Privacy Policy

1. Introduction

This Privacy Policy is issued by Bizylook Technologies Pvt. Ltd. ("we," "our," or "us"). Bizylook and BizyGrow are products and services operated by Bizylook Technologies Pvt. Ltd.. Both brands share the same backend infrastructure and legal entity.

This Privacy Policy applies to all products, services and websites operated by Bizylook Technologies Pvt. Ltd., including Bizylook and BizyGrow, and the websites https://bizylook.com, https://bizygrow.in, https://bizygrow.com. This policy may be hosted on bizylook.com while remaining fully applicable to BizyGrow and all related services.

We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our comprehensive business management platform, including business communication, customer relationship management, social media management, AI-powered automation, and reputation management.

By using our Service, you consent to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, business name, business category, company registration details, and password when you create an account.
• Business Profile: Company logo, address, tax IDs (GST, PAN), social media links, and business description.
• Contact Data: Customer and contact information you import or create, including names, phone numbers, email addresses, tags, and notes.
• Communication Content: Messages, templates, broadcast campaigns, and automated responses you create or send.
• Documents: Files you upload for AI processing, including invoices, receipts, contracts, and other business documents.
• Images: Photos and images you upload or generate using our AI Image Studio.
• Payment Information: Billing details processed through secure third-party payment providers (we do not store complete card numbers).
• Support Communications: Messages, feedback, and support requests you send to us.

2.2 Information from Third-Party Integrations

• WhatsApp Business API: Message content, delivery/read status, contact information, media files, and conversation history as authorized through Meta's WhatsApp Business Platform.
• Facebook: Page information, posts, comments, messages, and insights when you connect your Facebook Business Page.
• Instagram: Profile information, posts, comments, direct messages, stories, and engagement metrics when you connect your Instagram Business or Creator account.
• Google Business Profile: Business locations, reviews, ratings, reviewer information, and profile data when you explicitly connect your Google account via OAuth for user-requested features.

2.3 Automatically Collected Information

• Device Information: Browser type, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, features used, actions taken, timestamps, and session duration.
• Network Information: IP address, approximate geographic location, and internet service provider.
• Performance Data: Error logs, crash reports, and diagnostic information.

3. WhatsApp Business Integration

Our platform integrates with WhatsApp Business API provided by Meta Platforms, Inc. When you use WhatsApp features:

3.1 Data We Access

• Phone numbers and WhatsApp profile information of your contacts
• Message content (text, images, documents, audio, video, stickers, locations)
• Message metadata (timestamps, delivery status, read receipts)
• Template messages and their approval status
• Business profile information (name, description, profile picture, address)

3.2 How We Use WhatsApp Data

• Display and manage your conversations in our unified inbox
• Send messages on your behalf (individual, bulk, and automated)
• Process AI-powered auto-replies and chatbot responses
• Generate analytics and reports on message performance
• Sync contacts between WhatsApp and your contact database

3.3 WhatsApp Compliance

Our use of WhatsApp data is governed by Meta's WhatsApp Business Policy and Terms of Service. We:

• Only access data necessary to provide messaging features
• Do not sell WhatsApp user data to third parties
• Comply with opt-in requirements for business messaging
• Respect user privacy settings and blocking preferences

4. Meta Platforms (Facebook & Instagram)

When you connect your Facebook Page or Instagram account, we access data through Meta's Graph API in compliance with Meta Platform Terms.

4.1 Facebook Data

• Page Information: Page name, ID, category, profile picture, and cover photo
• Posts & Content: Posts, photos, videos, and their engagement metrics
• Messaging: Facebook Messenger conversations with your Page
• Comments: Comments on your posts and your replies
• Insights: Page analytics, reach, engagement, and audience demographics

4.2 Instagram Data

• Profile Information: Username, bio, profile picture, follower/following counts
• Media: Posts, stories, reels, and their engagement metrics
• Direct Messages: Instagram DM conversations (Business/Creator accounts)
• Comments: Comments on your posts and your replies
• Insights: Account analytics, reach, impressions, and audience data

4.3 How We Use Meta Platform Data

• Display your social media content in our unified dashboard
• Enable you to respond to comments and messages from one place
• Schedule and publish posts to your connected accounts
• Provide analytics and performance reports
• Power AI-assisted content creation and response suggestions

5. Google Business Profile Integration

Our platform integrates with Google Business Profile APIs to help you manage your online business presence and reputation. Google OAuth is used only when you explicitly connect your own Google account. We access only the minimum Google user data required to provide the features you request.

5.1 Data We Access

• Account Information: Google account email and basic profile information necessary to identify and maintain your connection (via OAuth)
• Business Locations: Location names, addresses, phone numbers, websites, and categories
• Reviews: Customer reviews, ratings, reviewer names/photos, review dates, and your replies
• Business Profile: Business description, hours, photos, and attributes needed for reputation and profile management features

5.2 How We Use Google Data

• Display your Google Business Profile locations and reviews in our reputation management dashboard
• Enable you to respond to reviews directly from our platform
• Optionally generate AI-assisted reply drafts for reviews (you review and approve before publishing)
• Provide alerts for new reviews and negative feedback
• Track review trends and sentiment over time for your requested analytics features

5.3 Connection, Tokens, Disconnect & Deletion

• Explicit consent: We only connect to Google after you initiate OAuth and authorize access.
• Token storage: OAuth access and refresh tokens are stored encrypted at rest (AES-256).
• Disconnect anytime: You may disconnect Google from within our platform and/or revoke access in your Google Account permissions at any time.
• Deletion: You may request deletion of Google-connected data associated with your account by contacting us. Upon disconnect or deletion request, we revoke or delete stored Google OAuth tokens and related Google user data, subject to legal retention requirements, within 30 days.

6. Google API Limited Use Compliance

Bizylook Technologies Pvt. Ltd. complies with the Google API Services User Data Policy, including the Limited Use requirements, for all Google user data obtained through Google APIs (including Google Business Profile). The following statements apply to Google user data, including data aggregated, anonymized, or derived from it:

• User-requested features only: Google user data is used only to provide or improve user-facing features that you explicitly request through our Service (such as Google Business Profile integration and related reputation management tools).
• Never sold: Google user data is never sold to third parties.
• No advertising: Google user data is never used for advertising, including personalized, retargeted, or interest-based advertising.
• No unrelated profiling: Google user data is never used for profiling unrelated to providing the features you requested.
• No generalized AI / model training: Google user data is never used for generalized artificial intelligence / machine learning model training, foundation model training, or to improve AI/ML models.
• No transfer for AI model training: Google user data is never transferred to third-party AI providers for model training, fine-tuning, or model improvement.
• AI processing (if any): If Google user data is processed through AI (for example, to generate a review reply draft you requested), it is processed solely to deliver that user-requested functionality for your account, is not retained by AI providers for training, and fully complies with the Google API Services User Data Policy including Limited Use requirements.
• Human access: Human access to Google user data is limited to cases needed for security, abuse investigation, compliance with law, or when you provide consent (for example, support troubleshooting).
• Policy adherence: Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. AI Services & Document Processing

Bizylook and BizyGrow provide AI-powered features to enhance your business operations. Understanding how we handle data in AI processing is important.

7.1 AI Agent (Automated Responses)

• Data Processed: Incoming messages, conversation context, your business information, and configured response rules
• Purpose: Generate intelligent automated responses to customer inquiries
• Processing: Messages are sent to AI providers (such as OpenRouter, OpenAI, or Anthropic) for inference to deliver the requested feature
• Storage: Prompts and responses may be logged temporarily for operational debugging, security, and abuse prevention (not for AI model training)

7.2 AI Document Parser

• Data Processed: Documents you upload (invoices, receipts, contracts, forms)
• Purpose: Extract structured data from documents automatically
• Processing: Documents are sent to AI vision models for text extraction and analysis
• Storage: Uploaded documents and extracted data are stored in your account
• Sensitive Data: Documents may contain financial information, personal details, or business data - handle with care

7.3 AI Image Studio

• Data Processed: Text prompts, reference images, and generation parameters
• Purpose: Generate marketing images, social media graphics, and creative content
• Processing: Prompts are sent to AI image generation models (such as Google Gemini)
• Storage: Generated images are stored in your account gallery
• Ownership: You own the images generated using your prompts and credits

7.4 AI Review Reply Drafts

• Data Processed: Review content, rating, reviewer name, and your business information (which may include Google Business Profile review data when that integration is connected)
• Purpose: Generate professional reply suggestions for customer reviews at your request
• Processing: Review data is sent to AI models solely to generate a contextual reply draft for the requesting user
• No training use: Google user data included in such requests is not stored by AI providers for training, is not used to improve or fine-tune AI/ML models, and is never transferred for model training
• Review Before Sending: AI drafts are suggestions only - you review and approve before publishing

7.5 AI Service Providers

We may use the following third-party AI providers (and similar enterprise AI providers) to power user-requested features:

• OpenRouter: Routes requests to various AI models for inference
• OpenAI: GPT models for text generation and analysis
• Google Gemini: Models for image generation, document processing, and related inference
• Anthropic Claude: Models for text generation and analysis
• Other enterprise AI providers: As needed to deliver requested features under comparable contractual and privacy controls

8. How We Use Your Information

We use collected information for the following purposes:

8.1 Service Delivery

• Provide, operate, and maintain our platform features
• Process your transactions and manage your account
• Enable integrations with third-party services you authorize
• Deliver AI-powered features and automation you request

8.2 Communication

• Send administrative messages, updates, and security alerts
• Respond to your support requests and inquiries
• Notify you about changes to our services or policies
• Send optional marketing communications (with your consent)

8.3 Improvement & Analytics

• Analyze usage patterns to improve user experience
• Develop new features and services
• Monitor and improve platform performance
• Conduct research and analytics (in anonymized form)

These improvement and analytics activities do not include using Google user data for advertising, sale, or AI/ML model training. Google user data remains subject to Section 6 (Google API Limited Use Compliance).

8.4 Security & Compliance

• Detect, prevent, and address fraud and abuse
• Enforce our terms of service
• Comply with legal obligations
• Protect the rights and safety of users

9. Data Sharing & Disclosure

We may share your information in the following circumstances:

9.1 Service Providers

We share data with trusted third-party vendors who perform services on our behalf:

• Cloud Hosting: Server infrastructure and data storage
• Payment Processors: Secure payment handling
• AI Providers: AI model inference solely to deliver user-requested features (not for model training involving Google user data)
• Analytics: Usage analysis and performance monitoring
• Communication: Email and notification delivery

Google-sourced user data is not shared with third parties for advertising, sale, or AI/ML model training. Transfers of Google user data, if any, are limited to providing the features you requested and comply with Limited Use requirements.

9.2 Platform Integrations

When you connect third-party services, data flows to those platforms as necessary:

• Meta (WhatsApp/Facebook/Instagram): Messages and content you send/receive
• Google: Review replies and profile updates you authorize through Google Business Profile features

9.3 Legal Requirements

We may disclose information when required to:

• Comply with applicable laws, regulations, or legal process
• Respond to lawful requests from government authorities
• Protect our rights, privacy, safety, or property
• Enforce our terms and agreements

9.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change. Any successor will remain bound to protect Google user data in accordance with this Privacy Policy and Google's Limited Use requirements.

10. Data Security

We implement comprehensive security measures to protect your information:

• Encryption in Transit: All data transmitted uses TLS/HTTPS encryption
• Encryption at Rest: Sensitive data is encrypted in our databases
• OAuth Token Security: Google and other OAuth tokens and API keys are encrypted at rest with AES-256
• Access Controls: Role-based access and multi-tenant data isolation
• Authentication: Secure password hashing and session management
• Monitoring: Security logging and anomaly detection
• Regular Updates: Security patches and vulnerability assessments

While we strive to protect your data, no method of transmission or storage is 100% secure. We encourage you to use strong passwords and keep your credentials confidential.

11. Data Retention

We retain your data according to the following guidelines:

• Account Data: Retained while your account is active and for a reasonable period after deletion request
• Message History: Retained according to your plan and preferences (typically 90-365 days)
• Documents & Media: Retained until you delete them or close your account
• Google-Connected Data & Tokens: Retained while your Google account remains connected; OAuth tokens and related Google user data are revoked or deleted upon disconnect or deletion request (generally within 30 days), subject to legal retention requirements
• AI Processing Logs: Retained for 30-90 days solely for operational debugging, security, and abuse prevention—not for AI/ML model training or model improvement
• Analytics Data: Aggregated data may be retained indefinitely (excluding uses prohibited for Google user data under Limited Use)
• Legal Compliance: Some data may be retained longer if required by law

You can request deletion of your data, including Google-connected data and your account, by contacting us. We will process deletion requests within 30 days, subject to legal retention requirements.

12. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data, including Google-connected data and your account
• Portability: Request your data in a portable format
• Restriction: Request restriction of certain processing activities
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent where processing is based on consent
• Disconnect Integrations: Revoke access to connected third-party accounts at any time
• Disconnect Google: Disconnect your Google account from our Service at any time and/or revoke access via your Google Account permissions; you may also request deletion of Google-derived data we store

To exercise these rights, please contact us at bizylook@gmail.com. We will respond within 30 days.

13. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication, security, and core functionality
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Understand how users interact with our platform
• Performance Cookies: Monitor and improve platform performance

You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality. We do not use Google user data obtained via Google APIs for advertising cookies or ads personalization.

14. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Our service providers and AI partners may be located in the United States or other countries.

When transferring data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses and adequacy decisions where applicable. International transfers of Google user data remain subject to the Google API Services User Data Policy and Limited Use requirements described in Section 6.

15. Children's Privacy

Our Service is intended for business use and is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will:

• Update the "Last updated" date at the top of this policy
• Notify you of material changes via email or in-app notification
• Obtain consent where required by law

If we change how we use Google user data, we will update this Privacy Policy and, where required, notify users and obtain any necessary consent before using Google user data for a new purpose.

We encourage you to review this policy periodically.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: