Privacy policy

1. Who this applies to

This policy covers personal data collected through bizbora.com, through the BizBora product, and through direct communication with us by email, phone, or in person. BizBora Hub Ltd. is the data controller for the data described here.

2. What we collect

• Contact details you submit through the contact form: name, email address, company, and the content of your message. Before anything reaches us, we email a one-time confirmation code to the address you gave; until you enter it, your message is held temporarily and is not sent to us. We also record your IP address with that request to limit abuse.
• Business data you or your organisation enter into BizBora, including sales, inventory, HR, and financial records, for the purpose of providing the product to you.
• Usage data about bizbora.com from Vercel Analytics, on every visit: pages viewed, referring site, approximate location, and device and browser type. It uses no cookies and records no personal identifiers; it tells returning visitors apart only by a hash that resets every day.
• Our own aggregate site statistics, also on every visit: which page was viewed, the domain of the site that referred you (never the full address), and which links you click. These are stored as bare records with a date. We do not store your IP address, a cookie, a device or visitor ID, or anything in a page address after the “?”. We skip visitors whose browser sends a Do Not Track or Global Privacy Control signal.
• If you accept analytics cookies, additional usage data from Google Analytics and Google Tag Manager: pages viewed, links clicked, approximate location derived from your IP address, device and browser type, and referring site. These use cookies, described in section 6.
• Standard technical data collected automatically by our hosting infrastructure, such as IP address and browser type, for security and reliability purposes.

3. How we use it

• To respond to inquiries submitted through the contact form.
• To provide, maintain, and support the BizBora product for the businesses using it.
• To understand, in aggregate, how bizbora.com is used, so we can improve it.
• To meet our legal and regulatory obligations.

We process this data on the basis that it is necessary to respond to your inquiry or provide the service you have asked for. Google Analytics and Google Tag Manager are only loaded once you accept them through the cookie banner shown on your first visit; declining or not responding means they never load and no analytics cookies are set. You can change your choice at any time with the “Cookie preferences” link in the footer. Vercel Analytics and our own aggregate page and link statistics run on every visit because they use no cookies and do not identify individual visitors.

4. Who we share it with

We use a small number of infrastructure providers to run bizbora.com and BizBora, each processing data strictly on our behalf and only for that purpose:

• Resend, for sending transactional email (contact-form confirmation codes, inquiry notifications, administrator sign-in codes).
• Neon, for database hosting.
• Vercel, for website hosting, file storage, and cookie-free Vercel Analytics that runs on every visit.
• Google, via Google Analytics and Google Tag Manager, for site traffic analysis, only if you accept analytics cookies.

Resend, Neon and Vercel process data strictly on our instructions and for no purpose of their own. Google processes analytics data under its own terms as well as ours; see Google’s privacy policy at policies.google.com/privacy for how it handles that data.

We do not sell personal data, and we do not share it with anyone for their own marketing purposes.

5. Data transferred outside Kenya

The infrastructure providers listed in section 4, including Google, process data on servers located outside Kenya. Where this happens, the transfer is necessary for us to provide the service you have requested, or, for analytics cookies, takes place only after you have consented to it, consistent with the conditions for cross-border transfer set out in Part VI of the Data Protection Act, 2019. We choose providers with established security and data protection practices and keep this arrangement under review.

6. Cookies and local storage

When you visit bizbora.com we store the following on your device:

• Analytics cookies (only if you accept): Google Analytics sets cookies named _ga and _ga_ followed by our measurement ID, which distinguish returning visitors and last up to two years. Google Tag Manager may set further cookies depending on the tags we run through it. Neither loads until you accept, and choosing “Decline” or ignoring the banner keeps them off.
• Local storage (always): your cookie choice, so we do not ask again, and your light/dark display preference. Neither leaves your device.
• Session storage (blog posts only): a flag that stops the same post being counted twice in one visit. It is cleared when you close the tab and is never sent to us. The post’s view count itself is a plain number not linked to you.
• Sign-in cookie (administrators only): set when staff sign in to manage the site. It is never set for ordinary visitors.

Vercel Analytics and our own site statistics set no cookies. To withdraw analytics consent, use “Cookie preferences” in the footer and choose Decline; you may also delete cookies in your browser settings.

7. Data retention

Contact-form submissions that are never confirmed with the emailed code are deleted within 24 hours. Confirmed submissions are kept for as long as needed to respond to and follow up on the inquiry, and are then archived or deleted. Our own page-view and link-click records are deleted after 13 months. Business data stored in BizBora is retained for as long as the account is active, and for a reasonable period after closure to allow for export or legal requirements, after which it is deleted.

8. Security

We restrict access to personal data to the people who need it to do their jobs, use encrypted connections between the site and our infrastructure, and rely on providers with their own security practices for hosting and storage. No system is completely secure, and we treat any suspected breach seriously, including notifying the Office of the Data Protection Commissioner within the timeframe the Act requires where applicable.

9. Children

Our services are directed at businesses and are not intended for children. We do not knowingly collect personal data from children.

10. Your rights

Under the Data Protection Act, 2019, you have the right to know what personal data we hold about you, to request a copy of it, to have inaccurate data corrected, to request deletion, and to object to or request restriction of certain processing. To exercise any of these rights, contact us using the details below; we will respond within a reasonable time and no later than the law requires. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke) if you believe your data has been mishandled.

11. Changes to this policy

We may update this policy as our practices change. The date at the top shows when it was last revised. Material changes will be reflected here before they take effect.

12. Contact

Questions about this policy, or a request relating to your personal data, can be sent to hello@bizbora.com.