Privacy Policy & Data Protection Terms

This Privacy Policy sets forth the terms under which BizBot (operating at bizzbot.tech, hereinafter referred to as "BizBot", "we", "our", or "the Platform") processes personal, commercial, and telemetry data.

Depending on your relationship with the Platform, our legal classification under data protection laws (including the Ghana Data Protection Act, 2012 (Act 843) and the EU General Data Protection Regulation (GDPR)) is as follows:

• For Merchants / Store Owners: BizBot operates as a Data Controller with respect to your merchant account details, subscription payment records, and administrative dashboard access.
• For Shoppers / End-Customers: The respective Merchant is the independent Data Controller of buyer personal data (customer name, delivery address, phone number, order preferences). BizBot operates as a Data Processor (Service Provider) acting strictly on the merchant's instructions to automate customer ordering, calculate cart subtotals, route payment requests, and dispatch order status notifications.

We collect and process only the minimum information necessary to execute commerce transactions across our supported channels:

To protect both our merchants and their shoppers, BizBot operates under strict, legally binding data usage parameters:

Under Section 18 of the Ghana Data Protection Act (Act 843) and Article 6 of the GDPR, BizBot processes personal data under the following legitimate grounds:

• Performance of a Contract: Necessary to register merchant accounts, display store catalogs, process items in carts, calculate delivery fees, generate Mobile Money payment authorization links, and deliver order receipts.
• Legitimate Interests: Necessary to ensure platform uptime, prevent duplicate webhook replays via Redis caching, detect payment fraud, and protect against malicious cyberattacks.
• Legal & Statutory Compliance: Retaining records of financial payments, settlement logs, and billing invoices to satisfy accounting, audit, and tax authorities (e.g. Ghana Revenue Authority).
• Consent: When merchants broadcast marketing updates or promotional campaigns to opt-in customer lists via WhatsApp Cloud API.

BizBot partners with industry-standard, security-certified technology providers to execute platform operations:

BizBot strictly implements the Meta WhatsApp Business Messaging Policy and Commerce Policy:

• Customer Service Window: Inbound conversations initiate a standard 24-hour service conversation window during which the store bot assists with product queries, cart building, and order checkout.
• Opt-In Consent for Marketing: Merchants using BizBot broadcast features represent and warrant that all targeted recipients have explicitly provided opt-in consent to receive promotional messages from the merchant's business.
• Spam Prohibition: Merchants are strictly forbidden from uploading scraped, purchased, or unauthorized phone number lists. Accounts flagged by Meta for spam or excessive user blocking will be suspended immediately.
• Prohibited Products: The platform may NOT be used to sell prohibited goods, including firearms, tobacco, illegal drugs, prescription medications without authorization, or counterfeit goods.

We deploy robust enterprise security safeguards to prevent accidental loss, unauthorized access, alteration, or disclosure of personal data:

• Encryption in Transit: All HTTP traffic to and from BizBot web storefronts, APIs, and webhooks is strictly enforced over HTTPS using TLS 1.3 encryption.
• Cryptographic Webhook Signatures: Inbound Meta webhooks are cryptographically authenticated via HMAC-SHA256 signature checks (`X-Hub-Signature-256`) against our private app secret to prevent spoofed payloads.
• Encrypted Database Secrets: Sensitive merchant access tokens, webhook verify tokens, and payment API keys are encrypted at rest using Laravel's AES-256-CBC envelope encryption.
• Idempotency & Replay Protection: Message IDs are validated against a 48-hour deduplication cache window to eliminate replay attacks and duplicate order charges.

We retain personal information only for as long as required to fulfill the purposes for which it was gathered, in accordance with the Ghana Data Protection Act (Act 843):

• Cart Sessions & Temporary Drafts: Unfinalized cart draft sessions are retained for active browsing and automatically purged after 30 days of inactivity. Shoppers can erase active carts and delivery addresses instantly by replying DELETE MY DATA or CLEAR CART in chat.
• Order Records & Statutory Financial Retention: Order records, transaction references, invoices, and fulfillment logs are retained in encrypted storage for statutory audit compliance (up to 6 years) as mandated by financial regulations and tax laws.
• Merchant Account & Store Closure: When a merchant closes their store via Settings > Danger Zone, product catalogs, categories, API credentials, and webhooks are permanently purged immediately. If the user account is closed, personal profiles are completely erased.

Under applicable data protection laws, individuals enjoy statutory rights concerning their personal data:

• Right of Access: You may request confirmation of what personal data is held about you and receive a readable copy.
• Right to Rectification: You may correct inaccurate or incomplete phone numbers, addresses, or profile details.
• Right to Erasure (Right to be Forgotten): You may request the deletion of your personal contact records, subject to statutory retention requirements for financial auditing.
• Right to Withdraw Consent: Customers may opt out of promotional messages from a merchant at any time by replying *STOP* or contacting the merchant.

Shoppers seeking to exercise rights regarding a specific merchant order should contact that merchant directly as the Data Controller, or reach our Data Protection team at privacy@bizzbot.tech.

If you have questions, inquiries, or complaints regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer: