Bizgora Privacy Policy

Effective Date: July 26, 2025

This Privacy Policy describes how Birchvest LLC d/b/a Bizgora ("Bizgora," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Bizgora iOS application, bizgora.com, related APIs, and any services or events that link to this Policy (collectively, the "Services"). By using the Services, you acknowledge the practices described here. For questions, contact support@bizgora.com or use the address in Section 13.

1. Information We Collect

• Identifiers - Examples: Name, postal address, email, telephone, government-issued ID (brokers only), account credentials, device identifier (IDFV) used for app functionality only. Source: You.
• Commercial Info - Examples: Listings posted, saved businesses, subscription tier, payment history. Source: You, transaction processors.
• Financial Data - Examples: Subscription purchase history, App Store transaction metadata, and receipts needed for entitlement verification. Source: Apple In-App Purchase.
• Internet / App Activity - Examples: IP address, timestamps, clicks, screens viewed, referral URLs, error logs. Source: Your device, analytics SDKs.
• Geolocation - Examples: Precise GPS (if you grant permission), coarse IP-based location. Source: Your device.
• User-Generated Content - Examples: Listings, photos, videos, messages, reviews, due-diligence attachments. Source: You.
• Inferences - Examples: Propensity scores (e.g., buyer interest), spam risk, valuation suggestions. Source: Internal algorithms.
• Sensitive Info (limited) - Examples: Broker license numbers, government IDs for fraud-prevention/KYC, precise location. Source: You (optional / permissioned).

We do not knowingly collect biometric templates, health data, or data from children (see Section 9).

2. How We Use Your Data

• Core Functionality - create and maintain accounts, authenticate users, post and manage listings, facilitate messaging, and process payments or subscriptions.
• Due Diligence & Fraud Prevention - verify broker licenses, confirm user identities, detect suspicious activity, and comply with anti-money-laundering ("AML") laws.
• Analytics & Product Improvement - study engagement, fix bugs, test features, and develop new services.
• Marketing (with opt-out) - send newsletters and product updates, including optional push notifications.
• Legal & Compliance - enforce our Terms, respond to lawful requests, defend legal claims, and protect rights, property, or safety.

We process personal data only when we have a valid legal basis: your consent (e.g., precise location), contract performance, legitimate interests, or statutory obligation (GDPR Art. 6).

3. How We Share or Disclose Information

• Buyers / Brokers / Sellers - Purpose: Information you explicitly include in listings, messages, or documents. Safeguards: Shared by you.
• Service Providers & Sub-Processors - Purpose: Hosting (AWS), analytics and crash reporting (Firebase), messaging (Stream), maps services (Google Maps), and payments (Apple In-App Purchase). Safeguards: DPAs / SCCs; access limited to need-to-know.
• Affiliates & Successors - Purpose: Corporate transactions (merger, acquisition, financing). Safeguards: Contractual confidentiality.
• Government / Law Enforcement - Purpose: Valid subpoena, court order, or statutory duty. Safeguards: Strict verification.

We do not "sell" personal data as defined by the CCPA/CPRA and other U.S. state laws. We also do not "share" personal data for cross-context behavioral advertising, and we do not track you across other companies' apps or websites. If Bizgora's practices change, we will update this Policy and provide required opt-outs.

4. Your Privacy Rights

• California (CCPA/CPRA): Access, delete, correct, know, opt-out of "sharing," limit sensitive info; call +1 (307) 429-2053 or email support@bizgora.com.
• Nevada SB-220: Right to opt-out of sale; same contact methods.
• Colorado, Connecticut, Utah, Virginia: Access, delete, portability, opt-out of targeted ads and profiling; request via in-app settings.
• EU/EEA & UK (GDPR): Access, rectify, erase, restrict, object, portability, lodge complaint with supervisory authority; transfer safeguarded by SCCs.
• Brazil (LGPD): Similar GDPR-style rights; contact us.

You may exercise your applicable rights by contacting support@bizgora.com or using the methods listed above.

Verification: We will ask for information to confirm your identity before processing your request and will respond within statutory timelines (e.g., 45 days in CA, 30 days under GDPR). You may also designate an authorized agent to make a request on your behalf. We will require proof that you have provided the agent with power of attorney or that the agent has your written permission to submit a request on your behalf.

5. Cookies, SDKs & Tracking Technologies

• First-Party Cookies / Secure Storage - Purpose: Maintain session, remember preferences. Control: In-app settings.
• Firebase Analytics / Crashlytics - Purpose: Usage statistics, crash reporting. Control: Disable analytics toggle.

6. International Transfers

We are U.S.-based; data may be processed in the U.S. and other countries with different privacy laws. For EU/UK data, we rely on Standard Contractual Clauses and supplementary measures (encryption in transit and at rest, zero-trust access controls).

7. Data Security

• TLS 1.3 encryption in transit; AES-256 at rest (AWS KMS).
• Principle-of-least-privilege; role-based access; MFA for admin accounts.
• Annual penetration tests, quarterly vulnerability scans, SOC 2-Type II controls in place.
• Incident response plan with 72-hour breach notification (GDPR) and other timelines as required by state laws.

While we implement robust security measures designed to protect your information, no security system is impenetrable, and we cannot guarantee the absolute security of our systems.

8. Data Retention & Deletion

• Account & Listings - Period: Active account + 7 years (audit, AML). Method: Secure permanent deletion from databases and backups.
• Payment Records - Period: 10 years (IRS and FinCEN). Method: Tokenization; irreversible deletion.
• Analytics Logs - Period: 24 months (aggregated thereafter). Method: Firebase data-retention controls.
• Support Tickets - Period: 5 years (defensive record). Method: Secure bulk purge from our support system.

Upon verified deletion request, we purge personal data unless retention is required by law or for our legitimate fraud-prevention interests.

9. Children's Privacy

The Services are intended for a general business audience and are not directed to individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. Consistent with the Children's Online Privacy Protection Act (COPPA) and other regulations, we do not direct our Services to children under 13 (or under 16 in the EEA/UK). If we discover we have inadvertently collected such information, we will delete it promptly.

10. Third-Party Links & Integrations

The Services may contain links or integrations (e.g., Google Maps, DocuSign). Your interactions are governed by their privacy policies, not ours.

11. Do Not Track Signals

Browsers may transmit DNT signals; because there is no consensus standard, we currently do not respond to DNT. You can control tracking via in-app settings and iOS privacy controls.

12. Changes to This Policy

We may update this Policy periodically. Material changes take effect 30 days after we post the updated version or notify you. We will update the "Effective Date" above and, for material changes, provide push or email notice.

13. How to Contact Us

If you have questions about this Policy, please contact us at:

Birchvest LLC d/b/a Bizgora
1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, USA
support@bizgora.com

If you have unresolved concerns, EU/UK residents may contact their local data-protection authority; California residents may contact the California Privacy Protection Agency (CPPA) or the California Attorney General.

Quick-Reference: Apple App Store Privacy Label

• Data Linked to You: Identifiers, Financial Info, Contact Info, User Content, Usage Data, Precise Location (optional)
• Data Not Linked to You: Diagnostics, coarse location, crash data
• Tracking: No