BizUApp Privacy Notice

Revision: 2026-09-01.1

Effective date: 1 September 2026

Language: English source text for the first-Beta NL/EN/RO legal set

This Privacy Notice explains how personal data is processed in connection with BizUApp. It applies specifically to BizUApp and is separate from privacy information that may apply to mybizu.com, the BizU webshop, or another separate BizU service.

It applies to registered BizUApp users and, where relevant, to other people whose personal data is processed through a supported BizUApp feature. In particular, it also applies where an approved provider uses the supported Manual Booking function to enter limited contact details for a customer who does not have a BizU account.

1. Controller and contact details

The controller for the BizUApp processing described in this Notice is:

Registered enterprise name: Bizu, Sandel

Commercial name: Bizu

KBO registered entity type: natural person

Enterprise number: 0662.815.846

VAT number: BE0662815846

Address: Bobijnstraat 3, 8800 Roeselare, Belgium

Email: bizu@bizu.be

Phone: +32 492 44 43 33

The controller is established in Belgium. You may use bizu@bizu.be for privacy questions and data-subject requests.

2. Scope and privacy principles

BizUApp is an AI-assisted personal productivity application with modules that may include Budget, Reservations, Bookings, To-Do, Shopping, SmartHub / Home Assistant, Notes, Blog / Feed, Settings, account functions, and BizU AI Assistant.

The personal data processed depends on the features you use and on whether the data is provided directly by you, generated through your use of BizUApp, or received from another source such as a booking provider.

BizU applies principles including:

data minimization;
purpose limitation;
privacy and security by design;
user/account isolation;
minimized technical logging under the applicable logging rules;
no sale of personal data;
controlled AI context rather than unrestricted background access to all user data.

3. First-Beta age eligibility

For the first public Beta in Belgium, the Netherlands, and Romania, registered BizUApp accounts are limited to users aged 18 or older.

Before normal registration, BizUApp asks for a simple binary self-declaration that the person is 18 or older. The first-Beta eligibility gate does not require a date of birth, birth year, identity document, selfie, biometric age signal, or KYC evidence, and does not create a separate persistent age record solely for that gate.

The declaration is an eligibility control, not verified proof of age.

4. Categories of personal data

4.1 Account and authentication data

BizUApp uses Firebase Authentication for registered accounts. Depending on the account state and features used, account-related data may include:

email address;
Firebase user identifier (UID);
display name and profile information you provide;
email-verification status;
account creation and update metadata;
authentication and security metadata necessary to keep the account secure.

Passwords are handled through the authentication provider. BizU does not need your plaintext password for normal application processing.

For the first-Beta user-facing registration scope, BizUApp uses email-and-password authentication; guest or anonymous registration is not supported.

4.2 Registration legal-evidence record

When a new registered account is subject to the current legal set, BizU records a limited registration legal-evidence record. It may include:

your UID;
the applicable legal-set identifier;
the Terms document identifier and revision;
the Privacy Notice document identifier and revision;
the revision-specific URLs associated with those documents;
the fact that the Terms were agreed;
the separate fact that the Privacy Notice was acknowledged;
the language shown during the acceptance event;
the server-recorded acceptance timestamp;
technical evidence-format metadata.

The Privacy Notice acknowledgment is not consent to all personal-data processing and is not proof that every separate processing activity is lawful. Each purpose relies on its own applicable lawful basis.

4.3 Profile and preference data

BizUApp may process profile settings, language, theme, app preferences, and other configuration you choose to save.

4.4 Budget, Reservations, To-Do, and planning data

If you use these modules, BizUApp may process information you enter or create for personal organization, such as budget and transaction records, categories, planned expenses, reservations, subscription-related planning records, tasks, statuses, dates, reminders, and related user-entered information.

4.5 Notes and personal knowledge

Notes can contain free text chosen by you and may therefore contain sensitive or confidential information even when BizUApp does not ask you to provide it.

Raw Notes titles, content, and tags are excluded from the default first-Beta AI business context. If BizU later introduces an explicit Notes-to-AI feature, that processing must be made clear to the user and handled under the applicable privacy and AI-context controls.

Do not use Notes as a password manager or intentionally store credentials or secrets that do not need to be present there.

4.6 Bookings data

If you use Bookings, BizUApp may process information needed to find providers, request or manage bookings, and maintain booking integrity, including:

user and provider identifiers;
service and provider references;
requested and confirmed date/time information;
booking status and lifecycle information;
information needed to display or manage the booking;
limited contact information where necessary for the booking flow.

Manual Booking for a person without a BizU account

An approved provider may use the supported Manual Booking function to create a booking for a customer who does not have a BizU account. In the current supported flow, the provider supplies:

customer name - required for the Manual Booking record;
email address - optional;
phone number - optional.

For that non-account customer, the source of the personal data received by BizU is the provider who creates the Manual Booking. BizU processes those details only for the limited booking, schedule-integrity, communication where applicable, platform-operation, security, and legal purposes described in this Notice.

4.7 Provider and partner information

If you use a provider/partner-facing capability, BizUApp may process application, ownership, profile, review, public-listing, service, moderation, and operational information associated with that role. Separate professional terms may apply to the business relationship, but this Privacy Notice describes relevant personal-data processing within BizUApp.

4.8 Shopping and local preference data

Shopping may process public partner/item information and user preferences such as saved, wishlist, or recently viewed items where those features are used.

Viewing a third-party partner listing does not by itself mean BizU sends your identity to that partner. If you follow an external link, request contact, or otherwise interact with the third party, that party may process data under its own privacy information.

4.9 SmartHub / Home Assistant data

SmartHub can connect to a Home Assistant system configured by you.

Home Assistant connection credentials and configuration are handled under the platform-specific BizUApp security model. Home Assistant tokens and the user's Home Assistant Base URL are not included in BizU AI context.

When you use SmartHub, BizUApp may process device or entity state needed to display the feature or perform a user-requested action. When SmartHub context is used by BizU AI, only minimized selected context should be sent; unrestricted raw Home Assistant payloads and credentials are not part of normal AI context.

Home Assistant remains an external system controlled by the user.

4.10 BizU AI Assistant data

When you use BizU AI Assistant, BizUApp may process:

the message or request you submit;
the locale and technical request metadata;
selected structured BizUApp context needed to answer the request;
the AI response;
limited conversation or session state where the active product flow requires it.

BizU AI uses controlled context. It is not intended to receive every piece of data stored in BizUApp for every request.

Client and proxy logging must not be used as a secondary store of raw AI conversations or raw structured user context where BizU's logging rules prohibit that content.

4.11 Backups

If you use an available cloud-backup feature, BizUApp may store backup files in the user-scoped backup area associated with your account. Backup handling and deletion are tied to the supported backup and account-deletion lifecycle.

4.12 Technical, security, and diagnostic metadata

BizUApp and its service providers may process technical metadata required to operate and secure the service, such as request status, authentication status, timestamps, error categories, device/platform information, network/security metadata, and redacted identifiers.

BizU's client-side logging policy prohibits raw AI content, raw AI context, secrets, Home Assistant credentials, financial values, raw booking payloads, and comparable sensitive content from becoming ordinary client logs.

5. Sources of personal data

Most personal data comes directly from you or is generated through your use of BizUApp.

Other data may come from:

Firebase Authentication and other technical service providers;
a booking provider involved in a booking;
for a non-account Manual Booking customer, the provider who enters the customer's name and any optional email address or phone number into the supported Manual Booking flow;
public partner or product information used for Shopping discovery;
the Home Assistant system you configure;
BizUApp and server-side processing needed to maintain account, booking, reservation, security, or other application state.

6. Purposes, lawful bases, and required versus optional data

BizU processes personal data only where an applicable lawful basis exists. The principal first-Beta purposes are set out below.

6.1 Account creation, authentication, and operation - Article 6(1)(b) GDPR

Processing of the account identifier, email address, authentication state, and necessary account data is required to create, authenticate, secure, and operate the registered BizUApp account and to perform the Account/Platform contract.

The email address and authentication credentials required by the authentication flow are necessary to create a first-Beta registered account. If you do not provide them, BizU cannot create or authenticate the account.

The 18+ self-declaration is necessary to pass the first-Beta registration eligibility gate, but BizU does not create a separate persistent age record solely for that declaration.

6.2 Functions you choose to use - Article 6(1)(b) GDPR where processing is necessary to provide the requested function

When you choose to use a BizUApp function, BizU may process the data objectively necessary to provide that requested function as part of the Account/Platform service. This may include personal planning modules, Bookings, Shopping preferences, SmartHub interactions, backups, and BizU AI Assistant. Provider-facing processing is also subject to the separate purposes and interests that apply to that role.

Data for optional modules is not required merely to hold a basic account. If you do not provide or generate the data needed for a particular optional function, that function may be unavailable or unable to provide the requested result, but unrelated functions are not made mandatory merely because the module exists. Where a particular optional processing activity relies on a different lawful basis, BizU identifies that basis in this Notice or in the specific information presented for that processing.

6.3 Terms acceptance during the active account - Article 6(1)(b) GDPR

Recording the applicable Terms acceptance is necessary to establish and manage the registered Account/Platform contractual relationship and to determine whether the account has completed the acceptance-required legal version.

If you do not expressly agree to a Terms version that is required for registration or continued account use, the relevant acceptance-required flow cannot be completed.

6.4 Privacy Notice acknowledgment during the active account - Article 6(1)(f) GDPR

BizU has a legitimate interest in retaining minimal evidence of which Privacy Notice revision was presented and acknowledged during the registration legal event, for transparency, accountability, and related evidentiary purposes. The acknowledgment is not consent.

Acknowledgment of the applicable Privacy Notice is required to complete the current registration legal-information flow. Refusing to acknowledge it means that flow cannot be completed, but the acknowledgment does not create a lawful basis for unrelated processing.

6.5 Non-account Manual Booking customer - Article 6(1)(f) GDPR

Where an approved provider lawfully enters limited contact details for a genuine Manual Booking customer who does not have a BizU account, BizU relies on legitimate interests to operate and record the provider-requested booking, maintain provider schedule and booking integrity, enable booking-related administration or communication where contact details are available, prevent misuse, and establish, exercise, or defend relevant legal claims.

The interests pursued are those of BizU in operating a reliable booking platform and of the provider and customer in having the genuine appointment represented and administered correctly. The processing is limited to the supported booking record and related operational needs.

In the current Manual Booking flow, the customer name is required to create the non-account booking record. Email and phone are optional. If the provider does not supply the required customer name, the Manual Booking cannot be created through that flow. If email or phone is not supplied, the booking may still be created, but contact-dependent communication or administration may be limited.

Because this data is received from the provider rather than directly from the non-account customer, BizU must provide the non-account customer with the information required by Article 14 GDPR within the applicable legal timeframe unless an Article 14 exception applies. In general, that means within a reasonable period after obtaining the data and no later than one month, or earlier where the data is used for the first communication with the customer or first disclosed to another recipient. The operational delivery mechanism for real non-account Manual Booking customers must be in place before that real-customer public-Beta use is enabled.

This does not replace any separate privacy obligations the provider may have for its own professional or customer relationship.

6.6 Security, abuse prevention, service integrity, and content/profile review - Article 6(1)(f) GDPR

BizU has legitimate interests in securing accounts and infrastructure, preventing fraud and abuse, maintaining service integrity, diagnosing failures using minimized technical metadata, applying account and provider/partner review rules, moderating or restricting unlawful or non-compliant public information, and establishing, exercising, or defending legal claims where necessary.

These interests are pursued using purpose limitation, access controls, data minimization, and other safeguards appropriate to the relevant processing.

6.7 Legal obligations - Article 6(1)(c) GDPR

Where Union or Member State law requires BizU to process, disclose, or retain specific personal data, processing may be necessary to comply with that legal obligation.

6.8 Restricted post-deletion registration legal-evidence archive - Article 6(1)(f) GDPR

After completed account deletion, the limited registration legal-evidence record is no longer used to operate the former account. It is moved into restricted legal-evidence archiving for the purposes below.

For the Terms agreement, BizU's legitimate interest is preserving minimal evidence reasonably necessary to establish, exercise, or defend claims concerning the existence of the former Account/Platform relationship, the applicable Terms version, the acceptance event, and materially relevant rights or obligations arising from that former relationship.

For the Privacy Notice acknowledgment, the distinct legitimate interest is preserving minimal evidence of which Privacy Notice revision was presented and acknowledged during the registration legal event, where reasonably necessary to demonstrate the transparency information associated with that event or to establish, exercise, or defend claims or complaints directly concerning that transparency event.

The processing is restricted by purpose, access, retention, and reuse limitations described in Section 10.

6.9 Consent - Article 6(1)(a) GDPR, only where specifically requested

If BizU introduces or offers an optional processing activity that genuinely relies on consent, BizU will request that consent separately and identify the relevant purpose. Accepting the Terms or acknowledging this Privacy Notice does not constitute blanket consent for unrelated processing.

Where processing relies on consent, you may withdraw it as described in Section 11.

6.10 Summary of what is required and what is optional

For the current first-Beta registered account:

required to create and authenticate the account: email address and the authentication information required by Firebase Authentication;
required to pass the first-Beta eligibility gate: the 18+ self-declaration, without a separate persistent age record solely for that declaration;
required to complete an acceptance-required registration legal flow: explicit agreement to the applicable Terms and acknowledgment of the applicable Privacy Notice;
optional unless you choose the feature: profile fields beyond what a specific flow requires, Budget/Reservations/To-Do content, Notes, Shopping preferences, SmartHub configuration, AI requests, backups, and other optional module data;
generated as necessary when you use the service: technical, authentication, security, and operational metadata needed to deliver and protect the relevant functions.

If required account or legal-flow information is not provided, BizU cannot create or complete the registered account flow. If optional module data is not provided, only the relevant optional feature may be unavailable or limited.

7. Recipients and service providers

Personal data may be processed by service providers or recipients only as needed for the relevant purpose. Depending on the feature, these may include:

Google / Firebase services for authentication, database, storage, hosting, and backend functions used by BizUApp;
Cloudflare for controlled proxy, security, and AI-gateway functions;
an AI model provider used by BizU when an AI request requires model processing;
the selected booking provider, where sharing is necessary to create or manage a requested booking;
mybizu.com / Odoo-related infrastructure where the relevant website, public catalogue, commercial, or partner functionality is used;
the user-configured Home Assistant system for SmartHub requests;
professional advisers, insurers, competent authorities, courts, or other recipients where disclosure is legally required or reasonably necessary for a concrete legal matter.

BizU does not sell personal data.

Third-party partners and independent providers may act as separate controllers for their own transactions, services, websites, or professional activities. Their privacy information applies to those independent purposes.

8. International transfers

Some technical providers may process data from locations outside Belgium or the European Economic Area as part of their global infrastructure.

Where GDPR transfer restrictions apply, BizU relies on an applicable transfer mechanism, such as an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism, together with supplementary safeguards where required. Information about the applicable safeguard can be requested using the contact details in this Notice where Article 13 or 14 requires it.

9. Automated decision-making and AI

BizUApp may use AI to generate suggestions, summaries, explanations, and contextual assistance.

BizU does not use BizU AI output as the sole basis for decisions that produce legal or similarly significant effects on users in the first-Beta scope.

Security, booking-lifecycle, account-deletion, and other protected functions remain subject to separate application and server-side controls rather than being decided solely by AI output.

10. Retention and account deletion

Retention depends on the data category and the purpose for which it is processed. The 10-year period described below applies only to the limited registration legal-evidence record and does not create a 10-year default for unrelated personal data.

10.1 Active account

Account and module data is retained as needed to provide the active account and the features you use, subject to feature-specific lifecycle rules and legal requirements.

The registration legal-evidence record is retained while the account is active.

10.2 Account-deletion process

You can request account deletion through the supported in-app flow. The request may temporarily remain pending or restricted where an active or future booking, a required manual review, or another documented condition must first be resolved.

When account deletion is completed, ordinary account access ends. Personal data is then deleted, anonymized, or retained only where a separate lawful purpose and retention rule applies to that data category.

10.3 Restricted post-deletion registration legal-evidence archive

After completed account deletion, the limited registration legal-evidence record is kept in a restricted legal-evidence archive for 10 years from the completed-deletion date.

This 10-year period is BizU's selected proportionate retention period. It is not a statutory retention period required by the GDPR or Belgian law.

The Terms agreement and Privacy Notice acknowledgment remain distinct facts with distinct purposes, but they use the same restricted archive and the same expiry date.

During this period, the archived record is not used for:

registration or account-status decisions;
authentication;
account recovery, recreation, or restoration;
personalization;
analytics;
marketing;
recommendations;
ordinary product functionality;
any other incompatible product purpose.

The record is not immediately anonymized because that would remove the link needed for the approved evidentiary purposes.

At the end of the 10-year period, the registration legal-evidence record and the remaining link to the former account are permanently deleted. BizU does not keep an anonymized residue by default merely for historical or analytical use.

A legal hold may temporarily suspend normal deletion only for evidence genuinely necessary for a concrete, documented, and limited legal claim, dispute, proceeding, investigation, or comparable legal matter. A generic possibility of future claims is not enough. When the concrete need ends, the evidence returns to the applicable deletion path.

10.4 Other data

Other categories - such as booking records, security records, backups, support records, or operational data - follow their own purposes and retention criteria. The restricted registration legal-evidence archive does not establish a 10-year retention rule for those categories.

Where no separate legal or operational reason requires continued retention, personal data is deleted or anonymized when it is no longer necessary for the relevant purpose.

11. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

access your personal data;
correct inaccurate data;
request erasure;
request restriction of processing;
receive portable data where the portability right applies;
object to processing based on legitimate interests;
withdraw consent where processing is based on consent, without affecting earlier lawful processing;
lodge a complaint with the competent data-protection supervisory authority.

To exercise a right, contact bizu@bizu.be. BizU may need to verify enough information to handle the request securely.

Right to object - Article 21 GDPR

Where processing relies on Article 6(1)(f) legitimate interests, you may object on grounds relating to your particular situation.

An objection does not necessarily require immediate deletion in every case. BizU will assess the objection under the applicable GDPR test, including whether compelling legitimate grounds or the establishment, exercise, or defence of legal claims justify continued processing.

12. Supervisory authority

You may lodge a complaint with the supervisory authority competent for you under the GDPR. Because the controller is established in Belgium, the Belgian Data Protection Authority may also be relevant depending on the circumstances.

Contacting BizU first is optional and does not remove your right to complain to a supervisory authority.

13. Security

BizU uses technical and organizational measures designed to protect personal data, including authentication, user-scoped access controls, server-side validation for protected operations, secret isolation, and minimized logging practices.

No system is completely secure. You should protect your device, account credentials, backup files, and third-party credentials and notify BizU if you suspect unauthorized access.

14. Third-party websites and independent services

BizUApp may link to mybizu.com, partners, providers, Home Assistant resources, or other external services.

When you use an external service, that third party may process personal data for its own purposes under its own terms and privacy information. BizU is not responsible for an independent third party's privacy practices except where applicable law provides otherwise.

15. Changes to this Privacy Notice

BizU may update this Privacy Notice when processing activities, law, providers, or product scope materially change.

Editorial or non-material publication changes do not automatically create a new registration legal acceptance or acknowledgment requirement.

Where a Privacy Notice revision must be expressly acknowledged as part of an acceptance-required legal version, BizU will present the applicable version through the relevant explicit flow. Such acknowledgment remains a transparency and evidence fact and is not consent to all processing.

Where applicable law requires notice of a material privacy change, BizU will provide appropriate notice.

16. Contact

For privacy questions or data-subject requests: