Privacy Policy

1. Introduction

This Privacy Policy describes how David's Dream LLC, a Texas limited liability company doing business as Biz22 ("Provider," "we," "us," or "our"), collects, uses, stores, shares, and protects your personal information when you use our website, platform, dashboard, and services (collectively, the "Service"). This Privacy Policy applies to all visitors, users, and customers of the Service.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

This Privacy Policy should be read together with our Terms of Service and Refund Policy.

2. Information We Collect

2.1 Information You Provide Directly

When you submit an order, create an account, or interact with the Service, we may collect the following categories of information that you voluntarily provide:

• Personal identifiers: Full name, email address, phone number, mailing address
• Business information: Business name, business type, business description, hours of operation, service and product descriptions, pricing information
• Visual assets: Logo files, photographs, images, and other visual content you upload
• Social media information: Social media profile URLs (Instagram, Facebook, X/Twitter, LinkedIn, YouTube, TikTok, and others)
• Design preferences: Color preferences, style preferences, design references, and written instructions
• Communication content: Messages, support requests, revision instructions, and other communications you send to us
• Domain information: Domain names and DNS configuration details. If you ask us to transfer a domain you already own to Biz22, we also receive the domain's transfer authorization code from you, and we record the domain's public DNS records (see "Domain transfers" below).

2.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

• Device and browser information: IP address, browser type, browser version, user agent string, operating system, device type, screen resolution
• Usage data: Pages visited, time spent on pages, click patterns, referring URLs, navigation paths
• Terms acceptance data: Timestamp, IP address, user agent, and Terms version at the time of acceptance (recorded for legal compliance and dispute resolution purposes)
• Authentication data: Login timestamps, session information, authentication method used (magic link or Google OAuth)
• Cookie data: As described in Section 8 below

Information such as your IP address and raw user-agent string may be processed or retained in connection with security, consent, or transaction records; the first-party analytics record described in Section 4A does not store those fields.

2.3 Information from Third Parties

We may receive information about you from third-party services, including:

• Stripe: Payment confirmation, subscription status, and billing information (we do not receive or store full credit card numbers)
• Google OAuth: Name and email address (if you sign in with Google)

2.4 Client-Uploaded Content

When you upload images (including custom logos, hero images, and about/profile images) or other files during the order process, we store these files on our servers and/or third-party storage services (Supabase Storage) for the purpose of incorporating them into your Website.

• Uploaded images are associated with your account and order record
• Uploaded images may be visible on your publicly accessible Website for as long as your hosting subscription remains active
• We do NOT analyze, verify, or investigate the copyright status or ownership of uploaded content (see our Terms of Service § 11.8)
• Uploaded images may be transmitted to third-party AI services for quality assessment and validation as described in Section 4

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

• Processing and fulfilling your orders
• Generating your Website using AI technology (see Section 4)
• Communicating with you about your project, including status updates, revision requests, and delivery notifications
• Providing customer support
• Managing your account and subscriptions

3.2 Payment Processing

• Processing payments and refunds through Stripe
• Managing subscription billing cycles
• Sending payment confirmations and invoices

3.3 Service Improvement

• Analyzing usage patterns to improve the Service
• Developing new features and functionality
• Quality assurance and testing
• Internal analytics and reporting

3.4 Security & Compliance

• Content screening to enforce our Acceptable Use Policy
• Fraud prevention and detection
• Enforcing our Terms of Service
• Complying with legal obligations
• Responding to legal requests and preventing harm
• Establishing, exercising, or defending legal claims and resolving disputes

3.5 Communications

• Sending service-related emails (order confirmations, project updates, etc.)
• Sending marketing and promotional communications (with your consent or as permitted by law; you may opt out at any time)
• Responding to your inquiries and support requests
• Keeping a list of contacts for Biz22's own business: where you send a message through the contact form on biz22.com and the email address you give is not already associated with a Biz22 account, your name, email address, phone number and message are copied into that list, and Biz22 may send you an email about its services (see Section 4D.2)
• Honoring privacy and messaging opt-out requests across Biz22 customers (see Section 4C.7)

4. AI Data Processing & Third-Party AI Services

Our Service uses artificial intelligence (AI) to generate Websites. This section explains how your data is processed by AI systems:

4.1 Data Sent to AI Providers

To generate your Website, the following categories of your information may be transmitted to third-party AI service providers:

• Business name, type, and description
• Contact information (phone number, email, address)
• Hours of operation
• Service and product descriptions
• Design preferences and instructions
• Uploaded images (for validation and quality assessment)

4.2 AI Service Providers

We use the following AI service providers:

• Anthropic (Claude API) — Used for two separate purposes. First, to generate your Website: content generation, design planning, code generation, quality assurance, content screening, and image validation, using the information described in Section 4.1. Second, to operate the assistant on biz22.com described in Section 4E, which sends a visitor's typed question — not any customer information — so that a published answer can be selected. Data is processed subject to Anthropic's usage policies.
• Google (Gemini API / Imagen) — Used for AI logo generation and supplemental image generation. Data is processed subject to Google's Generative AI terms.

4.3 AI Data Handling

• We transmit only the data necessary to generate your Website
• We do not control how third-party AI providers process, store, or retain data sent to their APIs
• AI providers may have their own data retention policies; we encourage you to review their privacy policies directly
• We do not use your data to train AI models; however, third-party AI providers may have their own policies regarding data usage for model improvement

4A. First-Party Site Analytics (biz22.com and Customer Websites)

Biz22 keeps its own analytics for biz22.com and for the customer websites it hosts (for example, yourbusiness.biz22.com or a customer's own domain), and the two are kept differently: on biz22.com, with your consent, each visit is recorded as individual events; on a customer website, Biz22 keeps only daily counts for the website as a whole and records nothing about the individual visit. No third-party analytics or advertising service runs on customer websites: they load no Google Analytics, no Google Tag Manager and no Meta Pixel, and they show no cookie consent banner. The only analytics on a customer website are the first-party counts described in this section, kept by Biz22 and transmitted to no one else.

4A.1 What the First-Party Record Contains

On a customer website, Biz22 keeps counts, not a record of each visit. For each website and each day it keeps three numbers: page views, clicks on the website's calls to action, and contact-form submissions the website accepted (a count only, never their contents). Nothing else is kept about a visit or a visitor: no individual event, no identifier of any kind, nothing about the visitor's device or location, no referring website, no page path and no time of day. Nothing is stored in the visitor's browser for this purpose. Records made on customer websites before this version of the policy took effect are described in Section 4A.4.

On biz22.com, visits are recorded as individual events, not as totals. The events are: page views, scroll depth, clicks on calls to action, presses of the send button on the contact forms of Biz22's example websites (recorded as an event without storing the contents of the form submission), section views, time on page, order-form steps (including starting the form, which fields were touched and a business-type search that found no match, but not the words searched), the completion of a payment for an order, and, on the home page, a page-speed measurement: how long after the page began loading its largest visible element was drawn on screen. Every event carries the identifier of the site visited, the type of event, and the date and time. Where our hosting provider supplies them with the request, the event also carries the visitor's country, region and city, derived from the network connection. Every event except the send-button press on the contact forms of Biz22's example websites also carries:

• The type of device: mobile, tablet or desktop
• The domain of the referring website only, not the full referring page
• A session identifier: a random value kept in the browser for the visit and tied to no account
• On biz22.com only:the path of the page viewed — never the full URL or its query string
• On biz22.com only:behavioural detail for the event — the section viewed and how many seconds each section of the page was visible, how far down the page the visitor scrolled, how long the page was open, the text of a call-to-action link clicked and the part of the page it was in, and, on the order form, which step was reached and which form fields were touched (not what was typed into them)
• On biz22.com only:a browser label (the browser's name) and the screen dimensions
• A device fingerprint — on biz22.com only, and only after Analytics consent:a truncated one-way hash of the browser's user-agent string joined to its screen dimensions. It is the same for the same browser from one visit to the next, so it links a visitor's separate sessions together and is used to count visitors rather than sessions. No device fingerprint is taken on a customer website
• On biz22.com only: advertising click identifiers captured from the landing address when a visit arrived from an ad — Google's (gclid, gbraid, wbraid) and Meta's (fbclid), which tie the session to a specific ad click on that platform — and any UTM campaign parameters
• On biz22.com only: when a payment for an order is completed, the identifier of that Stripe checkout session, which connects the browsing record to the resulting order and therefore to an identified customer, and the total amount of that payment

Neither the biz22.com record nor a customer website's counts include the visitor's IP address, the raw user-agent string, full URLs or query strings, or the contents of anything else typed into a form. Both are stored on Biz22's own systems and are not transmitted to Google, Meta or any other third party.

4A.2 Consent and Control

On biz22.com, the first-party record is collected only after you accept Analytics cookies in the cookie consent banner. If you have not made a choice, or you select "Reject All," nothing is recorded — no page view, no session identifier, no event of any kind. On customer websites there is no consent banner and no third-party tracking; the daily counts described above are added to during the visit, and nothing about the individual visit is recorded. On any site you can prevent your page views and clicks from being recorded or counted by disabling JavaScript or by using a browser or extension that blocks requests to the site's own analytics endpoints. On a customer website, a contact-form submission is counted by the server that receives it, so blocking the analytics endpoint does not prevent that count. The submission itself is not analytics: Biz22 passes it on to the business and keeps no record of you or of what you wrote, as described in Section 4D.

4A.3 Who Sees It, and What It Is Used For

Biz22 uses these records only to: (a) provide and operate the analytics feature for the customer whose website was visited; (b) detect and prevent abuse, bot traffic and security incidents; (c) monitor platform capacity and performance in aggregate; and (d) detect and fix defects in generated websites. Any other use will be separately disclosed.

Each customer business sees totals for its own website, built from the daily counts (page views and contact-form submissions). A business sees counts only — never the individual events, session identifiers, locations or browser hashes of its visitors. For visits made after this version of the policy took effect, no such individual record exists for a customer website at all. We do not sell these records or share them with any third party.

4A.4 How Long It Is Kept

biz22.com. Individual event records are retained indefinitely; no deletion process currently runs against them, and they are not aggregated or anonymized before storage.

Customer websites, from this version of the policy onward. No individual event record is created. The daily counts described in Section 4A.1 are retained indefinitely, and no deletion process currently runs against them.

Customer websites, before this version of the policy.Visits to customer websites were previously recorded as individual events. Each carried the site identifier and event type, a session identifier, the type of device, the visitor's country, region and city, the domain of the referring website and the date and time; a scroll-depth event also carried how far down the page the visitor scrolled, and a call-to-action click the text of the link clicked. The daily counts kept for customer websites in that period also split page views by type of device. These earlier records have not been deleted or changed, and they are not used to produce the current counts. They are kept pending a decision on how long to keep them, and no deletion process currently runs against them.

Customer websites, a running total kept before this version.Until this version of the policy took effect, each time a customer website's page was requested from Biz22's servers, Biz22 added one to a running total for that website, stored with the website's order rather than with the daily counts. That counter counted requests for the page rather than the page views recorded by Biz22's analytics system. The records available to Biz22 do not establish why the figures differ. Nothing about the visitor was stored with it. Beside it is a time: the same stored field can be written by more than one code path, and the stored value does not identify which code path wrote it. The total is no longer updated and has not been deleted or changed, and neither it nor the time is used to produce the current counts; the time is still written when Biz22's staff first open a paid, pending order that has not previously been opened. Both are kept pending the same decision.

biz22.com, fields recorded before this version.Before this version of the policy took effect, some biz22.com events also recorded: the words typed into the order form's business-type search when it found no match; the address a clicked call-to-action link led to; for an order-form step, the names of required fields left empty and whether the step was complete; and whether the order form was being used for a new order or to add services. These fields are no longer recorded. The earlier records have not been deleted or changed, and they are kept pending a decision on how long to keep them.

4A.5 How to Contact Us About This

If you visited a website Biz22 hosts and have a question about the record described in this section, or wish to make a request about it, contact us at biz22.com/contact— the same route as the "Contact Us" section at the end of this policy. Please tell us the website address you visited and the approximate date and time, so we can locate the relevant records.

4B. Advertising & Meta Pixel (Biz22 Marketing Site)

The Biz22 marketing website (biz22.com) uses Meta Pixel, an advertising analytics tool provided by Meta Platforms, Inc. This section explains how Meta Pixel works and how your data is handled in connection with our Facebook advertising campaigns.

4B.1 What Meta Pixel Does

Meta Pixel is a piece of JavaScript code that tracks visitor behavior on our website and reports certain events to Meta (Facebook) for advertising attribution and remarketing purposes. When enabled, it may collect:

• Page views on biz22.com — the only event type we have configured; no custom event parameters are sent
• Device and browser information used to access the site
• Data from biz22.com's own first-party cookies: Meta's "first-party cookies" setting is enabled for our Pixel, which allows data from those cookies to be shared with Meta

4B.2 Hashed Customer Data (Advanced Matching)

We have Meta's Automatic Advanced Matching enabled on biz22.com. As configured, it permits the Pixel to detect on a page and send to Meta, in hashed form, any of the following: email address, phone number, first and last name, gender, city, state and ZIP code, country, date of birth, and an external identifier. What Meta reports actually receivingis narrower: as of our review of the Meta console on September 5, 2026, Meta reports that 75% of PageView events are receiving hashed email address, first name, last name and phone number through Advanced Matching. Meta's "track events automatically without code" and "automatic events" settings are off; the Pixel reports page views only.

These values are hashed (SHA-256) in your browser before they are sent; raw, plain-text values are not transmitted. Hashing does not make this information anonymous.Meta can match a hashed value against the same information in its own records to identify you or your account — that matching is the purpose of the feature — so we do not describe it as anonymized or de-identified. We do not transmit financial data, government identifiers, or health information.

4B.3 Consent and Opt-Out

Meta Pixel is classified as a Marketing cookie and loads only if you accept Marketing cookies in our cookie consent banner. If you have not made a choice, or you decline Marketing cookies, the Pixel does not load and nothing is sent to Meta. The banner appears on your first visit. You can change your choice at any time using the "Cookie settings" link at the bottom of every page of our website.

4B.4 Meta's Data Use

Data transmitted via Meta Pixel is processed by Meta Platforms, Inc. subject to Meta's Privacy Policy. Meta may use this data to show you relevant ads on Facebook and Instagram, measure ad performance, and build advertising audiences. We encourage you to review Meta's privacy policy and use Meta's Ad Preferences tool to manage your ad settings.

4C. Booking Data (Online Booking)

Some Biz22-hosted business websites include an online appointment-booking widget (the optional Online Booking). This section explains how data submitted through that widget is handled. It applies to you if you book an appointment with a business through a Biz22-hosted website — you are a "Booker," a customer of that business, not of Biz22.

4C.1 What Is Collected, and From Whom

When a Booker books an appointment, the widget collects:

• Name, email address, and phone number (phone where provided, or required when text message notifications are selected)
• Appointment details: the service, staff member, date, and time booked
• Responses to any intake questions the business has configured
• The booking-time consent acknowledgment
• Appointment history with that business, including cancellations and no-shows
• Where the business uses text message notifications: the content of appointment-related text messages sent to the Booker, and of any replies the Booker sends

Collectively, "Booking Data." Booking Data is collected from Bookers — third parties who are customers of the business — not from Biz22's own customers.

4C.2 The Business Is the Controller; Biz22 Is the Processor

The business you book with is the data controller of your Booking Data: it decides why the data is collected and is responsible for its own privacy practices and legal compliance. Biz22 acts as a data processor / service provider, handling Booking Data solely on the business's behalf to operate the booking feature — accepting bookings, managing appointments, and sending appointment notifications. Biz22 does not use identifiable Booking Data for its own marketing, advertising, or any purpose beyond operating the feature; Biz22 may use aggregated, de-identified statistics (for example, platform-wide average booking rates) that do not identify any individual Booker, as described in Section 3C.8 of our Terms of Service. Text messages are different. Biz22 sends appointment texts itself, as the sender, for every business that uses its booking tool. Biz22 keeps the record of your choice about receiving appointment texts and of any opt-out, and uses those records only to run the text-message program and to comply with messaging rules (see Section 4C.7 and our SMS Terms).

4C.3 Notification Delivery (Resend and Twilio)

Appointment notifications are delivered through third-party sub-processors: email notifications through Resend, Inc. (which receives the Booker's email address and the notification content), and — where the business's Online Booking includes text messages — text notifications through Twilio Inc. (which receives the Booker's phone number and the content of messages sent and received). Both are listed with policy links in Section 5. See Section 13 for how text-messaging opt-in data and consent are treated.

4C.4 Retention

Booking Data is retained while the business's Online Booking subscription is active. If that subscription ends, scheduling records — appointments, Booker client records, intake responses, appointment notification logs, and logs of inbound text messages from Bookers — are deleted from Biz22's active systems approximately thirty (30) days later, unless the business resubscribes within that window. After that deletion, copies may persist for a limited period in our database provider's routine backups, and copies of text messages remain in Twilio's own message logs under Twilio's retention practices (see Section 7). Certain business records (for example, billing and transaction records) may be retained beyond that window under the retention practices described in Section 7. We may retain records used to calculate, verify, or dispute Text Message Notification charges, including the business associated with the message, the SMS provider's message identifier, the reported or calculated segment count, its source, and the time the message was sent. We retain these records for billing, accounting, dispute resolution, and legal compliance and do not use them to reconstruct the message content or identify the Booker's phone number. One category is deliberately excluded from this deletion: the platform-wide opt-out record described in Section 4C.7. The record of a Booker's choice about receiving appointment text messages (including the phone number, the business named in the agreement, whether the text-message box was selected, the version of the agreement shown, and the time) is also kept separately from the business's scheduling data, for five (5) years from when the choice was recorded, so that Biz22, as the sender, can show the basis for its text-message sending decisions. It is then deleted.

4C.5 Booker Rights: Requests Go Through the Business

Because the business is the controller of your Booking Data, requests to access, correct, or delete it should be directed to the business you booked with— its contact details appear on its website. If you contact Biz22 directly with such a request, we will direct it to the business rather than acting on it independently, except where the law requires us to act. Biz22 maintains the ability to export a Booker's record and appointment history, and to delete them from Biz22's active systems, and fulfills these actions on the business's behalf; after such a deletion, copies may persist for a limited period in backups and in providers' systems as described in Section 7. To cancel a specific appointment, use the manage link included in your booking confirmation.

4C.7 Platform-Wide Opt-Out Record

If you are a Booker and you reply STOP (or an equivalent opt-out keyword) to an appointment text message, we keep a minimised record containing the last ten digits of the phone number for the sole purpose of honouring that request. We are describing it separately because it works differently from everything else in this section:

• We keep it indefinitely. It is deliberately excluded from the thirty (30) day deletion described in Section 4C.4, and it survives the business cancelling its subscription.
• It applies across every business on the platform.Once you opt out at a given number, you will not receive appointment text messages from any business using Biz22 at that number — not only the business you replied to. This is the one respect in which we process Booker information across businesses rather than solely on one business's behalf, and we do it to honour opt-out requests reliably.
• We do not delete it on request, including at your own request.Deleting it would cause text messages to that number to resume, which is the opposite of what you asked for. You can reverse it yourself at any time by sending START or UNSTOP from that number.

We keep this record ourselves, rather than relying on our messaging carrier's own opt-out list, because carrier-held opt-out records are tied to the account that owns a particular phone number and do not reliably survive that number being re-provisioned or moved between accounts.

4D. Contact-Form Submissions (Customer Websites and biz22.com)

Many Biz22-hosted business websites include a contact form, and so does biz22.com. This section explains what happens to a message sent through one of those forms. If you send a message through a business's website, you are a customer or prospective customer of that business, not of Biz22: Biz22 passes your message on to the business and keeps no record of you or of what you wrote. If you send a message through biz22.com, you are writing to Biz22 itself, and Biz22 keeps it, as described below.

4D.1 What Happens When You Press Send

On a business's website, your submission is sent to an endpoint on Biz22's own servers, not directly to the business. Biz22 checks it for spam and abuse, passes it on to the business by email, and keeps no record of you or of what you wrote. (The website separately counts accepted submissions in its daily analytics, as described in Section 4A; that count contains nothing from the form.)

On biz22.com, your submission is sent to the same endpoint, and Biz22 checks it and stores it, as described in Section 4D.2.

On biz22.com, your message is sent to Biz22 itself, and you also receive an email confirming that it arrived. On a business's website, your message is sent to the business, and no confirmation email is sent to you.

4D.2 What Is Stored

On a business's website, Biz22 stores nothing about you and nothing from your message. It keeps a record that a message was passed on. That record holds when it happened, which website the submission named, that website's business name, the address the message was sent to, and which kind of address that was: the mailbox Biz22 provisioned for the business, an address the business's domain forwards to, the business's own account address (used when neither of the others exists), or Biz22's own inbox, used when the website named is not one Biz22 hosts. It holds nothing you entered. Separately, when the website is one Biz22 hosts and is live, its daily count of accepted submissions (Section 4A) goes up by one; the count contains nothing about you either.

On biz22.com, for each submission Biz22 accepts, it stores:

• The name, email address and message you entered, and your phone number if you gave one
• The date and time it was received
• Whether a Biz22 administrator has read or answered it, and the text of any reply Biz22 sends you
• If the email address you gave belongs to an existing Biz22 account, a link to that account
• A record that the notification email was sent, including your email address and the address it was sent to

If the email address you gave on biz22.com is not already associated with a Biz22 account, your name, email address, phone number and message are also copied into a list of contacts that Biz22 keeps for its own business. Biz22 administrators can see that list and can send an email about Biz22's services to the addresses on it.

4D.3 Checks Before a Submission Goes Further

Biz22's server reads the network (IP) address your submission comes from and uses it to limit how many submissions can be sent from one address in a short period, which protects the form against spam and abuse. The address is kept in the server's memory for that check, where it can remain for as long as that server process keeps running; it is not written to Biz22's database and is not stored with your submission.

A submission can be turned away before it is passed on or stored: if too many have come from the same address recently, if a required field is missing or the email address is not valid, or if automated checks judge it to be spam. In that last case the form may still say that your message was sent, although nothing was stored or delivered.

On a business's website, if your submission passes these checks but the email to the business cannot be sent, the form tells you at once that it failed, so that you can send it again. Biz22 does not hold a copy to fall back on. On biz22.com, a submission is stored before the email is sent, so if the email then fails, the form reports an error and the stored copy remains.

The same check, holding an address in memory for the same period, runs on the biz22.com assistant described in Section 4E. In both cases this is a temporary operational check, not an analytics identifier and not part of any stored record of what you wrote.

4D.4 Who Receives It, and Who Can See It

On a business's website, the business receives your submission as an email, sent to the address it uses with Biz22, with your email address set as the reply-to address so that it can answer you directly. Biz22 does not store your message, so there is no stored copy for Biz22 administrators to view; they can see only the record, described in Section 4D.2, that a message was passed on. The business's Biz22 dashboard shows only the number of submissions (Section 4A).

On biz22.com, Biz22 administrators can see every stored submission in Biz22's internal administration tools, and can reply to its sender by email from Biz22. Stored submissions are kept in Biz22's database, under the storage and security arrangements described in Section 6.

On both, the email is delivered through our email delivery provider, Resend, listed in Section 5, which holds its own copy of the email for the period stated in Section 7.

4D.5 What It Is Used For

On a business's website, Biz22 uses your submission only to receive it, to protect the contact form against spam and abuse, and to pass it on to the business.

On biz22.com, Biz22 uses a submission to receive and process it, to protect the contact form against spam and abuse, and to respond to it. Biz22 administrators may also reply to its sender. Where a copy is added to the contact list described in Section 4D.2, Biz22 may also use it to send you information about Biz22's services.

4D.6 How Long It Is Kept

On a business's website, Biz22 keeps no copy of your submission. The record that a message was passed on, described in Section 4D.2, is retained indefinitely, and no deletion process currently runs against it. The website's daily count is retained as described in Section 4A.4.

On biz22.com, stored submissions, any reply Biz22 sends, the record that the notification email was sent, and any copy added to the contact list described in Section 4D.2 are retained indefinitely; no deletion process currently runs against them.

On both, our email delivery provider holds its copy of the email for the period stated in Section 7, and whoever received the email keeps it under their own practices. The retention table in Section 7 states the same.

4D.7 How to Contact Us About This

If you wrote through a business's website, your message is held by that business, in the email it received; Biz22 keeps no copy. To ask about your message, or to make a request about it, contact the business directly — its contact details appear on its website. For questions about this section, or about the record that a message was passed on, contact us at biz22.com/contact or see Section 10, and tell us which website you used and the approximate date.

If you wrote through biz22.com, to ask about a submission Biz22 has stored, or to make a request about it, contact us at biz22.com/contact or see Section 10. Please tell us the approximate date and the email address you entered, so that we can locate it.

4E. The Assistant on biz22.com

biz22.com offers an assistant that answers questions about our service. It identifies itself as an AI assistant, and it is available only on biz22.com — never on a customer's website.

What happens to what you type. Your question is sent to Anthropic, PBC, which we use to decide which of our already-published answers (from our FAQ, Domain Guide and Email Guide pages) best matches it. The reply you see is that published text, or one of a few short fixed replies we wrote in advance — for example, a greeting, a thank you, a note on what the assistant can help with, a statement that it is an AI assistant and not a person, or a note that it answers only in English. None of these fixed replies contains information about our service or prices, and the assistant does not write answers of its own. If nothing matches, it tells you so and offers our contact form.

What we keep. We do not store what you type. For each reply we record which prepared answer was shown or, when none was, a general category for the question chosen from a fixed list — never your words — together with the date and time. That record contains no name, no email address, no IP address, no cookie, no session identifier, and nothing that links it to you or to any other record we hold. We use it to find the kinds of question the assistant could not answer, so we can publish answers to them. This record exists only as a line in our hosting provider's request logs, which the provider keeps for one (1) day; we do not copy it into any database of our own. Separately from that record, and like every request to our website, when your browser sends a message to the assistant, our hosting provider's request log records standard technical details about that request — including your IP address, the time and your browser type. That log does not contain what you typed, and Biz22 does not keep your message. Our hosting provider keeps those request logs for the same one (1) day, and we do not use them to identify you.

What Anthropic keeps. Anthropic deletes inputs and outputs within thirty (30) days. That period is subject to exceptions: a different retention arrangement agreed with Anthropic, enforcement of Anthropic's Usage Policy, and legal requirements. Where enforcement of that Usage Policy or a legal requirement applies, inputs and outputs may be kept for up to two (2) years and trust-and-safety classification scores for up to seven (7) years. We do not have a zero-data-retention agreement with Anthropic, so the ordinary thirty-day period and those exceptions are what apply.

The conversation is not saved. Your messages are held by your own browser for the length of the conversation and are sent back with each question so the assistant has context. We keep no copy, and closing the page ends it. (Our server limits how many earlier messages it will accept with a question. That limit is a constraint on what we will process, not a statement that we retain any of them — we retain none.)

What the assistant cannot see. It has no access to accounts, orders, payment information, or anything a customer has given us. It can read only the published information described above.

Please do not type anything sensitive. Your question is sent to Anthropic, so treat it as you would any message sent over the internet to a third party. This is a precaution we are asking you to take — it is not an assurance that sensitive information cannot reach Anthropic, because what you type is transmitted whatever it contains. If you need to give us personal details, use our contact form (Section 4D) instead.

Your address is used for rate limiting on this route in the same way, and for the same short period, as described in Section 4D.3.

4F. Partners Page Listing

If you choose to be listed, or accept a promotional offer that includes a listing, Biz22 may display your business name, business category, city and state, a screenshot or preview of your website (which may show your logo and other content on it), and a link to your website. We do this only to feature participating customers and their websites on Biz22's Partners page and in Biz22's marketing materials. If your business name is also your personal name, that name may appear. You can ask us to remove the listing at any time (support@biz22.com). We then stop creating any new use of it, and remove it from our website within ten business days. See Terms §11.9.

5. Third-Party Service Providers

We use the following third-party services to operate the Service. Each may receive certain categories of your data as necessary to perform their functions:

For Premium Plan Clients, in addition to the information Sherweb and Google receive as described above, Biz22 itself retains ongoing Google Workspace Super Administrator access to your organization for the duration of your subscription, including the technical ability to access the content of your mailbox. See our Terms of Service, Section 6.8, for the scope, purpose, and duration of this access.

We require our service providers to protect your information and use it only for the purposes for which it was disclosed. However, we are not responsible for the privacy practices or data security of third-party providers. We encourage you to review their privacy policies directly.

6. Data Storage & Security

6.1 Storage Location

Your data is stored on servers located in the United States, operated by our third-party infrastructure providers (Supabase and Vercel). One exception: if you subscribe to the Standard Plan, the content of your professional mailbox is stored on Qboxmail's infrastructure in the European Union (see Sections 5 and 7). By using the Service, you consent to the storage and processing of your data in these locations.

6.2 Security Measures

We implement reasonable technical and organizational security measures to protect your data from unauthorized access, loss, alteration, or misuse, including:

• Encryption in transit (TLS/SSL) for all data transmissions
• Encryption at rest for stored data
• Row-level security (RLS) policies on our database to restrict data access
• Role-based access control (RBAC) for administrative functions
• Secure authentication via magic links and OAuth (no passwords stored)
• Webhook signature verification for payment processing
• Regular security assessments and updates

6.3 No Absolute Guarantee

No method of internet transmission or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your data, we cannot guarantee absolute security. You acknowledge and accept the inherent risks of transmitting data over the internet and using cloud-based services.

7. Data Retention

We retain your data according to the following guidelines:

• Account and order data: Retained for as long as your account is active, and for a minimum of seven (7) years after account closure for financial, tax, and legal compliance purposes.
• Website data:Retained during active subscription, through the 30-day grace period, and for up to 90 days after archival. After 90 days, the website data is deleted from Biz22's active systems.
• Communication records: Retained for a minimum of three (3) years for dispute resolution and quality assurance purposes.
• Payment records: Retained for a minimum of seven (7) years as required by tax and financial regulations.
• Terms acceptance logs: Retained indefinitely for legal compliance and dispute resolution.
• AI generation records:The reports our AI agents produce for an order (the request review, the build notes and the quality-assurance report) are part of that order's record and are retained with it, under the account and order data period above. Separate diagnostic logs of generation defects and prompt tests are retained until deleted; we do not currently apply a fixed deletion period to them.
• First-party site analytics: On biz22.com, retained indefinitely, as individual events; no deletion process currently runs against them, and they are not aggregated or anonymized before storage. On customer websites, from this version of the policy onward, no individual event record is created; the daily counts per website are retained indefinitely, and no deletion process currently runs against them. Individual event records made on customer websites before this version have not been deleted or changed; they are kept pending a decision on how long to keep them, and no deletion process currently runs against them. A running total of page requests kept for each customer website before this version, and the time stored beside it, are no longer updated; they have not been deleted or changed, and are kept pending the same decision. Some biz22.com event records made before this version also hold fields that are no longer recorded; they too have not been deleted or changed. Section 4A.4 is the authoritative statement of what these records contain and how long they are kept.
• Contact-form submissions:On a business's website, Biz22 keeps no copy of the submission; the record that a message was passed on is retained indefinitely, and no deletion process currently runs against it. On biz22.com, stored submissions are retained indefinitely; no deletion process currently runs against them. This covers the stored submission, any reply Biz22 sends, the record that the notification email was sent, and any copy added to Biz22's contact list. Section 4D describes what is kept, and Section 4D.6 repeats this retention statement.
• the assistant on biz22.com (Section 4E) keeps no record of what visitors type; the record it does keep — which prepared answer was shown or, when none was, a category from a fixed list, and when — carries no identifier and exists only in our hosting provider's request logs, which the provider keeps for one (1) day; we keep no separate copy. Like every request to our website, the request carrying a message to the assistant is also recorded in those logs with standard technical details, including the IP address, for the same one (1) day, but the message content is not recorded.
• Uploaded content (logos, hero images, about images): Client-uploaded images and files are retained for the duration of the active service period plus 90 days after account termination (consistent with the Website restoration window in Section 12.3 of our Terms of Service). However, copies may be retained longer if required for ongoing legal proceedings, dispute resolution, or compliance with legal obligations related to intellectual property claims.
• Booking Data (Online Booking):Retained while the business's Online Booking subscription is active, then deleted from Biz22's active systems approximately thirty (30) days after that subscription ends (see Section 4C.4). Logs of inbound text messages from Bookers are deleted together with the rest of the Booking Data in that same window, not retained beyond it — with one deliberate exception: the platform-wide opt-out record described in Section 4C.7, which contains the last ten digits of the phone number, is retained indefinitely, and applies across every business on the platform, because deleting it would resume texting someone who asked us to stop.
• Professional mailbox email content (Standard Plan):The content of email messages you send and receive through a professional mailbox is hosted by our third-party email provider (Qboxmail — see Section 5) and is subject to that provider's own retention and privacy terms. Provider does not independently archive your mailbox message content, and its availability is governed by your active mailbox service.

Deletion from our active systems is what the periods above describe.After that point, copies may persist for a limited time outside those systems: in our database provider's routine backups, until the provider's backup cycle overwrites them; in our hosting provider's request logs, which are kept for one (1) day; and in the systems of the service providers listed in Section 5 under their own retention practices. Of those, we have verified the following: our email delivery provider (Resend) holds message content and delivery logs for thirty (30) days; Twilio keeps text-message logs available to us for thirteen (13) months by default and retains backups beyond that; and our AI providers hold prompts and outputs for up to thirty (30) days (Anthropic) or fifty-five (55) days (Google), longer where content is flagged for abuse review. We state a period only where we have verified it.

You may request deletion of your personal data as described in Section 10. However, we may retain certain information as required by law, for legitimate business purposes, or to enforce our rights.

8. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyze website performance, and provide certain features. A cookie is a small text file stored on your device when you visit our website.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the website to function properly. These enable core functionality such as authentication, session management, security, and accessibility. You cannot opt out of these cookies as the Service cannot operate without them.
• Analytics Cookies:Accepting Analytics cookies does two things on biz22.com. It allows Biz22's own first-party record of your visit, described in Section 4A. And it causes your browser to load Google Tag Manager, a container provided by Google LLC, which loads Google Analyticsand reports the pages you view to Google, with the page address, the page title, information about your browser and device, and identifiers included in the Analytics request. When you have not accepted Marketing cookies, Biz22's settings send them marked as not permitted for advertising use; that marking is a setting Biz22 sends with each report, and it does not by itself determine what Google does with the data. Accepting Analytics cookies may also cause information about the page you are viewing, including its web address, to be transmitted to a Google advertising-related endpoint. This happens even when you have declined Marketing cookies, and the marking described above does not prevent it. Declining Analytics cookies keeps Google Analytics from loading, and if you also decline Marketing cookies, Google Tag Manager is not loaded at all and nothing is sent to Google for analytics or advertising.
• Marketing Cookies: Used to track visitors across websites to display relevant advertisements and measure campaign effectiveness. We use Meta Pixel (provided by Meta Platforms, Inc.) as a Marketing cookie — it reports page views on biz22.com to Meta and, through Automatic Advanced Matching, sends hashed email, name and phone number on most page views (see Section 4B.2). We also use Google Ads(provided by Google LLC, through the Google Tag Manager container described above) as a Marketing cookie — it reports page views on biz22.com to Google Ads and may add your browser to Biz22's advertising audiences. Declining Marketing cookies keeps Meta Pixel from loading, so nothing is sent to Meta. It does not prevent every transmission to a Google advertising-related endpoint: as described under Analytics cookies above, accepting Analytics may cause such a transmission even when Marketing cookies are declined. We do NOT sell your personal information to third parties for advertising purposes.

8.2 Your Cookie Choices

When you first visit our website, you will see a cookie consent banner allowing you to accept all non-essential cookies, reject them all, or choose categories under "Manage Preferences", where Analytics and Marketing both start switched off. Until you make a choice, no non-essential cookie is set. You can change your choice at any time using the "Cookie settings" link at the bottom of every page of our website. You can also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

8.3 Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. Currently, there is no industry standard for how websites should respond to DNT signals. At this time, our Service does not respond to DNT signals. However, you may control tracking through the cookie preference tools described above.

9. International Data Transfers

If you are accessing the Service from outside the United States, please be aware that most of your data will be transferred to, stored, and processed in the United States, where our core infrastructure providers (Supabase and Vercel) are located. One exception is Standard-Plan professional mailbox content, which is hosted in the European Union by Qboxmail (see Sections 5 and 7). By using the Service, you explicitly consent to the transfer and processing of your data in these locations.

The data protection laws of the United States or the European Union may differ from those in your jurisdiction. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy, but we do not guarantee that the level of protection will be equivalent to that in your home jurisdiction.

10. Your Rights & Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information:

10.1 General Rights

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request a machine-readable copy of your data where technically feasible
• Opt-out of marketing: Unsubscribe from marketing communications at any time by clicking the "unsubscribe" link in any marketing email or contacting us

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share your data
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out of Sale or Sharing: Biz22 does not sell your personal information for monetary consideration. Biz22 may disclose personal information to advertising-related service providers in connection with advertising, attribution, measurement, or remarketing as described in Sections 4B and 5. Some disclosures for cross-context behavioral advertising may constitute "sharing" under the CCPA. If the CCPA applies to Biz22, you may have the right to opt out of the sale or sharing of your personal information, including for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Right to Correct: You have the right to request correction of inaccurate personal information
• Right to Limit Use of Sensitive Information: You may request that we limit the use and disclosure of sensitive personal information to only what is necessary to provide the Service

To exercise your CCPA/CPRA rights, please contact us via our contact form. We will respond to verifiable consumer requests within forty-five (45) days.

10.3 European Economic Area (EEA) and UK Residents (GDPR)

If you are located in the EEA or UK, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis for processing: We process your data based on: (a) contractual necessity (to fulfill our obligations under the Terms of Service), (b) legitimate interests (to improve and secure the Service), (c) consent (for marketing communications and non-essential cookies), and (d) legal obligation (for tax and financial record-keeping)
• Right to restrict processing: You may request restriction of processing in certain circumstances
• Right to object: You may object to processing based on legitimate interests
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal

To exercise your GDPR rights, please contact us via our contact form.

10.4 Limitations on Deletion

Please note that we may be unable to fully delete your data if retention is necessary for:

• Completing a transaction or fulfilling an ongoing service
• Compliance with legal, tax, or regulatory obligations
• Detecting and preventing fraud or security incidents
• Exercising or defending legal claims
• Internal record-keeping required for financial auditing

11. Automated Decision-Making

We use automated systems (including AI) to make certain decisions that may affect you:

• Content Screening: Automated content screening systems evaluate order submissions for compliance with our Acceptable Use Policy. Orders flagged by automated systems may be subject to additional manual review.
• Website Generation: AI systems make automated decisions about design, layout, color selection, and content arrangement based on the information you provide.
• Quality Assurance: Automated AI review systems evaluate generated Websites for quality, accuracy, and compliance with design standards.

These automated processes are integral to the Service and cannot be opted out of while using the Service. If you have concerns about automated decisions that affect you, please contact us via our contact form.

12. Children's Privacy

The Service is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 13 years of age (or such higher age as may be required by applicable law, such as 16 in the EEA under GDPR). If we become aware that we have collected personal information from a child under the applicable age, we will take steps to delete such information promptly.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact us via our contact form so that we can take appropriate action.

13. When We Share Your Information

We may share your information in the following circumstances:

• Service providers: With third-party service providers who assist us in operating the Service, as described in Sections 4 and 5 above
• Legal requirements: When required by law, subpoena, court order, or government request, or when we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request
• Business transfers: In connection with a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction involving all or a portion of our business, your data may be transferred to the acquiring entity
• With your consent: When you have given us explicit consent to share your information for a specific purpose
• Dispute resolution: With payment processors, financial institutions, collection agencies, or legal counsel in connection with payment disputes, chargebacks, or legal proceedings
• Published Websites: Information you include in your Website (business name, contact details, services, images) will be publicly accessible on the internet when your site is live
• Copyright claims & legal compliance: We may disclose information about Client-uploaded content — including the content itself, upload metadata, and Client identity and contact information — to: (a) copyright holders or their authorized representatives who submit valid DMCA takedown notices; (b) law enforcement agencies when required by law or legal process; (c) courts or arbitration panels in connection with intellectual property disputes; and (d) our legal counsel for the purpose of evaluating and responding to infringement claims. See Terms of Service § 11A for our DMCA compliance policy.

We do NOT sell your personal information to third parties for their own marketing or advertising purposes.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. This does not limit the service providers that deliver the messages you asked for (such as our SMS provider, Twilio), which receive your number and message content only to send those messages.

14. Data Breach Notification

In the event of a data breach that affects your personal information and poses a risk to your rights and freedoms, we will notify you as required by applicable law. We will make reasonable efforts to notify affected users via email within seventy-two (72) hours of becoming aware of the breach, where feasible.

15. Third-Party Links & Services

The Service or your Website may contain links to third-party websites or services that are not owned or controlled by Provider. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We strongly advise you to review the privacy policy of every site you visit.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. For material changes that significantly affect how we handle your personal information, we will make reasonable efforts to provide advance notice via email.

Continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the updated policy, you should discontinue use of the Service.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us at:

David's Dream LLC (d/b/a Biz22)
biz22.com/contact

For CCPA/GDPR data requests, please indicate "Data Rights Request" in your message and provide sufficient information to verify your identity.