1. Information We Collect

1.1 Information You Provide

We collect information that you voluntarily provide when using our services, including:

• Account Information: Name, email address, phone number, password (encrypted), profile photo, and user role (regular user, business owner, or administrator)
• Business Registration Information: Legal business name, trading name, business category, industry, services offered, specialties, service areas, business description, operating hours, and business gallery images with captions
• Business Verification Data: Business registration number, KRA PIN (Kenyan tax identification number), entity type (sole proprietor, partnership, company, LLP), registration date, and verification documents uploaded for authentication purposes
• Location Data: Business city, building/plot number, street address, area, nearby landmarks, and precise geographic coordinates (latitude/longitude) obtained from Google Maps, including Google Maps Place IDs
• Contact Details: Primary and alternate phone numbers, email addresses, and website URLs
• Customer Engagement Information: Data about how you interact with customers (communication channels used such as WhatsApp, TikTok, Instagram, Facebook), customer retention processes, and methods for handling customer dissatisfaction
• User-Generated Content: Reviews, ratings (1-5 stars), review titles, comments, review images (up to 3 per review), complaints, complaint categories and severity levels, complaint images (up to 5 per complaint), and responses to reviews or complaints
• Draft Data: Incomplete business registration information saved to our servers (not stored in your browser) to allow you to resume registration later
• Communication: Messages you send to us through contact forms, customer support inquiries, email correspondence, and business responses to reviews
• Saved Preferences: Businesses you save as favorites, businesses you recommend to others, and display preferences

1.2 Automatically Collected Information

When you access our platform, we automatically collect certain information to improve our services, ensure security, and provide analytics:

• Device Information: Browser type and version, device type (mobile, tablet, or desktop), operating system, screen resolution, and user agent string
• Network Information: IP address (hashed and anonymized for privacy protection - we never store raw IP addresses), internet service provider, and connection type
• Usage Data: Pages visited, page titles, time spent on each page, links and buttons clicked (phone, website, directions, email), search queries, traffic source (Google, direct, social media, referral), referrer URLs, and interaction patterns
• Business Profile Analytics: Views of business profiles, click events on business contact information, recommendation actions, peak usage hours, and unique visitor tracking for business analytics dashboards
• Location Data: Approximate location based on IP address; precise location coordinates only if you provide them when registering a business or with your explicit consent
• Cookies and Similar Technologies: Data collected through cookies and web beacons (see our Cookies Policy for details)
• Rate Limiting Data: For security and abuse prevention, we track event counts per user or anonymized session using hashed IP addresses combined with partial user agent fingerprints (this data is automatically deleted after 24 hours)

1.3 Analytics Data Collection

We use a two-tier analytics system to understand platform usage and provide business insights:

• Google Analytics (Firebase Analytics): Platform-wide analytics including page views, user demographics (aggregated and anonymized), session duration, bounce rates, and conversion events
• Custom Business Analytics: Business-specific metrics including page view counts (daily, monthly, lifetime), click tracking (phone, website, directions, email), device breakdown, traffic sources, peak usage hours, unique visitor counts, and recommendation tracking - all stored in our own database for business owner dashboards

1.4 Third-Party Information

We may receive information about you from third parties, including Google Maps (for location data and Place IDs), Firebase services (for authentication and cloud infrastructure), and business verification databases used to confirm the legitimacy of business registrations.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide Services: To operate and maintain the BizResolve platform, process business registrations, manage user accounts, display business listings, and facilitate customer reviews and complaints
• Business Verification: To verify business ownership and authenticity of listings using KRA PINs, registration numbers, and uploaded verification documents; to authenticate business legitimacy and prevent fraudulent listings
• Personalization: To personalize your experience, provide tailored business recommendations based on your location and preferences, and remember your saved businesses
• Communication: To send you service-related notifications (verification status, review responses, complaint updates), respond to your inquiries, and facilitate business-customer communication through our platform
• Analytics and Insights: To analyze platform usage patterns, track business profile performance, provide business owners with analytics dashboards showing page views and customer engagement, identify peak usage hours, measure traffic sources, and improve our services based on user behavior
• Security and Abuse Prevention: To detect and prevent fraud, spam, and abuse using rate limiting mechanisms (tiered based on authentication status: 100 events/minute for authenticated users, 50 for anonymous users with detectable IPs, 10 for fully anonymous users); to protect against automated attacks and ensure fair platform usage; to identify suspicious patterns using hashed IP addresses and device fingerprints
• Platform Improvement: To develop new features, fix technical problems, conduct research and analysis, optimize user interfaces, and enhance the quality of business listings
• Legal Compliance: To comply with legal obligations, enforce our Terms of Service, respond to legal requests, protect our rights and property, and investigate potential violations
• Marketing (with consent): To send promotional materials, newsletters, and platform updates; you can opt out at any time
• Customer Engagement Analysis: To understand how businesses interact with their customers, provide insights to business owners about customer engagement best practices, and identify trends in customer service approaches
• Complaint Resolution: To process and resolve customer complaints, facilitate communication between businesses and complainants, and maintain records of resolution outcomes

3. How We Share Your Information

We may share your information in the following circumstances:

3.1 Public Information

Information in business listings, reviews, and ratings is publicly visible to all users of the platform. Your username and review content will be displayed publicly when you post a review.

3.2 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform. These providers are contractually obligated to protect your information and may only use it for the specific services they provide to us:

• Firebase (Google Cloud): Authentication services, cloud database (Firestore), file storage, cloud functions for server-side processing, and hosting infrastructure
• Google Analytics: Platform analytics and user behavior tracking (data processed according to Google's privacy policy)
• Google Maps Platform: Location services, geocoding (converting addresses to coordinates), place IDs, and map displays

3.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership or control.

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using SSL/TLS protocols
• Encryption of sensitive data at rest
• Regular security assessments and audits
• Access controls and authentication mechanisms
• Employee training on data protection and security

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Your Privacy Rights

You have the following rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal requirements)
• Data Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to processing of your personal information for certain purposes
• Opt-Out: Opt out of marketing communications at any time

To exercise any of these rights, please contact us using the information provided at the end of this policy.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of our platform. Cookies are small data files stored on your device. We use the following types of cookies:

• Essential Cookies: Necessary for the platform to function properly
• Functional Cookies: Enable personalized features and remember your preferences
• Analytics Cookies: Help us understand how users interact with the platform
• Marketing Cookies: Used to deliver relevant advertisements

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of the platform.

7. Data Retention

We retain your personal information for specific periods based on the type of data and legal requirements:

• Active Accounts: Account data retained for the duration of account activity plus 2 years after last login for reactivation purposes
• Business Listings: Business information retained indefinitely while verified and active; rejected or inactive businesses retained for 1 year for audit purposes
• Verification Documents: KRA PINs, registration numbers, and uploaded documents retained for 7 years to comply with Kenyan business record-keeping requirements
• Reviews and Ratings: Retained indefinitely as they form part of the historical business record; deleted only upon legal request or Terms of Service violation
• Complaints: Retained for 3 years after resolution for dispute management and legal compliance
• Analytics Data: Aggregated analytics retained indefinitely for platform insights; individual event logs retained for 13 months (aligned with Google Analytics data retention)
• Rate Limiting Data: Automatically deleted after 24 hours
• Draft Business Data: Retained for 90 days of inactivity, then automatically deleted
• Communication Records: Customer support messages retained for 2 years; transactional emails retained for 1 year

When data reaches its retention limit, we securely delete or anonymize it. You may request earlier deletion by contacting us, subject to legal and business requirements.

Note: Even after deletion, some information may persist in backup systems for up to 30 days before being permanently removed.

8. Children's Privacy

BizResolve is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.

9. International Data Transfers

Your information may be transferred to and processed in countries other than Kenya, primarily through our use of Google Cloud Platform (Firebase) services. These countries may have different data protection laws than Kenya.

Specifically, data may be processed in:

• United States: Firebase/Google Cloud Platform data centers for database, storage, and cloud functions
• European Union: Google Analytics data processing centers
• Other Google Cloud Regions: As needed for service optimization and redundancy

When we transfer your information internationally, we ensure appropriate safeguards are in place through Google Cloud's compliance with international data protection frameworks, including standard contractual clauses and adherence to the EU-U.S. Data Privacy Framework. Your data is protected in accordance with this Privacy Policy regardless of where it is processed.

10. Third-Party Links

Our platform may contain links to third-party websites, such as business websites or social media pages. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on this page with a new "Last Updated" date
• Notify you via email or through a prominent notice on our platform
• Where required by law, obtain your consent for the changes

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: