Bizby Privacy Policy

Effective Date: October 12, 2026

1. Introduction

This Privacy Policy explains how Bizby ("we", "us", or "our") collects, uses, discloses, and protects your personal information when you use our service. Bizby is a Canadian company and all data processing is governed by Canadian law.

1.1 PIPEDA Compliance

Bizby is committed to complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 Fair Information Principles. This policy is structured to address each of those principles: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use, Disclosure, and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

1.2 Accountability

Bizby has designated a privacy officer who is responsible for our compliance with this policy and with PIPEDA. For all privacy-related inquiries, requests, or complaints, contact:

Privacy Officer
Email: privacy@bizby.ca

2. Information We Collect and Why

We collect personal information only for the purposes identified below, and we inform you of those purposes at or before the time of collection:

• Account Information (name, email address): Collected to create and manage your account, authenticate your identity, and communicate with you about your account and service updates.
• Payment Information (processed by Stripe): Collected to process subscription payments. Bizby does not store credit card numbers; payment data is handled by our payment processor, Stripe, under their own privacy and security policies.
• Board and Workspace Content (boards, sticky notes, drawings, uploaded files): Collected to provide the core collaboration service. Your content is stored to enable real-time collaboration, version history, and board persistence.
• Usage Data (features used, interaction patterns, session information): Collected to maintain, improve, and optimize the Bizby service.
• Cookies and Tracking Technologies: Used as described in Section 4 below.

2.1 Consent

By creating an account and using Bizby, you consent to the collection, use, and disclosure of your personal information as described in this policy. Where required, we obtain separate explicit consent:

• AI Features: When you use AI-powered features (such as summarization, translation, or poll creation), your board content is processed by our AI provider. By activating an AI feature, you consent to this processing. AI processing occurs in Canada (see Section 7.1).
• Analytics Cookies: Optional analytics cookies require your explicit opt-in consent through our cookie banner.

You may withdraw your consent at any time by contacting privacy@bizby.ca, subject to legal or contractual restrictions. We will inform you of the implications of withdrawal.

2.2 Limiting Collection

We collect only the personal information that is necessary for the purposes we have identified. We do not collect information indiscriminately, and we do not deceive or mislead individuals about the reasons for collecting their information.

3. How We Use Information

We use your information only for the purposes for which it was collected:

• Provide, maintain, and improve the Bizby collaboration platform
• Process payments and manage subscriptions
• Communicate with you about your account and service updates
• Analyze usage patterns to improve our service
• Comply with legal obligations

We will not use your personal information for purposes other than those identified without first obtaining your consent.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. You can control cookie preferences through our cookie banner that appears on your first visit.

4.1 Types of Cookies We Use

• Necessary Cookies: Essential for the website to function properly. These cannot be disabled as they are required for authentication, security, and basic functionality.
• Analytics Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously. These are optional and require your consent.

4.2 Managing Your Cookie Preferences

You can manage your cookie preferences at any time by:

• Clicking "Cookie Settings" in the footer of our website
• Adjusting your browser settings to block or delete cookies
• Opting out of targeted advertising through industry opt-out tools

Please note that blocking necessary cookies may affect the functionality of our service.

5. Sharing of Information

We do not sell your personal information. We may share your information with:

• Service Providers (Sub-Processors): Third-party companies that help us operate Bizby, listed in Section 9.1. These providers are contractually obligated to protect your data.
• Legal Requirements: When required by law, court order, or government request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets. You will be notified of any such change.

6. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes for which it was collected:

• Active Accounts: Your account information and board content are retained for as long as your account is active.
• Account Deletion: When you delete your account, we will delete your personal information and board content within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).
• Cookie Preferences: Stored in your browser until you clear them or change your preferences.
• Usage Data: Anonymized and aggregated usage data may be retained indefinitely for analytics purposes.

6.1 Data Accuracy

We take reasonable steps to ensure that your personal information is accurate, complete, and up to date. You can update your profile information at any time through your account settings. If you become aware that information we hold about you is inaccurate, please contact us at privacy@bizby.ca to request a correction.

7. Data Security

We protect your personal information with technical and organizational safeguards appropriate to the sensitivity of the information:

• Encryption at Rest: All stored data is encrypted using AES-256 encryption on Google Cloud infrastructure.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Access Controls: Firebase Security Rules enforce granular read/write permissions based on authentication and request context.
• Authentication: Firebase Authentication provides secure sign-in with protection against credential stuffing and brute-force attacks. Enterprise customers can configure SSO (SAML 2.0 / OIDC) to delegate authentication to their identity provider, including MFA enforcement.
• Audit Logging: Enterprise accounts include an immutable audit trail covering authentication events, board operations, member management, and SSO configuration changes.
• Infrastructure Security: Google Cloud provides enterprise-grade security including VPC isolation, DDoS protection, and continuous monitoring.

7.1 Canadian Data Residency

Bizby is built to keep data in Canada. Where each kind of data is processed and stored:

• Data at Rest: Account information, team and board metadata, audit records, and the images and files uploaded to boards are stored in the Google Cloud northamerica-northeast1 (Montreal) region. Montreal is also the single authoritative store for board snapshots in Bizby’s design, and snapshots are consolidated onto it. Until a board has been consolidated, its primary snapshot and recovery copies are held in Cloudflare R2 with an asynchronous copy in Montreal, and that board’s R2 copies are removed once its Montreal copies have been verified. Boards belonging to teams with Canadian data residency enabled are already Montreal-authoritative.
• Backend Processing: All Cloud Functions are deployed exclusively in the Montreal (northamerica-northeast1) region.
• AI Processing: AI features (summarization, translation, tone adjustment, poll creation, and other AI-powered tools) are processed via Azure OpenAI deployed in Canada East. Bizby’s own AI features do not send board content to US-based AI services. The optional Claude and ChatGPT connectors, which you connect yourself, are described in section 9.3.
• Real-Time Collaboration: Cloudflare Workers and Durable Objects run with an Eastern North America (enam) placement preference. enam spans eastern North America and includes United States locations, so compute on this path is not guaranteed to run in Canada, and Cloudflare offers no Canada-only Durable Object region. Teams that require the live runtime to stay in Canada enable Canadian data residency, which routes collaboration to our Toronto infrastructure instead. The live runtime holds a board only while a session is open.
• Enterprise Real-Time Collaboration: For Enterprise customers, live collaboration is served from dedicated infrastructure hosted on Fly.io in Toronto, Canada, so real-time session and socket data stays within Canada rather than transiting the global edge network. This data is transient and not persisted after a session ends.

8. Your Rights and Choices

Under PIPEDA, you have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal obligations.
• Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions.
• Opt-Out: Opt out of marketing communications and targeted advertising.
• Data Portability: Request your data in a portable format.

To exercise any of these rights, contact us at privacy@bizby.ca. We will respond to your request within 30 days.

8.1 Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, Bizby will:

• Notify the Office of the Privacy Commissioner of Canada as required by PIPEDA.
• Notify affected individuals as soon as feasible, including information about the breach, the risks, and steps they can take to protect themselves.
• Maintain records of all breaches involving personal information.

8.2 Challenging Compliance

You have the right to challenge Bizby's compliance with PIPEDA. To do so:

1. Contact our Privacy Officer at privacy@bizby.ca. We will investigate and respond within 30 days.
2. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

9. Data Residency and Sub-Processors

Bizby is built to keep your data in Canada. Your personal information and board content are not transferred outside Canada for storage or processing, except in these cases: payment processing through Stripe; transactional email through SendGrid; and, at Cloudflare, which is not pinned to a single region, the live collaboration session for teams without Canadian data residency enabled, the snapshots and recovery copies of boards not yet consolidated into Montreal, cached board downloads, and assets uploaded before board files moved to Montreal storage. Each is set out in the table below.

9.1 Sub-Processors

We use the following third-party service providers to operate Bizby:

* Stripe processes payment data (credit card information) in the United States. Bizby does not store credit card numbers. Only transaction identifiers are retained in our Canadian infrastructure. ** SendGrid processes transactional emails (account verification, notifications) in the United States. Only email addresses and notification content are transmitted. No board content is sent via email.

9.2 Exporting to Google Sheets

When you choose Export to Google Sheets, Bizby asks Google for permission to create files in your Google Drive. This is Google’s drive.file permission, which reaches only files Bizby creates or that you open with it; Bizby cannot see, list or read anything else in your Drive. Bizby uses it only to create the spreadsheet you asked for, containing the poll or frame content you chose to export. Google’s access token is held in your browser for the session and is never stored by Bizby or sent to its servers, and the spreadsheet is created directly between your browser and Google. The spreadsheet is then in your Google account, under your agreement with Google and your organization’s settings, which may store it outside Canada. This happens only at your direction, like downloading a CSV, and is not a transfer by Bizby. Bizby’s use of information received from Google APIs adheres to the Google API Services User Data Policy.

9.3 Connecting an AI assistant (Claude or ChatGPT)

Bizby can be connected to Claude, made by Anthropic, and to ChatGPT, made by OpenAI. Each connector is off unless a team owner turns it on in Team settings, separately for each assistant, and each person then chooses whether to connect it from their own Claude or ChatGPT account. Once you connect one, it can find, read, create and change boards on your behalf, with your access and only when you ask it to: it sees the boards you can see and changes only the boards you can change. Board content the assistant reads, and what you ask it to build, is then processed by its provider (Anthropic for Claude, OpenAI for ChatGPT) under your agreement with that provider and your organization’s settings, which may process it outside Canada. This happens only at your direction, like the Google Sheets export, and is not a transfer by Bizby: neither Anthropic nor OpenAI is one of Bizby’s service providers, and Bizby does not send either of them data on its own. A team owner can switch either connector off for the whole team at any time, and you can disconnect it in the assistant. Bizby’s own AI features, which use Microsoft’s Azure OpenAI Service in Canada and not ChatGPT, are not affected (section 7.1).

10. Children's Privacy

Bizby is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@bizby.ca.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" at the top indicates when the policy was last revised. For material changes, we will provide notice via email or a prominent notice within the service before the changes take effect. Continued use of Bizby after changes means you accept the updated policy.

12. Contact

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights under PIPEDA, contact us at:

Privacy Officer
Email: privacy@bizby.ca

General Support
Email: support@bizby.ca