Privacy policy

Biz on Maps (“we”, “us”) is based at 107 Sunbeam Street, Wolverhampton, England, WV2 4PG.

We are the data controller for the personal data described in this policy, except where section 9 says we act as a processor for a business that uses our public pages.

Contact for anything in this policy: hello@bizonmaps.com, or by post to the address above.

• Account data: name, email address, password (stored only as a secure hash) or Google sign-in identifier, workspace and team membership.
• Business data: business details, brand settings, products and services, uploaded photos and documents.
• Google data: data from your Google Business Profile once you connect it (see section 3).
• Billing data: plan, credit usage, invoices and payment status. Card details are handled by our payment processor; we never see or store full card numbers.
• Review request data: customer names, phone numbers or emails you upload to ask for reviews, and their consent records.
• Public page data: orders, bookings and chat messages from visitors to a business’s public page (see section 9).
• Technical data: IP address (stored as a one-way hash for rate limiting), browser type, security logs and error logs.
• Messages: anything you send us through the contact form or support.

When you connect a Google Business Profile, you grant Biz on Maps access through the Google Business Profile APIs using the https://www.googleapis.com/auth/business.manage scope.

What we access: for the locations you choose to connect, we access business profile details (name, address, hours, categories, description, contact details), attributes, reviews and your replies, posts, photos and other media, performance metrics (such as views, calls, direction requests and website clicks) and the search terms customers used to find you.

Why we use it: only to provide the features you use in our dashboard: to let you manage and update your profile, read and reply to reviews, prepare and publish posts and photos, and see your performance. Nothing is published to Google without your approval.

How it is stored: Google data is stored in our hosted database in the UK/EU region and is encrypted at rest. Google access and refresh tokens are additionally encrypted by us before storage and are never shown in the browser. Data is held only for the locations you connected and is visible only to members of your workspace.

Who it is shared with: no one, except the processors we need to run the service: our hosting and database provider; AI providers, only to generate review replies and content you request, under terms that do not allow them to train their models on your data; and our payment processor (which receives billing data, not Google data). We never sell Google data and never use it for advertising, ad targeting or credit decisions, and we do not let people read it except where you ask for support, where it is needed for security, or where the law requires it.

How to revoke access: go to Settings → Google and choose Disconnect, or remove Biz on Maps at Google Account permissions. When you disconnect, we delete your Google tokens straight away and stop syncing.

Retention and deletion: synced Google data is kept while the location stays connected. After you disconnect, it is deleted within 30 days, apart from replies and posts you published, which stay in your history until you delete your workspace. When you delete your workspace, all Google data is deleted within 30 days and removed from backups within a further 35 days. You can ask us to delete it sooner at hello@bizonmaps.com.

Biz on Maps’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Under UK GDPR we rely on these lawful bases:

• Contract: to create your account, run the service, connect Google, process credits and deliver the features you use.
• Legal obligation: to keep invoices and accounting records and respond to lawful requests.
• Legitimate interests: to keep the service secure, prevent abuse and fraud, fix faults, and improve the product using aggregated usage data.
• Consent: for optional emails and, where needed, for review requests sent to your customers (which you must collect).

We do not make decisions with legal or similarly significant effects based solely on automated processing.

When you ask for an AI reply, post, article or image, we send only the data needed for that task to our AI provider. Providers process it on our instructions and may not use it to train their models. You review AI output before it is published.

We use these categories of processor, each under a written agreement:

• Hosting, database and file storage.
• AI model providers (for content you ask us to generate).
• Payment processing (Stripe) for subscriptions, top-ups and invoices.
• Email delivery, for account and service emails.
• Google, when you connect and publish to your Business Profile.

The full list, with purpose and region, is on our Sub-processors page. We also share data if the law requires it, or with a buyer if our business is sold (you will be told). We never sell personal data, including Google user data, and we use it only to provide the service.

Some processors (for example AI and payment providers) may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, plus additional safeguards where needed.

Businesses can publish a public page where visitors place orders, request bookings and chat. For that data, the business is the controller and we act as its processor.

The business is responsible for having a lawful basis, telling its customers how their data is used, answering their requests, and setting its own retention for orders and invoices. We provide tools to help: automatic chat deletion after 90 days, anonymisation of old orders, and an “Erase this customer” action.

Orders are sent to the business through WhatsApp, which is a separate service with its own privacy policy. We do not take payments on public pages. Visitors who want their data removed should contact the business first; they can also contact us and we will pass the request on.

Under UK GDPR (and EU GDPR where it applies to you) you have the right to access, correct, delete or receive a copy of your data, to restrict or object to processing, and to withdraw consent at any time.

To use these rights, email hello@bizonmaps.com. We may ask you to confirm your identity. We reply within one month, and there is normally no charge. You can also export or delete much of your data yourself in Settings, or ask us to delete your whole workspace. If you are in the EU, you can also complain to your local data protection authority.

We use encryption in transit and at rest, extra encryption for access tokens, strict separation between workspaces, least-privilege staff access with audit logs, and regular security testing. No system is perfectly secure; if a breach affects you, we will tell you and the ICO where the law requires it.

We use:

• Sign-in session storage, to keep you signed in.
• Preference storage (for example, a collapsed sidebar or chosen plan).
• Security and load-balancing cookies set by our hosting provider.
• Stripe’s cookies on the checkout page, for fraud prevention.
• Google Analytics cookies on our marketing pages only; in the UK and Europe only after you accept in the cookie banner.

We do not use advertising cookies. Details are in our Cookie policy.

Biz on Maps is a business service for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

We may update this policy. The effective date at the top shows the current version. If a change is significant, we will tell account holders by email or in the dashboard before it takes effect.

Questions or complaints: hello@bizonmaps.com, or write to Biz on Maps, 107 Sunbeam Street, Wolverhampton, England, WV2 4PG.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to help first.

See also our Terms of service.