account and email, or that it was the business), and the profile's name or link if one was given. See Google Business Profile access.
• If you send our Enterprise contact form: your name, work email, company, team size and, if you add them, your phone number and what you need, plus the page you sent it from, your plan if you are signed in, and your IP address and browser details to stop spam. We email it to our sales team at sales@bizvoid.com and keep it so we can follow up; like your support requests, it is kept after you delete your account.

Google Sign-In. If you create an account or sign in using Google, we receive your email address, name, profile picture URL, and Google account identifier from your Google profile. We use this solely to create and authenticate your BizVoid account and to display your name and avatar within the application. We do not use Google user data for advertising, do not sell it, and do not share it with third parties except our infrastructure providers acting on our behalf. This data is retained for the life of your account and permanently deleted with it (see “Your rights” below for when that happens). You can delete your account at any time from Settings, or by emailing support@bizvoid.com. You may also revoke BizVoid’s access at any time via your Google Account permissions page.

Cold Call Coach calls

When you place a call with Cold Call Coach, both sides of the call are transcribed live by AssemblyAI so the app can show you coaching suggestions while you talk. The suggestions are generated from that transcript by Google's Gemini API. The call itself runs through Twilio. The person you call is told at the start of the call that it may be recorded and transcribed, before they are connected to you.

We keep the transcript as text, never an audio recording, with the call in your history. It is visible only to your account, except for the few lines around a suggestion you vote down in the survey below, and is deleted when you delete your account.

After a call you can answer a short survey (how helpful the Coach was, how the call ended, what got in the way, a thumbs up or down on its suggestions, and what it should have said), which we keep with that call and use to tailor your own coaching, including on the next call to the same business (your agency team's too, when your agency pools saved reports), and to improve bizvoid's Coach, where our team may read a suggestion you voted down with the few lines of the call around it; your answers are deleted when you delete your account. What the Coach learns from your answers is covered under Learning from your feedback.

AI features

bizvoid uses AI from other companies to run some features. This section says which AI each feature uses, what it receives, and what we promise about it. Our sub-processors page lists every company that processes personal data for us, with where it does so.

Who runs our AI

• Google Gemini (several Gemini models, on the paid tier): Cold Call Coach suggestions, Site Builder text, images and videos (including photos you add for them), website fix suggestions, AI workflows, and checking written feedback notes. Only when someone turns them on, it also runs the client portal chat and creative analysis, described below.
• OpenRouter, running the Qwen 2.5 72B model (qwen/qwen-2.5-72b-instruct): pitch drafts, audit reports, the chat assistant in the app, Discover's AI filters, email follow-up drafts, a check of what a business sells when it applies for Client Billing, and the business manager agents' briefings, answers, review reply drafts and win-back email drafts. We ask OpenRouter to send our requests only to model hosts that do not collect prompts. For the business manager agents that is required: if no such host is available, nothing is sent. Their prompts never include invoices, payments or ad data.
• Deepgram: on AI agent calls, it turns the caller's speech into text (Nova-3), speaks the agent's replies (Aura-2 voices), and runs the model that writes those replies, OpenAI's gpt-5.4-mini. OpenAI receives the call's text through Deepgram; we have no account with OpenAI. We opt every call out of Deepgram's model training, so Deepgram does not use the call's audio or text to train its models and keeps them only as long as it takes to handle the call.
• AssemblyAI: live transcripts of Cold Call Coach calls.

Google Gemini

We use Google's Gemini API on the paid tier, through a Google Cloud project with billing turned on. Google acts as our processor and we share data with it to run these features. Under Google's terms for that tier, Google does not use our prompts or Gemini's answers to improve its products. Google keeps them for up to 55 days to detect abuse and meet legal duties, and authorized Google staff may review content its safety systems flag. Google may store or cache the data in any country where it has facilities. We never use what we send to Gemini to train AI models, and we never sell it.

Creative analysis (Google Ads and Meta only)

Creative analysis is part of the ads agent, and it is off by default. Only the agency owner can turn it on, for one client at a time, and only after confirming they have that client's written permission. Other members of the agency team cannot turn it on or off. When it is on, bizvoid sends that client's ad previews (image and video thumbnails), headlines, ad text and results totals (such as spend, impressions, clicks and conversions) to Google's Gemini, which writes notes for the agency's team on which ads work, why, and what to test next.

• It works only with Google Ads and Meta ad accounts. TikTok ad data is not sent to any AI, and will not be unless TikTok agrees in writing. YouTube data is never sent to any AI.
• Each request holds one ad account's data only. We never combine clients, or compare one client's ads with another's.
• We never send access tokens, audiences, or anything about the people who saw the ads, and we never ask Gemini to identify anyone shown in an ad.
• The notes are shown only to the agency team that manages that client. They never go into the client portal chat.
• We never use this data to train AI models. We keep the notes for 12 months, and delete them sooner when the ad account is disconnected or the agency's bizvoid account is deleted. Turning creative analysis off stops new requests straight away.

Chat with your agents on a client portal

An agency's client can ask an AI questions about their own agents on their client portal page. The chat runs on Google's Gemini 3.6 Flash, on the paid tier described above. It is off until the agency turns it on for that client. After that, the first time the client opens the agents page, we ask whether they want the chat, and we save their answer for that portal link. A new portal link asks again. Nothing is sent to Gemini until both the agency and the client have said yes, and either one can turn it off at any time. The chat says it is an AI assistant powered by Google Gemini.

We keep the chat (what the client asks, what it answers, and their thumbs up or down) for 90 days. After that it is deleted automatically. It is deleted sooner when the agency removes that client or deletes its bizvoid account. We keep the client's yes or no, and when they gave it, as the record of their choice for as long as the client stays on the agency's account.

To answer, it can read that client's agent activity: summaries of their calls and texts, which may include callers' names and phone numbers. It works only on that client's portal page and only with that client's data. It never sees ad data, and never sees the invoices and payments that Payment follow-up tracks. The client's thumbs up or down and notes on its answers help it learn, as described next. For callers' details, the business is the controller and we are its processor, as our Data Processing Addendum sets out.

Learning from your feedback

The Cold Call Coach, the ads agent, the client portal chat and our other agents can learn from your feedback.

• Your taps come first: a thumbs up or down, or a reason you pick. A written note is optional.
• Before a note is kept, we remove contact details such as emails, phone numbers, links, card numbers and street addresses. Only that cleaned copy is kept.
• An automated filter then checks the note, using our own rules and Google's Gemini. Notes on the ads agent's proposals are checked by our own rules only and are never sent to an AI. A note the filter flags, or could not check, waits for bizvoid staff, who may read it and decide whether it counts. It teaches nothing unless they approve it.
• What the AI learns tunes it for your account only, for example for one rep, agent or ad account in it. We never use one account's feedback for another account, and never use it to train AI models.
• You can see what the AI learned and choose Forget. From then on, nothing before that moment counts for that lesson.
• Feedback counts for 90 days. Notes are deleted 90 days after you leave them, and lessons 90 days after they last formed. Both are deleted when you delete your account.

What AI never decides

No AI in bizvoid makes a decision about a person that has a legal or similarly serious effect on them. AI drafts, suggests and flags; a person decides. For example, when the AI check flags a Client Billing application, a person reviews it. We never ask an AI to identify a person from an image, a voice or a text. Everyone who uses our AI features must be 18 or over, and must follow Google's Generative AI Prohibited Use Policy, as our Terms say.

SMS / text messaging

bizvoid’s Cold Call Coach feature lets a bizvoid customer text their own leads and customers from a dedicated phone number. If you text or call that number, the bizvoid customer (the business you contacted) can reply to you through the bizvoid platform using that same number. bizvoid also texts a one-time verification code to a phone number when you, or an agency you work with, ask to add or confirm it. If you book a bizvoid demo and tick the box for text reminders, bizvoid texts you up to 2 reminders about that demo: one a day before and one an hour before. Reply STOP to any of them to stop, or HELP for help.

bizvoid’s own texts. bizvoid texts you from its own number only for one-time verification codes you ask for, reminders about a demo you booked if you ticked that box, and bizvoid deals and tips. Deals and tips are sent only if you tick the separate box for them, on the Book a demo form or in your account settings. That box is never ticked for you, and you don't have to tick it to buy or book. After you tick it, we send one welcome text, and the deals and tips start only after you reply YES. Reply NO to that text to decline. To show you agreed, we keep your phone number, the exact wording you agreed to, where and when you agreed, and your latest reply (YES, NO, STOP or START). Message frequency varies. Message and data rates may apply. Reply STOP to any of bizvoid’s own texts to stop them, START to get them again, or HELP for help, or email support@bizvoid.com. You can also turn deals and tips off in your account settings. We never sell your phone number, and never share it or your consent with anyone for their marketing.

We do not sell, rent or share mobile phone numbers, text message opt-in data or consent with third parties or affiliates for marketing or promotional purposes. Sharing with service providers that deliver messages for us, such as Twilio and the wireless carriers, is limited to sending and receiving those messages. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Message frequency varies depending on your conversation with the business you contacted. Message and data rates may apply. You can opt out of receiving further messages at any time by replying STOP, or reply HELP for support.

Pitch email opt-outs

bizvoid customers can send pitch emails to businesses from their own email account. If you reply to one asking the sender to stop, unsubscribe from it, or an email to you bounces (can't be delivered), we keep your email address on a do-not-email list so you aren't emailed again. The list is kept for the sender and, if they are part of an agency on bizvoid, for that agency too, so nobody else there emails you either. We keep only your address, which of those happened and when, and we use it only to stop those emails.

The list is deleted with the account: the sender's when their bizvoid account is permanently deleted, and the agency's along with the agency when its owner's account is permanently deleted. When another member of the agency deletes their account, the agency keeps its list, so the rest of the agency still won't email you.

Pitch email open and click tracking

A bizvoid customer can choose to track opens and clicks on the pitch emails they send. It is off unless they turn it on. When it is on, the email has a tiny image and its links go through bizvoid first. When your email app loads that image or you click a link, we record that it happened and when, and show the sender a count ("Opened", "Clicked"). The links hold only a random code, never your email address or name. Your IP address is used only to limit abuse of these links, is kept for a few hours, and is not stored with the count. We do not set cookies or load any other tracker. Some email apps load images on their own, so an open may be counted when you did not read the email. The unsubscribe link is never tracked. To avoid this, turn off images in your email app, or reply and ask the sender to stop. These records are deleted along with the sender's email history when their bizvoid account is deleted.

Sanctions compliance & IP geolocation

As a US company, we are legally required to block access to the Service from countries and regions under comprehensive US (OFAC) sanctions. To comply, we determine the approximate country and region of each visit by looking up the visitor's IP address in a MaxMind GeoLite2 database hosted on our own servers. This lookup happens entirely on our infrastructure: your IP address is never sent to MaxMind or any other third party for this purpose. The legal basis for this processing is compliance with a legal obligation (GDPR Article 6(1)(c)). If a visit is blocked, we keep an internal record of the attempt (IP address, detected country or region, and the page requested) as part of our compliance records.

Separately, if you set a prospecting country in your profile, we may compare it against your IP-derived country and, if you have one, your card billing country to detect misuse of the Service (legitimate interest, GDPR Article 6(1)(f)). A mismatch is only logged internally for review; it never blocks your account on its own.

Bot protection (Cloudflare Turnstile)

To keep bots out of sign-in, sign-up and our Book a demo and Contact sales forms, we use Cloudflare Turnstile, a check that you are a person. It appears as a checkbox on those forms and usually ticks itself with no puzzle to solve; Cloudflare asks you to click only when its own risk signals call for one.

To run the check, Turnstile runs small challenges in your browser, and Cloudflare processes signals about your device and browser, such as your IP address, your browser's user agent and its TLS fingerprint. It does not read what you type into the form. When you sign in or sign up, the request carries the check's token to Supabase, our authentication provider, which confirms it with Cloudflare before letting the request through. When you send the Book a demo or Contact sales form, our server confirms the token with Cloudflare before saving it. Cloudflare processes these signals on our behalf to detect and block bots, and on its own account to improve Turnstile's bot detection. The legal basis is our legitimate interest in keeping the Service free of spam and abuse (GDPR Article 6(1)(f)). Cloudflare's Turnstile Privacy Addendum and Privacy Policy apply to its use of this data.

How long we keep scans, audits, leads and pitches

Discover scan results, the audits listed on the Audit tab, saved leads, saved audits and pitches are deleted automatically 90 days after they were added, by a job that runs once a day. For scan results and listed audits, the 90 days run from the scan, and running the scan again starts them over. For saved leads, they run from when you saved the lead. For saved audits and pitches, they run from when the audit or pitch was last saved, re-run or regenerated.

A saved lead, saved audit or pitch is not deleted while you or your agency team still use it, that is, while it is in your Pipeline, at any stage from Found to Won; is linked to a Site Builder design, a deployed site or a site you connected to bizvoid; is linked to one of your clients, a client invoice or a business contact profile; is for a business you called with Cold Call Coach; has the phone number of one of your AI agents, or of a business one of your agents works for; or, for a saved audit, has competitors you unlocked. It is also kept while you or your agency team have another saved lead, saved audit or pitch for the same business that is still inside its own 90 days, so a pitch that is still live keeps the older lead and audit for that business. If it stops being in use after it is 90 days old, it is deleted in the next daily run. Scan results and listed audits have no such exception, because nothing else in your account depends on them.

Deletion is permanent and cannot be undone. You can delete a card yourself at any time before then and, on plans that include CSV export, export your saved leads and saved audits from Reports to keep a copy. Deleting a card does not refund any credits used to create it and does not affect your Site Builder designs, deployed sites, clients, invoices or other data, which we keep for as long as your account is active, or until you delete your account (see “Your rights” below).

How long we keep cinematic theme art

AI art and videos made for cinematic themes that are never used to build a site are deleted automatically after 60 days. The 60 days run from the last time you changed the art, for example by making new images, picking one or adding your own photo. This includes any photo you uploaded for that art. A job that runs once a day deletes the art and its files.

Art on a built site stays as long as the site does. Deleted art cannot be restored, and deleting it does not refund credits you spent on new images.

Third-party services

• Supabase: authentication and database (EU/US servers)
• Railway: hosting for our app and servers
• Resend: sending our emails, and the emails businesses send their own customers through bizvoid
• Square, Intuit QuickBooks, Xero, Shopify and Wix: only when a business connects one of them for Payment follow-up, we read its invoices or orders from it (see Payment tracking and Payment follow-up)
• Meta Marketing API: only when a business connects its Meta ad account on a client's Ads tab, to read its campaign results and make the campaign changes you confirm (see Meta ads connection)
• Google Ads API: only when a business connects its Google Ads account on a client's Ads tab, to read its campaign results and make the campaign changes you confirm (see Google Ads connection)
• TikTok API for Business: only when a business connects its TikTok ad account on a client's Ads tab, to read its campaign results and make the campaign changes you confirm (see TikTok ads connection)
• Stripe: payment processing, and (if you invoice your own clients) identity verification, payouts, and fraud and sanctions screening for your connected account. Stripe is an independent controller of the verification data you give it directly.
• Google Gemini: AI for Cold Call Coach suggestions, Site Builder, website fixes and feedback checks, and, only when turned on, the client portal chat and creative analysis (see AI features)
• OpenRouter: AI for pitch and audit features, the in-app chat assistant and the business manager agents
• Twilio: phone calls, text messages and phone numbers
• Deepgram: live speech recognition and the voice of AI agents
• OpenAI: the language model (gpt-5.4-mini) that AI agents use to reply, run through Deepgram
• AssemblyAI: live transcription of Cold Call Coach calls
• Google Places / PageSpeed APIs: business and website data lookup
• Trestle, EnformionGO and Cobalt Intelligence: people-data and business-registry providers we use, only when you ask us to find a business's email, to look up the business owner's name and contact email. We send them the business's name, phone number, address or website, and the owner's name when we have it. Before them we check the business's own website, public state business filings (New York, Colorado and Oregon open data) and, when that feature is switched on, its public Facebook or Instagram page, read the way any logged-out visitor sees it
• BetterContact: another business-contact finder we use the same way, only when you ask us to find a business's email. We send it the business's name, the owner's name, and the website domain when the business has one
• Public business registration records: we copy new business filings from state open data (Florida's Division of Corporations, and the New York, Colorado, Oregon, Connecticut and Texas open data portals): the business's name, address, filing date and, where the filing lists them, its officers' or owner's names and a business phone. We keep these public filings so we never have to fetch them again, show recent ones in Discover's New businesses list, and use the owner's name when you ask us to find that business's email. We send these sources nothing about you
• MillionVerifier: checks that an email address found this way can receive mail before we show it. We send it the address only
• Cloudflare Turnstile: checking that you are a person when you sign in, sign up, or send the Book a demo or Contact sales form (see Bot protection)
• MaxMind GeoLite2: IP-to-region database used for sanctions compliance; runs entirely on our servers, no visitor data is shared with MaxMind
• Pravatar: the stock profile pictures on our home page. Our server fetches them from Pravatar and serves them to you itself, so your browser never connects to Pravatar and no visitor data is shared with it
• Meta (Facebook) Pixel: advertising measurement on our public pages, loaded only with your consent
• TikTok Pixel: advertising measurement on our public pages, loaded only with your consent
• Google Ads: advertising measurement on our public pages plus purchase conversion reporting after checkout; only cookieless signals until you consent (Google Consent Mode), with advertising cookies only after you do
• Google Analytics: measuring visits to our public pages and how people use them; cookieless until you consent (Google Consent Mode), with analytics cookies only after you do

Our sub-processors page lists each of these that processes personal data for us, with what it receives and where. We give at least 30 days' notice before adding one that handles our customers' personal data.

We do not use Intercom. The Meta and TikTok Pixels and Google Ads advertising cookies are used solely to measure our own advertising, and only after you consent. None of them is loaded inside the logged-in app, except that the Google tag reports a purchase from the short page you pass through after checkout: without your consent, only as a cookieless signal. Google Analytics is used only to see how people use our public pages. It sets cookies only after you consent, and is turned off in the logged-in app.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Google API Services User Data Policy & Limited Use

bizvoid’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect Google Meet to create real meetings for your bookings, bizvoid requests the calendar.events scope, used only to create, update, or delete a single Calendar event for each appointment booked through your shared link. The only information written to that event is the client’s name and the appointment’s start and end time. No meeting description and no attendee list is ever added to the event, and no Google Calendar or Workspace data is read back beyond what is needed to update or cancel that same event later.

When you book a bizvoid demo and choose Google Meet, the event is created the same way on the calendar of the bizvoid team member hosting it, with your name, the demo’s time, and your email address as its only guest, so you can join without waiting to be let in. Google is told not to email you about it: the confirmation comes from us. Choose Zoom and the meeting is made on our team member’s Zoom account with your name and the time; choose a phone call and no meeting is made anywhere.

If you connect YouTube in our affiliate program, bizvoid requests the youtube.readonly scope, used only to read your own channel’s handle and subscriber count once, to set your affiliate level. See YouTube API Services below.

If you connect a client business’s Google Ads account on its Ads tab, bizvoid requests the adwords scope, used only to list the Google Ads accounts you can open so you can pick the client’s, to read that account’s campaign results, to pause or resume a campaign or change its daily budget when you confirm it, and, only if the agency owner turns on creative analysis for that client, to write notes on its ads with Google’s Gemini, and the openid scope, used only to know which Google account connected. See Google Ads connection below.

If a business adds bizvoid’s Google account as a Manager on its Google Business Profile, bizvoid will use the Google Business Profile APIs, once Google approves bizvoid’s access to them, only to post the review replies approved in bizvoid. See Google Business Profile access below.

bizvoid never uses data obtained through this or any other Google API to train, improve, or fine-tune any machine learning or AI model, ours or a third party’s. It is never sold, shared with advertisers, or used for any purpose beyond creating and maintaining your calendar event, for YouTube, setting your affiliate level, for Google Ads, showing a client’s campaign results, making the changes you confirm and, when creative analysis is on, writing notes on that client’s ads, or, for Google Business Profile, posting the review replies approved in bizvoid. bizvoid’s other AI features (such as cold-outreach pitch drafts, website audit reports, and Site Builder content, via OpenRouter and Google’s Gemini API) run only on a freelancer’s own business details or on publicly available information about a prospective lead’s business, never on Google Calendar, Workspace or YouTube data. Google Ads data reaches an AI only through creative analysis: it is off until the agency owner turns it on for one client, after confirming that client’s written permission, and then that one account’s ad previews, ad text and results totals go to Google’s Gemini API on the paid tier, as described under Creative analysis. No AI feature uses anything received through the Google Business Profile APIs: review reply drafts are written from the reviews Google shows publicly on the business’s listing (Google Places).

YouTube API Services

bizvoid uses YouTube API Services. When you apply to the bizvoid affiliate program at partners.bizvoid.com, or verify your following from the Affiliate tab of the partner portal, you can connect your YouTube channel so we can confirm its subscriber count and set your affiliate commission level. By connecting YouTube you agree to be bound by the YouTube Terms of Service. Google’s use of your data is covered by the Google Privacy Policy (http://www.google.com/policies/privacy).

What we access. You sign in with Google and give bizvoid read-only access to your YouTube account. We use it for a single request: we ask YouTube for the channel owned by the account you signed in with. YouTube returns that channel’s ID, its basic public details (such as its title, description, handle and thumbnails) and its statistics (such as its subscriber, view and video counts). We never upload, change or delete anything on YouTube, and we do not read your videos, comments, playlists, watch history or Google account email.

What we keep. Only the channel’s handle (or its channel ID, if it has no handle) and its subscriber count, for 30 days at most. The rest of YouTube’s answer is discarded. Straight after that one request we revoke the access you gave us, so bizvoid cannot read your YouTube account again, and we never store an access or refresh token. To check again later, you sign in again.

How we use and share it. We use the handle and subscriber count only to set your affiliate level, which decides your commission rate, to show you what was verified, and to make sure one channel counts for only one affiliate, by comparing handles with other applications and affiliates while we still hold them. You can see them in the partner portal, and bizvoid staff who review applications and run the affiliate program can see them. They are stored in our database (Supabase) and handled by our hosting provider (Railway), which process them only on our behalf. We do not sell them, share them with advertisers or any other third party, use them for advertising, or use them to train AI models.

Cookies on your device. While you connect, we set short-lived cookies in your browser on partners.bizvoid.com. A security code for the Google sign-in lasts 10 minutes (affiliate_apply_oauth on the application; youtube_oauth_state in the portal, with creator_oauth_return to bring you back to the right tab). On the application, a signed cookie holds the handle and subscriber count until you submit, for up to 1 hour (affiliate_apply_accounts). They are used only for that sign-in, never for tracking or advertising.

How long we keep it. If you connect YouTube on the application but never submit it, nothing is kept once the cookie expires. If you submit, the handle and subscriber count are saved with your application. When you are approved, or connect YouTube from the portal, they are also saved as a verified check on your affiliate account. Because we revoke our access straight after reading them, we cannot refresh them, so we delete every handle and subscriber count within 30 days of reading it, from your application and from your affiliate account. A job runs every day and deletes those read 29 or more days earlier. After that we keep only bizvoid’s own records: your affiliate level, the fact that you verified a YouTube channel, and the date you verified it. To check again, connect YouTube again; the new handle and subscriber count are also deleted within 30 days.

Deleting your data and revoking access. To have us delete the YouTube handle and subscriber count we hold about you before the 30 days are up, email support@bizvoid.com from the address you applied with, and we will delete them within 7 days. Your affiliate level stays as it is, and commissions you already earned keep their rate. Deleting what bizvoid stores does not change anything stored by YouTube; to delete data on YouTube, use YouTube itself. Because we revoke our access right after the one request, bizvoid keeps no ongoing access to your account. In addition to asking us to delete your data, you can review or remove bizvoid’s access to your Google account at any time on the Google security settings page at https://security.google.com/settings/security/permissions.

Questions or complaints. Email support@bizvoid.com with any question or complaint about how bizvoid handles your YouTube data.

Bizvoid's Own Advertising Accounts

bizvoid uses one Google Ads app, shown on Google’s sign-in screen as BizVoid Ops or bizvoid, for two things. The first is the Ads tab, where customers connect their own clients’ Google Ads accounts; what it reads, changes and keeps is set out in Google Ads connection below. The second is our own reporting on bizvoid l.l.c.’s advertising, described here, which involves no customer data.

Our internal operations dashboard (BizVoid Ops) reads campaign performance and spend from the one Google Ads account owned by bizvoid l.l.c., with a Google account a bizvoid administrator signs in with. For our own account it only reads and never changes anything. It reads totals per campaign and day (spend, impressions, clicks, conversions and conversion value), nothing about any person, and shows them only to authorized bizvoid team members. They are never shared with customers, advertisers or anyone else, and never used for profiling or advertising. They are kept as long as we need them for our own reporting.

BizVoid Ops reads the same kind of data from the one TikTok ad account owned by BizVoid LLC, through the TikTok API for Business, with an access token a BizVoid administrator authorizes for that account. It reads campaign totals only (spend, impressions, clicks and conversions per campaign and day), nothing about any person, never changes the account, and uses and keeps that data the same way as the Google Ads data above.

Data Protection

BizVoid LLC implements the following measures to protect sensitive data, including data from the Google Ads API, both on the Ads tab and in our own reporting:

• Encryption in transit and at rest. All data transmitted between our services, third-party APIs (including Google Ads), and our database is encrypted using industry-standard TLS. Data stored in our database is encrypted at rest using the security infrastructure provided by our cloud database provider (Supabase / PostgreSQL with AES-256 encryption). The Google Ads refresh tokens customers give us are also encrypted (AES-256-GCM) before they are stored.
• Access controls. A customer’s Google Ads data is visible only to that customer and the members of their agency team who manage that client, and to bizvoid staff only as described in Google Ads connection. Our internal dashboards are restricted to authorized BizVoid team members and administrators. Access is protected by strong authentication requirements including two-factor authentication (2FA). All administrative access is logged and auditable.
• Credential management. API credentials and the OAuth token our own reporting uses are stored as environment variables in secure production infrastructure. The tokens customers give us are stored encrypted in our database. None of them is ever committed to source code, and access to production credentials is restricted to authorized administrators.
• Data minimization. bizvoid requests only the Google Ads API scope (https://www.googleapis.com/auth/adwords), which is the only scope Google offers for the Google Ads API, plus openid on the Ads tab. On the Ads tab it is used only as described in Google Ads connection; for our own account, only to read campaign performance and spend. We do not request or use other Google API scopes for Google Ads.
• Data retention and deletion. Campaign results on the Ads tab are not stored, and what the Ads tab keeps and for how long is set out in Google Ads connection. Our own account’s campaign totals are kept as long as needed for internal reporting. Users may request deletion of their personal data at any time by contacting admin@bizvoid.com.
• Incident response. In the event of a security incident affecting user data, BizVoid LLC will notify affected users and, where required by law, regulatory authorities within the timeframes required by applicable data protection regulations.
• Third-party access. Data accessed via the Google Ads API is not sold, not shared with third parties other than the database and hosting providers that process it for us and, only for a client with creative analysis turned on, Google’s Gemini API, and not used for advertising or profiling. Ads tab data is used only to provide the Ads tab and ads agent features; our own account’s data only for internal reporting shown to authorized BizVoid team members.

Creator Program

BizVoid runs a separate creator program, Bizvoid Creator Payouts, open to independent creators who produce content featuring BizVoid and may be compensated for it. Creators are not BizVoid customers, and this Privacy Policy does not cover the personal data BizVoid collects about them. That is covered by the Creator Privacy Notice published on ops.bizvoid (the app bizvoid also uses to run staff operations and the Bizvoid Creator Payouts program), where creators log in to submit content and track payouts. How we handle data from YouTube, for creators and affiliates alike, is set out under YouTube API Services above.

If you sign in with TikTok on the affiliate application or in the partner portal, TikTok shares the account’s ID, username, display name, profile picture and follower count with bizvoid, and, for a creator who submits videos, the view counts of their own videos. We use them only to set affiliate levels, to make sure one account counts for only one affiliate, and to check the views a creator is paid for. The Creator Privacy Notice sets out how we keep them.

Client billing & Stripe Connect

If you use client billing to invoice your own clients, that feature runs on Stripe Connect and involves two sets of personal data: yours, and your clients'.

Your verification data goes to Stripe, not to us

To pay you, Stripe is legally required to verify who you are. It collects that information directly from you through its own onboarding, which we embed in our app for convenience. Depending on your country and business type, Stripe may ask for your legal name, date of birth, home or business address, government identification document, tax identification number, and bank account details.

We never receive or store those documents, your government ID, or your bank account number. They pass from you to Stripe. Stripe acts as an independent controller of that data under its own privacy policy, which you should read before onboarding. What we receive back from Stripe is limited to:

• your connected account identifier;
• the country and currency of that account;
• whether the account can currently accept payments and receive payouts;
• a list of what Stripe still requires, so we can tell you what is outstanding;
• if you choose to pay for agent balance from it, the account's available balance, read when you pay, and the debits you choose to make.

Your account country is permanent once set, because Stripe does not allow it to be changed after an account is created.

Your clients' data, and who is responsible for it

When you invoice a client, we process that client's billing name, billing email, the invoice amount and description, and its payment status. Card details are entered directly with Stripe and are never stored by us.

You are the controller of your clients' data and we are your processor for it. You decide who to invoice and what to say. You are responsible for having a lawful basis to bill that person, for the accuracy of the billing contact you enter, and for answering their questions about how you handle their information. We process it only to issue the invoice, route the payment, tell you whether it was paid, and keep the financial records the law requires us to keep.

Where the money goes affects the data

Which path applies is determined automatically by your account's country. Where your country supports accepting card payments directly, your client pays you and the transaction record lives in your own Stripe account, which we close when your account is permanently deleted; Stripe keeps its records under its own policies. Where your country can receive payouts but cannot accept card payments directly, the payment is collected through our platform account and forwarded to you, so we are a party to the transaction record, and it stays in our Stripe account as our financial record for as long as tax, accounting and anti-fraud obligations require, including after your account is deleted. The invoice records in our own database, with each invoice's client, amount, description and status, are deleted when your account is permanently deleted. We keep our records of disputes and balance recoveries on your client billing account, as set out in Section 13 of our Terms.

International transfers and fraud screening

Client billing is available in many countries, so your data and your clients' data may be transferred to and processed in the United States and in other countries where Stripe operates, under the safeguards described in Stripe's own privacy policy. Stripe also screens transactions and accounts for fraud, sanctions, and money laundering, and may restrict, delay, or decline an account or a payment on that basis. Those decisions are made by Stripe under its own legal obligations, and Stripe does not always tell us the reason.

Tax documents

Where the law requires a tax form for payments processed through your connected account, Stripe prepares, files, and delivers it, normally by email and through its own document interface. In the United States this is commonly a Form 1099-K. Stripe may ask you for tax information, including a taxpayer identification number, and holds that information itself.

The Documents tab in your profile links you through to the documents Stripe holds for your account. We do not prepare these documents, do not receive copies of them, and do not store them. Opening one takes you to Stripe. A correction to a form must be pursued with Stripe, since we cannot amend a document we never held.

Your rights

You may ask us for a copy of the billing data we hold about you, or ask us to correct it, as described under Your rights below. Requests about the identity, banking, and tax data you gave to Stripe must go to Stripe, since we do not hold it. We cannot delete financial records we are required by law to retain, and deleting a connected account is done through Stripe.

Paying for your agents from a client portal

An agency can let one of its clients add money to that client's own agents from their client portal. It is off until the agency turns it on for that client. When the client pays, they pay bizvoid directly, by card through Stripe, and bizvoid is the merchant of record. For that payment we are the controller of the client's payment data.

• Stripe collects the card details and the email for the receipt on its own payment page. We never see or store card numbers.
• We keep the amount, when it was paid, which wallet it went to, and Stripe's references for the payment and the checkout, as our financial record and to handle refunds and disputes.
• The agency sees the amount added and when, never the card. The agency owner gets an email when money is added.
• The money is prepaid credit for bizvoid agent services. It is never paid out to the agency, and only that client's agents can spend it. Money left over stays in the client's wallet.
• A refund is possible within 24 hours of paying, if none of that money has been spent, as our Refund Policy says.

Stripe also keeps its own records of the payment under its own privacy policy, and may screen it for fraud. We keep our payment records for as long as tax, accounting and anti-fraud rules require, including after an account is deleted.

Payment tracking and Payment follow-up

A business can use bizvoid to track what its own customers owe and to send them reminders to pay (the Payment follow-up agent). To do that we process personal data about that business's customers. The business is the controller of that data and we are its processor. We handle it only on the business's instructions, as set out in our Data Processing Addendum.

Where it comes from

Only from the sources the business chooses: its own Stripe account connected through Stripe Connect, Square, QuickBooks Online, Xero, Wix orders from a Wix site it links, a CSV file it uploads, deposits taken on its bizvoid booking page, and invoices it enters by hand. Shopify orders are not available to every account yet, and are handled the same way where they are.

What we keep

• the customer's name (or company name) and email address;
• for each invoice, order or payment: its number or reference, amount and currency, description, due date, the date it was paid, its status (paid, open, overdue, failed or refunded) and the link the customer can pay at;
• the customer's phone number, only while text reminders for payments are switched on, only a US or Canada number, and only from invoices entered by hand, a CSV file, Stripe, Square, QuickBooks or Xero. We never collect phone numbers from Shopify or Wix orders;
• each reminder raised for the business to approve or send, with the customer's name, email (and phone, for a text), the invoice and the amount;
• when a customer chooses text reminders on the page linked from their reminder emails, or turns them off there: the mobile number they gave, the business, the invoice the link came with, the time, the page, their IP address and browser details, and the exact wording they saw, as proof of their own choice.

We do not store customers' postal addresses, card numbers or bank details. The access tokens that let us read a connected account are stored encrypted (AES-256-GCM) and are never shown in the app.

Why we use it, and what we never do with it

We use it only to show the business what its customers owe and have paid, and to send the business's own payment reminders, by email and, where switched on, by text, in the business's name. A reminder is texted only to a customer who chose text reminders themselves, on the page linked from their reminder emails, at the number they gave there. Every reminder email has an unsubscribe link, and texts stop when the customer unticks the box on that page or replies STOP. We never sell this data, never share it for advertising, never use it to train AI models, and never put it into an AI prompt. The business manager agent's briefings and answers count payment reminders but never quote a customer, an amount or an invoice. It is processed by Supabase (our database), Railway (our hosting), Resend (email), Twilio (texts) and the platform it came from.

How long we keep it

• When the business disconnects a source in bizvoid, the connection and its stored access tokens are deleted at once, and so are that source's open and overdue invoices. Its paid and refunded history is kept as the business's record until the business deletes its bizvoid account. For QuickBooks, everything synced from it is deleted, paid history included, and the customer's details are removed from any reminder raised from it.
• When access is removed on the platform's side (the business uninstalls our app or revokes our access there), we stop reading it, delete any stored tokens, and delete that source's open and overdue invoices.
• Shopify. When a store uninstalls our app, Shopify asks us 48 hours later to erase the store's data, and we delete every order synced from that store, the store's link to the business and the stored install with its access token, and remove the customers' details from reminders raised from those orders, and delete those customers' text reminder choices. When a store asks us to erase one of its customers, we remove that customer's name and email from their synced orders and from the reminders raised from them, and delete their text reminder choices. When a store asks for a copy of what we hold on one of its customers, we send it to the store within 30 days.
• When the business's bizvoid account is permanently deleted (see “Your rights” below), every tracked payment, payment source connection and reminder is deleted with it, and so is every text reminder choice its customers made.

If you are one of the business's customers

The business decides what is kept about you, so to see, correct or delete your details, ask that business first. You can also email support@bizvoid.com. We will pass your request to the business and help it respond, and act on it ourselves where the law requires us to. To stop reminders, use the unsubscribe link in the email or reply STOP to the text.

Meta ads connection

On a Pro or Agency plan you can connect a client business's Meta ad account (its Facebook and Instagram ads) on that client's Ads tab. You connect with Facebook Login for Business and choose there which business portfolio and ad accounts to share. bizvoid asks Meta for three permissions and uses each one only as described here.

What we read

• business_management: the business portfolios you manage and their ad accounts (each one's name, ID, currency, time zone and status), so you can pick the client's ad account.
• ads_read: for the ad account you picked, each campaign's name, ID, objective, status and budget, and its spend, impressions, reach, clicks, click-through rate, cost per click and results for the last 7 and the last 30 days, plus the ad account's totals. Also each ad that ran in the last 30 days: its name, ID, campaign, status and the same numbers, and its preview (thumbnail, headline, text and kind of ad), to rank the best ads and the ones wasting money.

These are totals Meta reports for the campaigns and ads, never information about the people who saw the ads. We do not read audiences, comments, messages, payment methods or billing details.

What we change

With ads_management, bizvoid pauses or resumes a campaign, or changes a campaign's daily budget, and only when a person using bizvoid asks for that change and confirms it on the Ads tab, or approves a change the client's ads agent proposed, in Decisions on the client's Overview. Nothing is changed automatically, and nothing else in the ad account (its ad sets, ads, targeting, lifetime budgets or billing) is ever changed.

Why, and what we never do with it

We use it only to show you and your team how the client's ads are doing and to make the changes you confirm, and, if the agency owner turns it on for that client, for creative analysis. We never sell it, never share it with advertisers, never use it for our own advertising and never use it to train AI models. It is visible only to you and the members of your agency team who manage that client, and to bizvoid staff only when needed for support or security.

Creative analysis is off until the agency owner turns it on for a client, after confirming they have that client's written permission. When it is on, that client's ad previews, ad text and results totals are sent to Google's Gemini API (paid tier) to write notes for that agency's team. Each request holds one client's data only, and never includes access tokens, audiences or anything about the people who saw the ads. Google acts as our processor. Under its paid terms it does not use this data to improve its products. Google keeps it for up to 55 days only to detect abuse and meet legal duties, and authorized Google staff may review content its safety systems flag. Google may process it in any country where it has facilities. We keep the notes for 12 months and delete them when you disconnect the account. See Creative analysis.

How the access is stored

The access token Meta issues is encrypted (AES-256-GCM) before it is stored, is sent only to Meta, and is never shown in the app or written to our logs. Only bizvoid's server can read it; the browser never receives it. It is held in our database (Supabase), and our hosting provider (Railway) runs the server that uses it.

What we keep, and for how long

• Campaign and ad results on the Ads tab are not stored. They are read from Meta each time the Ads tab opens and shown, then discarded. Ad previews load straight from Meta and are never stored by bizvoid. When creative analysis is on, our server fetches them only to send them to Gemini, and does not keep them.
• The ads agent's reports and proposed changes. If the client has an ads agent, the reports it writes and the changes it proposes keep campaign and ad names, numbers (such as spend, results and cost per result) and daily budgets. Each one is kept for 90 days from when it was made, whether a proposed change was approved, turned down or never decided, then deleted automatically by a job that runs once a day. They are deleted sooner in three cases: straight away when you disconnect Meta for the client (the ones for Meta), straight away when you delete the ads agent (all of its own), and within 30 days when you ask us to (see below). A change you approve is also written to the change log below, where it stays after the proposal is deleted.
• How approved changes turned out. When you approve a change the ads agent proposed, bizvoid reads that campaign again 7 and 14 days later and keeps its name and ID, the kind of change, its spend, results and cost per result before and after, and whether the change helped. These are kept for 12 months from the change, so the agent can learn from them, then deleted automatically. When you tell the agent to forget something it learned, bizvoid keeps which item and when, also for 12 months. They go at once when you disconnect Meta for the client or delete the ads agent. The reason and note you give when you turn a proposal down stay on that proposal and are deleted with it. A copy of the note with contact details removed waits for bizvoid staff to check (see Learning from your feedback); it is never sent to an AI, and it goes at the same times as the rest, or after 90 days.
• Creative analysis notes. If the agency owner turns on creative analysis for the client, the notes Gemini writes about its ads are kept for 12 months, then deleted automatically. They go at once when you disconnect Meta for the client, and with your account.
• The connection (the encrypted token, the permissions Meta granted, the Meta user or system user ID the token belongs to, and the picked ad account's name, ID, currency, time zone and business portfolio) is kept until you disconnect it, which deletes all of it. If Meta stops accepting the token (it expired, or bizvoid was removed on Meta's side), all of it is deleted the next time bizvoid tries to use the token, and only a note to reconnect remains.
• The change log: for every pause, resume and budget change made from bizvoid, and each time Meta is connected or disconnected or an ad account is picked: who did it (their bizvoid account and email), when, the campaign's or ad account's name and ID, the value before and after, and Meta's answer (for a connection, the permissions Meta granted). It is kept as your record for as long as your bizvoid account exists, including after you disconnect, and is deleted when your account is permanently deleted or when you ask us to delete it.
• When your bizvoid account is permanently deleted (see “Your rights” below), every ad account connection, its token, the change log and the ads agent's reports, proposed changes and checks on approved changes are deleted with it, and so are any creative analysis notes.

How to disconnect and delete it

On the client's Ads tab, choose Disconnect. It works on any plan, including after you move below Pro, and deletes the stored token, the picked ad account and the ads agent's reports and proposed changes for Meta at once, along with any creative analysis notes. For a connection made with your own Facebook login, bizvoid also asks Meta to take back its access, unless the same login still connects another business in bizvoid, since Meta's revoke would end that one too. Removing bizvoid from your Facebook login entirely is done on Facebook, in Settings and privacy, then Settings, then Security and login, then Business integrations. For a connection made through a business portfolio, Meta gives apps no way to remove themselves, so remove bizvoid in Meta Business Settings, then Integrations, then Connected apps. To have the change log and the ads agent's reports and proposed changes for Meta deleted as well, email support@bizvoid.com from your account's email address and name the client business; we delete them within 30 days and confirm by email. Step by step instructions are on our data deletion page.

Google Ads connection

On a Pro or Agency plan you can connect a client business's Google Ads account on that client's Ads tab. You sign in with Google and allow bizvoid to manage your Google Ads accounts, then pick the client's account in bizvoid. bizvoid asks Google for two scopes and uses each one only as described here.

What we read

• https://www.googleapis.com/auth/adwords: the Google Ads accounts the Google account you sign in with can open, and the client accounts under each manager account (each one's name, customer ID, currency, time zone and status), so you can pick the client's account. Then, for the account you picked, each campaign's name, ID, type, status and budget (and whether the budget is shared with other campaigns), and its cost, impressions, clicks, click-through rate, average cost per click and conversions for the last 7 and the last 30 days, plus the account's totals. Also each ad that ran in the last 30 days: its name, ID, campaign, status and the same numbers, and its preview (image or video thumbnail, headline, text and kind of ad), to rank the best ads and the ones wasting money.
• openid: the ID Google gives the Google account that connected, so that disconnecting one client never ends the access another client connected with the same Google account still uses. We do not ask Google for your name, email address or profile.

These are totals Google Ads reports for the campaigns and ads, never information about the people who saw the ads. We do not read keywords, search terms, audiences, conversion details, payment methods or billing details.

What we change

With the adwords scope, bizvoid pauses or resumes a campaign, or changes the daily amount of a campaign's own budget, and only when a person using bizvoid asks for that change and confirms it on the Ads tab, or approves a change the client's ads agent proposed, in Decisions on the client's Overview. Nothing is changed automatically, and nothing else in the account (its ad groups, ads, keywords, bidding, targeting, budgets shared with other campaigns, total budgets or billing) is ever changed.

Why, and what we never do with it

We use it only to show you and your team how the client's ads are doing and to make the changes you confirm, and, if the agency owner turns it on for that client, for creative analysis. We never sell it, never share it with advertisers, never use it for our own advertising or to target ads, and never use it to train AI models. It is visible only to you and the members of your agency team who manage that client, and to bizvoid staff only when you ask us for support, for security, or where the law requires it.

Creative analysis is off until the agency owner turns it on for a client, after confirming they have that client's written permission. When it is on, that client's ad previews, ad text and results totals are sent to Google's Gemini API (paid tier) to write notes for that agency's team. Each request holds one client's data only, and never includes tokens, keywords, audiences or anything about the people who saw the ads. Google acts as our processor. Under its paid terms it does not use this data to improve its products. Google keeps it for up to 55 days only to detect abuse and meet legal duties, and authorized Google staff may review content its safety systems flag. Google may process it in any country where it has facilities. We keep the notes for 12 months and delete them when you disconnect the account. See Creative analysis.

Google API Services User Data Policy and Limited Use

bizvoid's use and transfer to any other app of information received from Google APIs, including the Google Ads API, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only to provide the Ads tab and ads agent features described here, and transfer it to no one except as needed to provide those features (our database and hosting providers, which process it for us, and, only for a client with creative analysis turned on, Google's Gemini API), to comply with the law, or as part of a merger, acquisition or sale of bizvoid with notice to you.

How the access is stored

bizvoid keeps only the refresh token Google issues. It is encrypted (AES-256-GCM) before it is stored, is sent only to Google, and is never shown in the app or written to our logs. Only bizvoid's server can read it; the browser never receives it. Each time the Ads tab reads or changes something, the server trades it with Google for an access token that lasts about an hour, uses that for the one request, and does not keep it. The refresh token is held in our database (Supabase), and our hosting provider (Railway) runs the server that uses it.

What we keep, and for how long

• Campaign and ad results on the Ads tab are not stored. They are read from Google Ads each time the Ads tab opens and shown, then discarded. Ad previews load straight from Google and are never stored by bizvoid. When creative analysis is on, our server fetches them only to send them to Gemini, and does not keep them.
• The ads agent's reports and proposed changes. If the client has an ads agent, the reports it writes and the changes it proposes keep campaign and ad names, numbers (such as cost, conversions and cost per conversion) and daily budgets. Each one is kept for 90 days from when it was made, whether a proposed change was approved, turned down or never decided, then deleted automatically by a job that runs once a day. They are deleted sooner in three cases: straight away when you disconnect Google Ads for the client (the ones for Google Ads), straight away when you delete the ads agent (all of its own), and within 30 days when you ask us to (see below). A change you approve is also written to the change log below, where it stays after the proposal is deleted.
• How approved changes turned out. When you approve a change the ads agent proposed, bizvoid reads that campaign again 7 and 14 days later and keeps its name and ID, the kind of change, its spend, results and cost per result before and after, and whether the change helped. These are kept for 12 months from the change, so the agent can learn from them, then deleted automatically. When you tell the agent to forget something it learned, bizvoid keeps which item and when, also for 12 months. They go at once when you disconnect Google Ads for the client or delete the ads agent. The reason and note you give when you turn a proposal down stay on that proposal and are deleted with it. A copy of the note with contact details removed waits for bizvoid staff to check (see Learning from your feedback); it is never sent to an AI, and it goes at the same times as the rest, or after 90 days.
• Creative analysis notes. If the agency owner turns on creative analysis for the client, the notes Gemini writes about its ads are kept for 12 months, then deleted automatically. They go at once when you disconnect Google Ads for the client, and with your account.
• The connection (the encrypted refresh token, the scopes Google granted, the Google account's ID, and the picked account's name, customer ID, currency, time zone and the manager account it is reached through) is kept until you disconnect it, which deletes all of it. If Google stops accepting the refresh token (you removed bizvoid from your Google account, or Google ended the access), all of it is deleted the next time bizvoid tries to use it, and only a note to reconnect remains.
• The change log: for every pause, resume and budget change made from bizvoid, and each time Google Ads is connected or disconnected or an account is picked: who did it (their bizvoid account and email), when, the campaign's or account's name and ID, the value before and after, and Google's answer. It is kept as your record for as long as your bizvoid account exists, including after you disconnect, and is deleted when your account is permanently deleted or when you ask us to delete it.
• When your bizvoid account is permanently deleted (see “Your rights” below), bizvoid asks Google to revoke its access (unless the same Google account still connects another business in bizvoid) and deletes every Google Ads connection, its token, the change log and the ads agent's reports, proposed changes and checks on approved changes with it, and any creative analysis notes too.

How to disconnect and revoke it

On the client's Ads tab, choose Disconnect Google Ads. It works on any plan, including after you move below Pro, and deletes the stored token, the picked account and the ads agent's reports and proposed changes for Google Ads at once, along with any creative analysis notes. bizvoid also asks Google to revoke its access, unless the same Google account still connects another business in bizvoid, since Google's revoke ends the access that Google account gave bizvoid for every business. You can remove bizvoid's access yourself at any time in your Google Account, under Security, then Your connections to third-party apps and services, at https://myaccount.google.com/connections. To have the change log and the ads agent's reports and proposed changes for Google Ads deleted as well, email support@bizvoid.com from your account's email address and name the client business; we delete them within 30 days and confirm by email.

TikTok ads connection

On a Pro or Agency plan you can connect a client business's TikTok ad account on that client's Ads tab. You sign in with TikTok for Business and choose the ad accounts to share with bizvoid, then pick the client's account in bizvoid. bizvoid asks TikTok for three permissions and uses each one only as described here.

What we read

• Ad Account Management: the ad accounts you shared with bizvoid (each one's name, ID, currency, time zone and status), so you can pick the client's account.
• Ads Management: for the account you picked, each campaign's name, ID, objective, status and budget.
• Reporting: each campaign's spend, impressions, clicks, click-through rate, cost per click and conversions for the last 7 and the last 30 days, plus the account's totals. Also each ad that ran in the last 30 days: its name, ID, campaign, text and the same numbers (and its status, with Ads Management), to rank the best ads and the ones wasting money.
• When you connect, the ID TikTok gives your TikTok for Business user, so that disconnecting one client never ends the access another client connected with the same login still uses. We do not keep your name or email address.

These are totals TikTok reports for the campaigns and ads, never information about the people who saw the ads. We do not read ad groups, images or videos, audiences, pixels, conversion details, payment methods or billing details.

What we change

With the Ads Management permission, bizvoid pauses or resumes a campaign, or changes a campaign's own daily budget, and only when a person using bizvoid asks for that change and confirms it on the Ads tab, or approves a change the client's ads agent proposed, in Decisions on the client's Overview. Nothing is changed automatically, and nothing else in the account (its ad groups, ads, bidding, targeting, lifetime budgets or billing) is ever changed.

Why, and what we never do with it

We use it only to show you and your team how the client's ads are doing and to make the changes you confirm. We never sell it, never share it with advertisers or anyone else, never use it for our own advertising or to target ads, never use it to train AI models and never put it into an AI prompt. Creative analysis does not use TikTok ad data, and we will not send TikTok data to any AI unless TikTok agrees to it in writing. It is visible only to you and the members of your agency team who manage that client, and to bizvoid staff only when you ask us for support, for security, or where the law requires it. We transfer it to no one except as needed to provide these features (our database and hosting providers, which process it for us), to comply with the law, or as part of a merger, acquisition or sale of bizvoid with notice to you.

How the access is stored

TikTok gives bizvoid one access token that does not expire until it is revoked. It is encrypted (AES-256-GCM) before it is stored, is sent only to TikTok, and is never shown in the app or written to our logs. Only bizvoid's server can read it; the browser never receives it. It is held in our database (Supabase), and our hosting provider (Railway) runs the server that uses it.

What we keep, and for how long

• Campaign and ad results on the Ads tab are not stored. They are read from TikTok each time the Ads tab opens and shown, then discarded.
• The ads agent's reports and proposed changes. If the client has an ads agent, the reports it writes and the changes it proposes keep campaign and ad names, numbers (such as spend, conversions and cost per conversion) and daily budgets. Each one is kept for 90 days from when it was made, then deleted automatically by a job that runs once a day. They are deleted sooner in three cases: straight away when you disconnect TikTok for the client (the ones for TikTok), straight away when you delete the ads agent (all of its own), and within 30 days when you ask us to (see below). A change you approve is also written to the change log below, where it stays after the proposal is deleted.
• How approved changes turned out. When you approve a change the ads agent proposed, bizvoid reads that campaign again 7 and 14 days later and keeps its name and ID, the kind of change, its spend, results and cost per result before and after, and whether the change helped. These are kept for 12 months from the change, so the agent can learn from them, then deleted automatically. When you tell the agent to forget something it learned, bizvoid keeps which item and when, also for 12 months. They go at once when you disconnect TikTok for the client or delete the ads agent. The reason and note you give when you turn a proposal down stay on that proposal and are deleted with it. A copy of the note with contact details removed waits for bizvoid staff to check (see Learning from your feedback); it is never sent to an AI, and it goes at the same times as the rest, or after 90 days.
• The connection (the encrypted access token, the permissions TikTok granted, the TikTok for Business user's ID, and the picked account's name, ID, currency and time zone) is kept until you disconnect it, which deletes all of it. If TikTok stops accepting the token (you removed bizvoid in TikTok for Business, or TikTok ended the access), all of it is deleted the next time bizvoid tries to use it, and only a note to reconnect remains.
• The change log: for every pause, resume and budget change made from bizvoid, and each time TikTok is connected or disconnected or an account is picked: who did it (their bizvoid account and email), when, the campaign's or account's name and ID, the value before and after, and TikTok's answer. It is kept as your record for as long as your bizvoid account exists, including after you disconnect, and is deleted when your account is permanently deleted or when you ask us to delete it.
• When your bizvoid account is permanently deleted (see “Your rights” below), bizvoid asks TikTok to revoke its token (unless the same TikTok for Business login still connects another business in bizvoid) and deletes every TikTok connection, its token, the change log and the ads agent's reports, proposed changes and checks on approved changes with it.

How to disconnect and revoke it

On the client's Ads tab, choose Disconnect TikTok. It works on any plan, including after you move below Pro, and deletes the stored token, the picked account and the ads agent's reports and proposed changes for TikTok at once. bizvoid also asks TikTok to revoke its token, unless the same TikTok for Business login still connects another business in bizvoid, since revoking it ends bizvoid's access to every ad account that token covers. You can remove bizvoid's access yourself at any time on your TikTok for Business authorizations page, at https://ads.tiktok.com/ac/page/authorizations. To have the change log and the ads agent's reports and proposed changes for TikTok deleted as well, email support@bizvoid.com from your account's email address and name the client business; we delete them within 30 days and confirm by email.

Google Business Profile access

Review request can draft replies to a business's new Google reviews. So bizvoid can post the replies that are approved, we ask the business to add bizvoid's Google account, info@bizvoidhq.com, as a Manager on its Google Business Profile. It is added on Google, in Business Profile settings, then People and access, and only if the business chooses to. We ask for the Manager role, never Owner.

What bizvoid can do with it

On Google, a Manager can reply to reviews and edit the profile's details, but can't delete the profile or remove its owners. bizvoid uses this access only to post review replies that the business, or the agency that runs its agents in bizvoid, approved in bizvoid, and only once Google approves bizvoid's access to the Google Business Profile APIs. Until then bizvoid posts nothing. It never changes the profile's details, photos or anything else, and never posts a reply that wasn't approved. The replies it drafts are written from the reviews Google shows publicly on the business's listing (Google Places), not through this access.

Applying to Google

Google gives Business Profile API access only to a company that manages a profile verified for 60 days or more. So bizvoid staff accept the invitation from info@bizvoidhq.com, look at how long the profile has been verified, and may name the profile in bizvoid's request to Google. We send Google nothing else about the business.

What we keep

When someone tells bizvoid that the business added it, we keep a note on the business's Review request agent: when, who said so (their bizvoid account and email, or that the business said so on its bookings link), and the profile's name or link if they gave one. The business sees the note on its bookings link without anyone's email. bizvoid staff see these notes in a list, to know which invitations to accept and which profiles to name to Google. The note is deleted when it is marked as not added, or when the agent or the bizvoid account is deleted.

How to remove bizvoid

Remove it at any time on Google: open the Business Profile, go to Menu (the three dots), then Business Profile settings, then People and access, and remove info@bizvoidhq.com. bizvoid's access ends at once. To clear the note in bizvoid too, choose Mark as not added in the Review request agent's setup, in bizvoid or on the business's bookings link.

Google API Services User Data Policy and Limited Use

bizvoid's use and transfer to any other app of information received from Google APIs, including the Google Business Profile APIs, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Anything bizvoid receives through the Business Profile APIs is used only to post approved review replies, and is never sold, shared with advertisers, used for advertising, used to train AI models or put into an AI prompt.

AI Voice Agents & automated messages

If a bizvoid customer runs an AI agent on their business number, calls and messages to and from that number are processed as follows.

Voice calls. Call audio is streamed to Deepgram, which converts speech to text, generates a reply and speaks it back. The reply is written by OpenAI's gpt-5.4-mini model, which Deepgram runs for us. Deepgram processes the audio to provide that service. We opt every call out of Deepgram's model training, so Deepgram does not use the call to train its models. At the start of every call the agent says “This call is answered by an AI assistant”, adding that the call may be recorded and transcribed, or is recorded, when that applies. A campaign call opens with “Hi, this is an automated AI assistant calling on behalf of” the business. We keep each call's length for billing. We keep an audio recording of an agent call only if the business turns on call recording, as described under Call recordings below. Whether we keep a text transcript depends on the business's plan, as described under Call transcripts below. We do not sell call audio or transcripts.

Call transcripts. If you use bizvoid's AI agents on a Pro or Agency plan, we store what your agent and your callers said on each call (a text transcript, not an audio recording), the caller's phone number, how the call ended, and the text messages your agent sends and receives. This is used only to show you your agent's activity and results, is visible only to your account, and is deleted when you delete the agent or your account. Agent call transcripts (what callers said and their numbers) are kept for 180 days, then deleted automatically. We do not store transcripts on Free or Starter plans. Your agent tells callers at the start of the call that it may be recorded and transcribed, or, when the business records its calls, that the call is recorded.

Call ratings. Receptionist and lead qualification agents ask callers to rate the call. This is on by default. The business can turn it off for each agent with the switch “Ask callers to rate the call”. At the end of the call, the agent asks the caller to stay on the line and rate the call from 1 to 10. Answering is optional. If the caller hangs up, no rating is saved. If they give a rating, we keep it with that call, for that business only, so the business can see how its agent is doing. It is deleted with the call record. Ratings are never used to decide anything about the caller.

Call recordings. On a Pro or Agency plan, a business can choose to record its agent's calls. Callers are told at the start of the call that it is recorded. The recording stops before a call is handed to a person. The audio is stored with Twilio. Only the account the agent belongs to can play it: the business's own account, or, for an agent an agency runs for a client, the agency's account and its team members. It is deleted after 90 days, or sooner when the business deletes the agent or removes that customer.

Texts consent records. With each booking, we keep the proof of how its customer agreed to texts about it, or said no: how and when, their number and name, the business and its texting campaign, the exact words they were shown or asked and their version, each box they ticked or left unticked, their answer, the page or call it came from, a keyed hash of their IP address (never the address itself), their browser, and who recorded it for them. It is kept with the booking and deleted with it or with the account. When the customer's details are deleted from the booking, the record (which holds their name and number) is kept only as proof for 4 years, the time in which a claim about those texts can be brought, and is then deleted automatically.

Your choices on your booking's link. The link in a booking's confirmation lets its customer move or cancel it, see what they agreed to about texts, and tick or untick the same two boxes the booking page shows, at any time. Each change is kept with the same proof as the booking itself, and the earlier choices are kept with it. Once the appointment has passed or been cancelled (24 hours after a cancel the customer made themselves, so the same person can't book and cancel over and over), the customer can delete their name, email, mobile number and notes from it on that link. The booking's date, time and length stay for the business's records, and so does its texts consent record, because the business needs it to show it had their agreement for texts it already sent. That record is deleted automatically 4 years later. A STOP is kept apart, so it is always honoured.

Asking a business to remove you. A business can remove one of its customers from bizvoid, for example when they ask to be forgotten. That deletes what the business holds about them in bizvoid: their website form messages, AI agent call transcripts and answers, voicemails and the links to their recordings, text messages and their consent to be called, the visits to the business's website linked to them (see Visits to websites we publish for businesses), and their name, email, mobile number and notes from their bookings. The bookings' dates and times stay for the business's records, and so do payment records, which the law and the business's accounts need. The proof of how they agreed to texts is kept only as proof, for 4 years, then deleted automatically, and no longer lets the business text them. A STOP is kept, so they are never texted again by mistake.

An AI agent's texts question. When an AI agent asks a caller whether it may text them about their booking, we keep the question as the agent said it and the caller's answer, with when each was said, in that booking's consent record. Unlike call transcripts, these are kept beyond 180 days, for as long as the booking is, because they are the proof of the caller's agreement.

Text messages. Messages are sent and received through Twilio. We store the message body, the numbers involved, and the time, so the business has a record of the conversation.

Opting out. Reply STOP to any agent message to stop further messages from that business, or START to resume. You can also ask the business by email, by phone or in person: it records your opt-out in bizvoid, which stops its texts to you the same way. For texts about a booking, you can untick the boxes on your booking's link at any time. We keep a record of that opt-out (the number, the keyword and the time) specifically so it can be enforced on every later send. That record is kept for as long as the business's account exists, because deleting it would allow messaging to resume, which is the opposite of what you asked for.

Campaign calls. A business can have its agent call people who gave that business written consent to be called. For each of them, the business gives us a consent record: the phone number, the person's name, when and how they agreed, and the consent wording or a link to it. When someone ticks the optional box agreeing to be called on a business's bizvoid booking page or on a website built with bizvoid (on pages from before October 21, 2026, to be called and texted), we record that consent as proof: the phone number and name they entered, the business it was given to, the page, the time, their IP address and browser details, and the exact wording they agreed to. A website built with bizvoid can also show a separate, optional box for occasional offers by text from the business, at most one a month, with the business's privacy policy and terms under it. A tick there is recorded the same way, with those links, and only people who ticked it are ever sent the business's offer texts, until they reply STOP. If someone asks on a campaign call not to be called again, we log the number and the time, the same way as a texted STOP. We keep consent records to prove that consent was given, and opt-out logs so that every opt-out is honored on later calls and texts. A withdrawn consent is marked as withdrawn rather than erased, so the record stays complete. Both are kept for as long as the business's account exists, unless the business removes that person, when their consent record is deleted and their opt-out is kept.

Who is responsible. The business running the agent decides who to contact and is the controller of that contact. bizvoid provides the tooling. If you want your details removed from a particular business's records, contact that business; if you want to reach us, use the address below.

Visits to websites we publish for businesses

When an agency publishes a business's website with bizvoid, the website counts its visits, so the business can see how people find it and become customers. It uses no cookies.

How it works. When you open a page, a small script makes a random visit code. The code lives only in that open page. To follow you to the next page of the same website, or to the business's bizvoid booking page, it is added to the link you click as v= and the code. Nothing is saved on your device: no cookies, no local storage and no fingerprinting. Close the page and the code is gone. Your next visit gets a new one.

What we keep for a visit. The website and the page you landed on, how many pages you saw, and when. Where you came from: the name of the website that linked to it (for example google.com, never the full address), the campaign tags in the link (such as utm_source and utm_campaign), and the type and value of an ad click ID in the link (gclid, fbclid, ttclid or msclkid). And whether you then tapped the call or text button, sent the contact form or booked. We do not keep your IP address or your browser details with a visit. Your IP address is used briefly to stop abuse (rate limiting). Visits from search engine crawlers and other bots are left out.

If you get in touch. When you send the website's contact form or book from that visit, your message or booking is linked to the visit. The business then sees your steps, for example: came from a Google ad, sent the form, booked, paid. A payment shows in those steps when the business has connected its payment records and the payment has your phone number or email. A call or text right after you tap the website's call or text button may be linked to that visit too. If you never get in touch, a visit is not linked to you.

Ad click IDs. We keep them so the business may later report a booking back to the ad platform that sent you. We do not do that today, and we will update this policy before we do. They are never shown on any screen.

Who sees it. The business and its agency, in the business's client portal: visit counts, where visits came from, and the steps of the people who got in touch.

How long we keep it. 13 months, then the visit is deleted automatically. If the business removes you as a customer, the visits linked to you are deleted then.

Who is responsible. The business decides to count visits to its website and is the controller of this data. bizvoid provides the tool. To ask about your data, contact the business. To reach us, use the address below.

Your rights

Under GDPR and CCPA, you have the right to access, correct, or delete your personal data. You can delete your account yourself at any time from Settings → Account → Delete account. Your account is closed straight away and every subscription we bill you for is cancelled, but your data is kept for 30 days so you can restore the account if you change your mind. We then permanently delete it in our first daily deletion run on or after the 30th day, or later if your client billing account cannot be closed yet, in which case we try again each day. Once it is permanently deleted, it cannot be restored.

Some records are kept after that, as set out in Section 13 of our Terms: a record of your plan, account dates and usage counts without your name or email; records of security, fraud and billing checks with your email address removed; your support requests; our own cost and money records; and what Stripe, our payment processor, keeps of your payments. Permanent deletion also removes your AI agents and the files you uploaded. To have your account deleted straight away instead of after 30 days, to exercise any other right, or if you prefer we handle the deletion, contact us at support@bizvoid.com.

Changes to this policy

We may update this policy as the product evolves. We will tell you about a material change by email or an in-app notice at least 30 days before it takes effect, unless the law requires it sooner. Before a new feature uses your data in a new way, we ask you first, as with creative analysis and the client portal chat. We give the same 30 days' notice before adding a sub-processor that handles our customers' personal data, and you can object by turning off the feature it serves or closing your account. Continued use after a change takes effect constitutes acceptance.