Privacy policy

This policy explains what data BIZLINKED processes, why, for how long, and your rights under the GDPR.

1. Who is responsible

For your account data (name, email, company, settings, payments), the controller is BIZZY CONSULTING (KvK 42108017, Almere, Netherlands) — hello@bizlinked.app.

For the prospect data you collect through the extension (LinkedIn profiles, conversations), you are the controller and BIZZY CONSULTING acts as your processor: we store and process it only to run the service for you, on your instructions, as set out in section 9, our Terms and the Data Processing Agreement.

2. Data we process

• Account: first and last name, email, company, language, time zone, LinkedIn profile URL, the profile you describe (offer, target, voice).
• Security: sign-in codes (stored hashed, valid 10 minutes), sessions (30 days), IP address of sign-ins, activity log.
• Payment: handled by Stripe; we receive the subscription status, invoice amounts and dates — never your card number.
• Your AI API key, only if you choose to add one: stored encrypted in a vault; we never display it back and only use it to generate your texts.
• Prospecting data (processed on your behalf): public LinkedIn profile information of the people you prospect (name, headline, location, profile photo, public posts), the status of your invitations and the conversations the extension reads in your LinkedIn inbox to know who replied.
• Extension: technical run reports (time, version, counts, errors) and the LinkedIn account it recognizes in your browser.
• Your own LinkedIn statistics: your own posts (text, date, format) with their impressions, reactions, comments and shares, and your follower count, read by the extension in your browser to build your performance dashboard. Only your own account is read; a figure LinkedIn does not show you is left empty.
• Assistant connector, only if you connect one: the access you grant to ChatGPT or Claude when you click « Allow access » (access tokens stored hashed, revocable at any time in Settings) and a log of the requests made through it (time and tool used).
• Subscription journey: the steps you take on our pricing and payment screens (plan and billing period viewed, payment page opened or cancelled, offers shown and their expiry) and, only if you answer it, how you heard about BIZLINKED (one optional question asked after payment). If you add a card during the trial, it is held by Stripe to take the first payment when the trial ends.

3. Why (purposes and legal bases)

• Provide the service, sign-in and support — performance of the contract.
• Billing and accounting — legal obligation.
• Security, fraud and abuse prevention — legitimate interest.
• Service emails (sign-in code, alerts, replies received, morning list) — performance of the contract.
• News about BIZLINKED sent to members (new features, similar services) — legitimate interest for existing customers (soft opt-in: art. 11.7 Dutch Telecommunications Act, art. 13 Directive 2002/58/EC). Every such email has an unsubscribe link, which takes effect immediately. Non-members only receive them with their consent.
• Website analysis before sign-up — legitimate interest: the website address you enter, the result, and a one-way hash of your connection address to prevent abuse. Only public pages are read. Kept 30 days, or attached to your account if you sign up.
• Post performance dashboard, content suggestions and the assistant connector — performance of the contract.
• Audience measurement of our public website — legitimate interest: see section 6.
• Measuring and improving our pricing and payment screens, and knowing which channels bring paying customers (subscription journey, optional « how did you hear about us » answer) — legitimate interest. Never sold, never used for advertising profiles.
• Referral programme — performance of the contract: the referrer sees the first name, sign-up date and subscription status of their referrals, nothing else.

4. Processors and where your data goes

In short: your BIZLINKED database (account, prospects, conversations, settings) is stored in the European Union. Some processing takes place outside the EU: delivery of the website, payments, Google sign-in if you use it, and AI text generation. Each of these is listed below with its safeguard.

• Supabase — database, files, server functions. Stored and processed in the EU (AWS eu-west-1, Ireland).
• Vercel — delivers the website and the application pages from a worldwide network, including the USA. It does not hold your prospect database. Safeguards: EU–US Data Privacy Framework and Standard Contractual Clauses.
• Brevo — transactional email (sign-in codes, alerts). France, EU.
• Stripe — payments. Ireland and USA. Safeguards: Data Privacy Framework and Standard Contractual Clauses.
• Google — only if you choose “Sign in with Google”, to confirm your email address. USA, Data Privacy Framework.
• Anthropic — AI text generation included in your plan, within your monthly AI allowance: the profile excerpts needed to write a text are sent to Anthropic, which processes them in the USA as our processor. Safeguards: adequacy decision or Standard Contractual Clauses.
• Your own AI provider (Anthropic or OpenAI), only if you add your own API key: the profile excerpts needed to write a text are then sent through your key to that provider, which processes them in the USA under your own agreement with it. You choose the provider; its terms and safeguards apply.
• Your meeting recorder (Fathom, Fireflies or Granola), only if you add your own API key for the Meeting to post feature: BIZLINKED then reads, at your request, the summary and an excerpt of the transcript of the one meeting you pick, under your own agreement with that provider, to draft a LinkedIn post that you review before anything is published. The client is kept anonymous by default. Removing the key in Settings stops this immediately.
• Your AI assistant (OpenAI ChatGPT or Anthropic Claude), only if you connect it yourself (you click « Allow access » on BIZLINKED's authorisation page): when you ask it something, the data it requests from BIZLINKED (your profile, funnel figures, prospects, conversations, post statistics) is sent to it and processed under your own account and terms with that provider, mostly in the USA. You start and control this transfer; disconnecting the assistant in Settings stops it immediately.
• Google Fonts — fonts loaded by the website (Google sees your IP address).

For the prospect data you process with BIZLINKED, our commitments as your processor (GDPR art. 28) are set out in the Data Processing Agreement, which forms part of our Terms. We will inform you at least 30 days before adding or replacing a processor that handles prospect data.

5. Retention

• Account and prospecting data: as long as your account is open, then deleted within 30 days of closure (except invoices, kept 7 years for tax purposes).
• Sign-in codes: 10 minutes. Sessions: 30 days. Security logs: 12 months. Connector request log: 12 months.
• Website audience measurement: 13 months.

6. Cookies and local storage

BIZLINKED uses no advertising cookies, no third-party analytics and no cross-site tracking. The application stores your session and preferences (language, theme) in your browser's local storage, strictly necessary for the service.

Audience measurement. To know which pages of our public website are useful, we keep in your browser's local storage a random visitor identifier and the page that brought you to us, and we send the pages you view to our own server in the EU. This data is not shared with anyone, is not used for advertising, is kept 13 months, and is not combined with other websites. Signed-in members are not counted. You can delete it at any time by clearing your browser's site data for bizlinked.app, or write to hello@bizlinked.app.

7. Security

Encrypted connections (HTTPS/HSTS), strict isolation between accounts, encrypted API keys, sign-in by one-time code, protection against brute force, content security policy. Your LinkedIn password and cookies are never collected: the extension works with your session, in your own browser.

8. Your rights

You can access, correct, delete, export or restrict your data, and object to processing, by writing to hello@bizlinked.app. We reply within one month. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local authority.

9. Your responsibilities as controller

When you prospect with BIZLINKED, you are responsible for having a legal basis (usually legitimate interest in B2B prospecting), for respecting LinkedIn's rules, for honoring requests from the people you contact, and for not collecting sensitive data. On request, BIZZY CONSULTING deletes a prospect's data from your account.

10. Changes

We will notify you by email of any substantial change to this policy.