Privacy Policy
Last updated: 2026-09-07
Bizfloo Branding ("we", "our", "us") operates bizfloo.com from Raleigh, NC 27601. This policy explains what we collect, why, and the rights you have over your information.
1. Information we collect
- Information you give us — name, email, phone, business name, project details, and anything else you submit through our forms (Contact, Quote, Audit, Intake, Schedule, Bizfloo AI chat).
- Payment information — handled by Square. We never see or store your full card number; Square processes payments on a PCI-compliant hosted page.
- Automatic information — IP address, browser, device type, approximate location (country, region and city, derived from the IP address by our hosting provider — we do not store the IP address itself), pages visited, referring source, and the campaign link or QR code you arrived through. Collected via cookies and analytics tools: Google Analytics 4, Microsoft Clarity, PostHog, the Meta Pixel, OneSignal (only if you accept push notifications), and our own first-party analytics stored in our database.
2. How we use it
- To respond to inquiries and deliver requested services.
- To send transactional emails (quote confirmations, invoice receipts).
- To improve site performance and content.
- To send marketing communications you've opted into (you can unsubscribe at any time).
3. Who we share it with
- Service providers — Resend (email), Square (payments), Supabase (data storage), Vercel (hosting), OpenAI / Anthropic (AI-powered chat). Each is bound by their own privacy and security terms.
- Legal compliance — when required by law or in response to valid legal requests.
- We do not sell your personal information.
4. Cookies & tracking
We use cookies and similar technologies to keep the site working (essential), measure usage (analytics), and remember your preferences. You can disable cookies in your browser, but parts of the site may not function properly.
Session recording and heatmaps
Microsoft Clarity and PostHog reconstruct your visit — the pages you view, where you scroll, where you move and click, and how long you stay — so we can see where the site is confusing and fix it. What is stored is a recording of the page and of your interactions with it, played back later like a video. These are not video or audio recordings of you: no camera, no microphone, and we never see your screen outside this website.
Text you type into forms is masked before it leaves your browser. Names, email addresses, phone numbers and message contents are replaced with placeholder characters in the recording, so the people reviewing these sessions can see that a field was filled in but not what was written in it. Payment details are handled entirely by Square on their own hosted page and are never present in a recording.
Pages we never record, and pages we do not count
Input masking only covers text you type. It does not cover text a page already displays — your own name printed on your digital business card, for example. So rather than rely on masking alone, we switch session recording off entirely, before the recorder loads, on every page that can show or collect your personal details:
/portal— your client account and everything inside it./admin— our own staff area./cardsand/bizfloo-cards— the digital business card builder and every published card, including the pages where you enter your name, phone number and email./products/confirmed— the page shown after a purchase.
Two of those go further. Visits to /portal and /admin are not recorded and not counted — no page view, no analytics event, nothing sent to Google Analytics, PostHog, Clarity or our own database. Signed-in activity in your account does not appear in our traffic numbers at all. Visits to the card pages are counted (we need to know the builder is being used) but are never recorded.
Campaign and QR tracking
Links we publish — on flyers, business cards, billboards, our Google Business profile, social posts and paid ads — may carry a short code (a /go/ link, often behind a QR code) or a campaign tag in the address (utm_source, utm_medium, utm_campaign, and the click identifiers Google and Meta add to their own ads). We record which one you arrived through, the site that referred you and the first page you landed on, once, at the start of your visit, and attach it to what you do afterwards. This tells us the advert worked; it does not identify you personally.
Choices and opt-out
Turn analytics off for this browser. The button below switches off Google Analytics, Microsoft Clarity, PostHog, the Meta Pixel and our own first-party analytics together, and stops any session recording already in progress. The site keeps working normally.
Loading your current setting…
We also honour the Global Privacy Control signal: if your browser or extension sends it, analytics and session recording are disabled automatically and nothing further is collected — you do not have to press anything. You can also block these tools with any standard content blocker, or disable cookies in your browser settings. Visits from our own staff and from automated bots are excluded from our reporting.
5. Your rights
Regardless of where you live, you can request that we:
- Show you a copy of the personal information we hold about you.
- Correct or update inaccurate information.
- Delete your information (subject to limited legal retention).
- Stop using your information for marketing.
To exercise any of these, email info@bizfloo.com. California residents have additional rights under the CCPA; EU/UK residents under the GDPR. We honor both.
6. Children
Our services are not directed to anyone under 13. We do not knowingly collect information from children. If you believe a child has submitted information, contact us and we'll delete it.
7. Data retention & security
We keep submitted information only as long as needed to provide the service or as required by law. Data in transit is encrypted via TLS; data at rest is encrypted by our service providers.
8. Google user data (Bizfloo Cards Calendar integration)
When you use a Bizfloo Cards account and connect your Google Calendar, Bizfloo uses Google APIs to read and write events on the calendar(s) you select. This section explains specifically how we handle data received from Google APIs.
- What we access — the email address of the Google account you sign in with (so we can label the connection) and the
https://www.googleapis.com/auth/calendar.eventsscope on the calendar you choose, so we can create, update, and remove booking events on your calendar. - What we store — only the OAuth refresh token (encrypted at rest), the connected email address, and the ID of the calendar you selected as the target. We do not copy your calendar events into our database; we read and write them in place through the Google Calendar API.
- How we use it — solely to keep your Bizfloo Cards booking schedule in sync with the Google Calendar you connected. No other use.
- Who we share it with — nobody. We do not transfer Google user data to any third party for advertising, analytics, AI or machine-learning training, or any purpose other than providing the Bizfloo Cards booking-sync feature you opted into.
- How to revoke access — visit myaccount.google.com/permissions to disconnect Bizfloo, or open Admin → Calendar inside your Bizfloo Cards account and click Disconnect. Either action fully deletes the stored OAuth refresh token on our side.
Limited Use disclosure.Bizfloo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
9. Changes to this policy
We may update this policy from time to time. Material changes will be highlighted with an updated "Last updated" date at the top.
10. Contact
Bizfloo Branding
Raleigh, NC 27601
Email: info@bizfloo.com
Phone: (910) 546-6485
This policy is provided as a general framework and does not constitute legal advice. For binding compliance, consult a licensed attorney.