Privacy Policy

BZAR ("we," "us," or "our") operates the marketplace platform at bzar.app. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, mobile experience, and related services (collectively, the "Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

Some parts of the Service are only available to vendors who connect an outside account, such as a business mailbox, or who use a paid BZAR Pro tool. Those parts send data to more providers than the basic Service does. Sections 4, 7, and 8 say which providers, and when.

We collect the following types of information:

• Account information: Name, email address, password (hashed), role selection (consumer, vendor, or organizer), and zip code when you create an account.
• Profile information: Business name, description, category, phone number, address, logo, banner images, and social media links for vendors and organizers.
• Payment information: Payment details are collected and processed by Stripe. We do not store your full credit card number, bank account number, or other sensitive financial information on our servers. We do store a Stripe customer reference, transaction amounts, and the status of your payments and your subscription.
• Location information: Zip code (provided during signup), IP-based geolocation on our waitlist form (to check eligibility for our DC/Maryland/Virginia service area), the place and address text you type into our location fields, and venue addresses for events.
• Usage data: Pages visited, features used, browser type, device information, IP address, and interaction patterns. See Section 6 for how we collect this and how to opt out.
• Messages:Content of messages exchanged between users through the platform's messaging system.
• Uploaded content: Images, documents, and other files you upload to the platform (such as vendor logos, event photos, contracts, and application materials).
• Connected-account data: If a vendor connects an outside account, we import data from it. For a connected mailbox this includes the full text of emails and their attachments. See Section 8.

We use your information to:

• Provide, operate, and maintain the Service
• Process transactions and send related information (confirmations, receipts, tickets)
• Bill and manage vendor subscriptions
• Facilitate communication between consumers, vendors, and event organizers
• Verify your eligibility for the Service (e.g., DMV area residency)
• Send transactional emails (booking updates, event reminders, application status changes)
• Send browser or mobile push notifications, if you turn them on
• Measure how the Service is used, diagnose errors, and improve and personalize the product
• Sort and summarize a vendor's connected mailbox, where that vendor has turned the feature on (Section 7)
• Detect, prevent, and address fraud, abuse, or technical issues, including rate-limiting abusive traffic
• Comply with legal obligations

We use the service providers below. Each receives only the data it needs to do its job. The groups say whether a provider is in use for everyone, only for vendors who choose to connect it, or not in use today.

Core platform — in use for everyone

• Supabase: Database hosting, user authentication, file storage, and real-time features. Supabase holds effectively all of the data described in Section 2.
• Vercel: Web hosting and serverless function execution. Vercel processes your requests, including your IP address. We also use Vercel Web Analytics, which counts page views without setting a cookie and without building a profile of you.
• Stripe:Payment processing, vendor and organizer payout management, subscription billing, and identity verification for Stripe Connect accounts. Stripe receives your payment details, name, email address, and transaction amounts. Stripe's privacy policy governs their handling of that data.
• Resend: Transactional email delivery. Resend receives your email address and the content of the emails we send you.
• PostHog: Product analytics. Our servers send PostHog usage events, such as an application submitted or a ticket purchased, together with your account identifier and the details of that action. Your browser also sends PostHog page views and clicks, routed through our own domain. See Section 6.
• Sentry: Error monitoring, performance tracing, and session replay. Sentry receives error reports, request traces, your IP address, your account identifier, and, for a sample of sessions, a replay of your interactions with the page. See Section 6.
• Google:Optional "sign in with Google" authentication, plus the Google Maps, Places, and Geocoding APIs for venue and location display and for the address fields you type into. Google receives your search text, the map area you view, and your IP address for those requests.
• Upstash (Redis): Rate limiting. Upstash holds short-lived counters keyed to your account identifier or your IP address, so we can block abusive traffic.
• ipapi.co: IP-based geolocation on our waitlist form. Your browser contacts ipapi.co directly, so ipapi.co sees your IP address.
• Web push: If you turn on browser notifications, we deliver them through the push service run by your own browser vendor (for example Google, Mozilla, or Apple). That service receives the encrypted notification and your push subscription endpoint.

AI processing — in use where an AI feature is enabled

• OpenRouter: The gateway that all of our AI requests pass through. OpenRouter forwards the request to a model provider and returns the answer.
• Model providers reached through OpenRouter: Google (Gemini models), OpenAI (GPT models), Mistral, and DeepSeek. Which provider handles a given request depends on the task and on availability. Section 7 explains what content we send.

Vendor integrations — only when a vendor connects them

• Nango: The service that runs our outside-account connections. Nango performs the sign-in handshake and holds the access tokens for every integration in this group, in its vault, on our behalf.
• Google Gmail: Reads a connected vendor mailbox. This is a restricted Google API scope. Section 8 explains what we import and store.
• Google Calendar: Reads and writes events on a connected vendor calendar.
• Google Business Profile: Reads reviews and business listing data, and posts replies, for a connected vendor listing.
• Instagram (Meta):Reads a connected vendor's media, and sends and receives Instagram direct messages on the vendor's behalf.
• Shopify:Imports a connected vendor's products, customers, and orders. We honour Shopify's mandatory data-deletion webhooks — see Section 10.
• Square:Imports a connected vendor's catalog, customers, and orders.

Built but not in use today

The Service contains working code for the providers below, but they are not configured and receive no data today. We will update this policy before we turn any of them on.

• Twilio: SMS delivery. SMS sending is switched off, and no phone numbers go to Twilio.
• Expo: Push notifications for the BZAR mobile app. The app has not been released, so no device tokens are registered or sent.
• Apify: Collects public event listings from Eventbrite and Instagram to help fill our event directory. This is public business listing data rather than your account data, and the feature is switched off.

We do not use advertising cookies. We run no ad networks and no ad pixels on the Service, and we do not sell or share your data for advertising. We do use analytics and error-monitoring tools that record how you use the Service, which Section 6 describes in full.

The following are stored on your device:

• Authentication session: Supabase auth tokens stored in cookies (names beginning sb-) to keep you signed in.
• Active organization: The bzar-active-org cookie stores your currently selected organization for organizer accounts.
• Onboarding state: The bzar-onboarded cookie tracks whether you have completed the onboarding process.
• Interface preferences: The bzar-dashboard-nav-collapsed cookie remembers whether you collapsed the dashboard sidebar.
• Analytics: PostHog stores a cookie and local storage entries (names beginning ph_) that hold a random device identifier, a session identifier, and, after you sign in, your account identifier. Section 6 describes what PostHog records and how to opt out.
• Local storage: Draft form data and in-progress carts, under keys beginning bzar- (for example bzar-cart, bzar-event-cart, and bzar-event-wizard). These stay on your device so you do not lose work between page loads.
• Session replay:Sentry stores a session identifier in your browser's session storage for the replay described in Section 6.

Vercel Web Analytics sets no cookie.

We measure how the Service is used, and we watch for errors. This is how, and what it means for you:

• PostHog — product analytics. Two streams feed it. Our servers record events such as signing up, submitting an application, buying a ticket, or cancelling a subscription, together with your account identifier, your role, and the details of the action. Your browser records page views and clicks — which element you clicked, on which page. On the business dashboards we strip the text of clicked elements before the event leaves the page, so customer names, email addresses, and amounts shown there do not reach PostHog. Until you sign in, browser events carry only a random identifier and PostHog builds no profile of you. We use all of this to understand which features work and where people get stuck.
• Sentry — errors, tracing, and session replay. When something breaks, we send Sentry an error report with the technical context, your IP address, and your account identifier. Sentry also records a replay — a reconstruction of what happened on the page — for roughly 1 in 10 sessions, and for any session in which an error occurs. Replays mask text content by default, so what we normally see is the shape of your interaction rather than what you typed.
• Vercel Web Analytics — page views. Counts visits by page. No cookie, and no cross-site profile.

How to opt out. Email us at hello@bzar.app with the subject "analytics opt-out". We will exclude your account from product analytics and from session replay. A tracker blocker also works, though analytics events travel through our own domain and some blockers miss them — the email opt-out is the reliable route. The Service keeps working either way. Opting out does not stop us keeping the security and transaction logs we need to run the platform.

Some BZAR features use large language models. When one of them runs, the relevant content leaves our servers and goes to OpenRouter, which routes it to a model provider — Google, OpenAI, Mistral, or DeepSeek — and returns the result.

What we send, and when:

• Inbox sorting. If a vendor connects a mailbox and turns on inbox triage, we send each incoming email for classification. That includes the sender name and address, the subject, and the body text of the email, together with a short description of the vendor's business. This applies to email from people who do not have a BZAR account.
• The BZAR assistant. Where a vendor has the assistant enabled, we send the content it is asked to work with — such as a message thread, a customer record, or a review — so it can draft a reply or a summary.
• Event directory research. We summarize and categorize public event listings. This uses public business information, not your account data.

Retention and training.BZAR does not train any model on your data, and does not sell your data to any AI provider. We keep a record of each AI request's cost and metadata for billing and for abuse monitoring. Content sent through OpenRouter is handled under OpenRouter's and the chosen model provider's own data policies, which we do not control. We do not use AI to make decisions that produce legal or similarly significant effects about you.

Your choices. A vendor can stop all mailbox-based AI processing by disconnecting the mailbox. If you do not have a BZAR account and you emailed a vendor who uses this feature, contact us at hello@bzar.app and we will remove your messages from our systems.

Vendors can connect outside business accounts to BZAR. Connections run through Nango, which performs the sign-in handshake with the provider and holds the resulting access tokens in its vault on our behalf. We never receive or store your password for a connected account.

Connected mailboxes need a fuller explanation. When a vendor connects a Gmail mailbox:

• We read messages from approximately the last 30 days, and then keep the mailbox in sync.
• We store the full body text of each message, a sanitized HTML version, the subject, the sender and recipient addresses, the timestamps, Gmail's own category labels, and attachments.
• This includes messages from people who are not BZAR users. If you emailed a BZAR vendor at their connected business address, your message, your name, your email address, and your attachments are stored in that vendor's BZAR inbox. We process that data on the vendor's behalf, so they can read their own business mail.
• We may send messages for AI classification, as described in Section 7.
• Disconnecting stops future imports but does not erase past ones. When a vendor disconnects a mailbox, we revoke the access token and import no new mail. Messages already imported stay in that vendor's BZAR inbox until the vendor deletes them or asks us to delete them.

If you emailed a vendor and want your data removed, write to hello@bzar.app. You do not need a BZAR account to make that request.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share data in the following circumstances:

• Public profiles: Vendor business profiles and organizer profiles are publicly visible when marked as public. This includes business name, description, category, location, and uploaded images.
• Event participation:When a vendor is approved for an event, their profile information is visible in the event's vendor directory.
• Between users, to complete a transaction: When you book, message, or buy from a vendor or organizer, the information they need in order to serve you — such as your name, contact details, and order details — is shared with them.
• Service providers: The providers listed in Section 4 process data on our behalf so that the Service can work. This includes payment processing through Stripe and the AI processing described in Section 7.
• Connected accounts you authorize: Where a vendor connects an outside account, data moves between BZAR and that provider as described in Section 8.
• Legal compliance: We may disclose information if required by law, court order, or government request, or to protect the rights, safety, or property of BZAR or others.
• Business transfers: If BZAR is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

BZAR vendors may connect third-party platforms (such as Shopify or Square) or upload CSV files to import their existing customer lists into BZAR's CRM and analytics tools. When a vendor does this, BZAR processes that data on the vendor's behalf as a data processor:

• Data types processed:Names, email addresses, phone numbers, order history, and purchase amounts imported from the vendor's connected platform or uploaded file.
• Purpose:To populate the vendor's BZAR CRM, power event-attribution analytics, and enable the vendor to communicate with their customers through BZAR. This data is used solely to provide services to the vendor and is never used for BZAR's own marketing or sold to third parties.
• Retention:Imported customer data is retained as long as the vendor's BZAR account is active or until the vendor disconnects the integration and requests deletion.
• Platform deletion requests (Shopify GDPR webhooks): BZAR honors mandatory deletion webhooks from Shopify. When BZAR receives a customers/redact or shop/redactwebhook, we permanently delete the corresponding imported customer records from the vendor's CRM within 30 days of the request.
• Customer rights: If you are an end-customer whose data was imported by a BZAR vendor, you may contact us at hello@bzar.app to request access to, correction of, or deletion of your records.

We keep personal data for as long as we need it for the purpose we collected it for, and then we delete it. In practice:

• Account and profile data: For as long as your account is open. After you ask us to delete your account, we remove it within 30 days, apart from the records listed at the end of this section.
• Transaction, payment, and subscription records: Up to 7 years after the transaction, because tax and accounting law requires it. Stripe keeps its own copy under its own schedule.
• Messages and inbox content: For as long as the account they belong to is open, unless you delete them sooner. Mailbox content imported from a connected account is covered by Section 8.
• Uploaded files and documents: For as long as the account they belong to is open, unless you delete them sooner.
• Product analytics events: Held by PostHog under our configured retention. We do not use them to rebuild a profile of you after you delete your account.
• Error reports and session replays: Held by Sentry for a short window under its retention settings — replays for approximately 90 days, and error reports for up to 90 days.
• Rate-limiting counters: Minutes to hours. They expire automatically.
• Records we must keep: We may keep a minimal record after deletion where we need it to meet a legal obligation, resolve a dispute, or enforce our agreements — for example, a record that an account was suspended for fraud.

BZAR is operated from the United States and serves the Washington DC, Maryland, and Virginia area. Our core providers — Supabase, Vercel, Stripe, and Resend — store data primarily in the United States.

Some providers may process data outside the United States, including the AI model providers reached through OpenRouter, our error monitoring, and the push services run by browser vendors. If you use the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States and in other countries where our providers operate, and that privacy laws there may differ from those of your own country.

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Update: Correct or update your account and profile information at any time through your dashboard.
• Delete: Request deletion of your account and associated data. Some data may be retained as required by law or for legitimate business purposes — see Section 11.
• Data portability: Request your data in a portable format.
• Opt out of analytics: As described in Section 6.

To exercise any of these rights, contact us at hello@bzar.app. We answer within 45 days, and we will tell you if we need longer.

If you live in Virginia, California, or another state with a comprehensive privacy law, you have these rights in addition to those in Section 13:

• Know and access: Confirm whether we process your personal data, and get a copy of it.
• Correct: Fix inaccurate personal data we hold about you.
• Delete: Have your personal data deleted.
• Portability: Receive your data in a portable, readable format.
• Opt out of targeted advertising, sale, and profiling: We do not sell personal data, we do not process it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. There is therefore nothing to opt out of, but you may still ask us to confirm this in writing.
• No retaliation: We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

How to make a request. Email hello@bzar.app. We may need to verify your identity, usually by asking you to write from the email address on the account. An authorized agent may act for you if you give them written permission.

Appeals (Virginia).If we refuse your request, you may appeal by replying to our decision within 30 days. We will respond to the appeal in writing within 60 days. If we deny the appeal, you may submit a complaint to the Virginia Attorney General's office.

We implement appropriate technical and organizational measures to protect your information:

• All data in transit is encrypted via HTTPS/TLS.
• Database access is controlled through Supabase Row Level Security (RLS) policies, ensuring users can only access data they are authorized to see.
• Supabase encrypts data at rest in their managed PostgreSQL databases.
• Payment data is handled by Stripe, which is PCI DSS Level 1 compliant.
• Passwords are hashed using industry-standard algorithms and are never stored in plain text.
• Access tokens for connected accounts are held in Nango's vault rather than in our own database.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us at hello@bzar.app and we will promptly delete the information.

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For material changes, we will notify you via email or a prominent notice on the Service. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: hello@bzar.app

Website: bzar.app