Privacy Policy
Last updated: October 16, 2026
1. Introduction
Bzz ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our queue management service. We are based in Ireland and comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. Information We Collect
We collect the following types of information:
For Business Users:
- Email address (for account creation and authentication via magic link)
- Business name and logo
- Payment information (processed securely by Stripe)
- Subscription and billing history
- When you contact support from the dashboard: your name, email, organisation, site and plan, plus aggregate queue counts (how many buzzers are waiting or ready). Never guest names or contact details.
For Queue and Booking Customers:
- Name (optional, for queue identification)
- Phone number and email address, when you make a booking or the venue asks for them
- Party size, booking time and seating preferences
- Notes you or the venue add to your visit
- A random device identifier stored on your device (used to recognise your place in line; it is not a fingerprint and is not used for advertising)
- Push notification tokens (Web Push or Apple Push Notification service) if you allow notifications
- Your table, if you check in at one
- Messages you exchange with the venue through Bzz chat
- An Apple Wallet pass, if you add one
- The result of an on-site check, if the venue uses one (see section 7)
- When you accept a venue's terms or waiver: the time, your IP address and your browser type, as a record of your acceptance
Automatically Collected:
- Browser type and version
- Device information
- IP address
- Pages visited and interactions
- Cookies and similar tracking technologies (on our websites only; the iOS app and App Clip do not load analytics or advertising trackers)
3. How We Use Your Information
- Provide and maintain our queue management service
- Process payments and manage subscriptions
- Send real-time queue notifications
- Authenticate users via passwordless magic links
- Improve our service through analytics
- Provide customer support via live chat
- Send service-related communications
- Comply with legal obligations
- Check the country of your IP address when you create an account or visit our sign-in, sign-up and features pages, because we do not currently offer new accounts in some countries. We do not store your IP address for this; we keep only a daily count of blocked attempts per country. IP geolocation data by DB-IP.
4. Cookies and Consent Management
We use Silktide Consent Manager (an open-source cookie consent solution) to manage your cookie preferences. When you first visit our site, you will be asked to consent to different categories of cookies:
- Necessary cookies: Essential for the website to function. These cannot be disabled and include authentication and payment processing cookies.
- Preference cookies: Remember your settings and preferences, including live chat functionality (Tawk.to).
- Statistics cookies: Help us understand how visitors interact with our website through Google Analytics and Hotjar.
- Marketing cookies: Used to display relevant advertisements through Google AdSense.
You can change your cookie preferences at any time by clicking the cookie settings button or through your browser settings.
5. Third-Party Services
We use the following third-party services that may collect and process your data:
Supabase (Data Storage & Authentication)
Stores user accounts, business data, and queue information. Data is encrypted at rest and in transit.Privacy Policy
Stripe (Payment Processing)
Processes subscription payments securely. We do not store your full credit card details.Privacy Policy
Brevo (Marketing Email)
If you ask us to email you a calculator result, Brevo sends a confirmation email first. Only after you confirm do we email you the link and a short series of tips. We store your email address, the calculator you used and that link. Every email has an unsubscribe link.Privacy Policy
Cloudflare Turnstile (Bot Protection)
Loaded only when you open an email form on our guides and calculators, to check the request comes from a person. To limit abuse we keep salted hashes of the requesting IP address and email for two days.Privacy Policy
Google Analytics (Website Analytics)
Collects anonymised data about website usage to help us improve our service.Privacy Policy
Google AdSense (Advertising)
May display personalised advertisements based on your browsing history.Privacy Policy
Hotjar (User Experience Analytics)
Records anonymised user sessions to help us understand how users interact with our service.Privacy Policy
Tawk.to (Live Chat Support)
Provides live chat functionality for customer support. Business users who chat from the dashboard are identified to support by name, email, organisation, site and plan, with aggregate queue counts. Queue customers' pages do not load the chat.Privacy Policy
6. Data Storage and Security
Your data is stored securely using Supabase infrastructure hosted in the EU. We implement industry-standard security measures including encryption at rest and in transit, secure authentication, and regular security audits. Access to personal data is restricted to authorised personnel only.
7. Push Notifications
With your explicit permission, we send push notifications to inform you about your queue status. These notifications are essential for the core functionality of our service. You can disable push notifications at any time through your browser or device settings.
In the Bzz iOS app and App Clip, notifications are delivered through Apple Push Notification service (APNs). The apps use the camera only to read a venue's QR code and NFC only to read a venue's tag; nothing from the camera or NFC reader is recorded or stored. The apps do not track you across other companies' apps or websites.
Some venues ask guests to confirm they are on site. Only then, and only with your permission, we check your device's location when you join or while you wait. We compare it with the venue's location and keep only the result (on site or not, and a rounded distance) with your place in line; your coordinates are not stored.
8. Data Retention
We retain your personal data only for as long as necessary to provide our services and fulfil the purposes described in this policy. Business account data is retained for the duration of your subscription plus 30 days. Payment records are retained as required by law.
Queue and booking customers:
- Chat messages are deleted 24 hours after your visit ends.
- Push notification tokens are deleted 7 days after your visit ends.
- Your other personal details (name, phone number, email address, notes, device identifier, table, Apple Wallet pass, and the IP address and browser recorded when you accepted terms) are removed 30 days after your visit. For a booking, the 30 days run from the booking time, or from the cancellation if that was later. What remains is anonymous: the venue still sees that a visit happened, when, and for how many people, but not who it was.
- Signed waivers and agreements: if you accepted a venue's waiver or terms, the details needed to show that you did (your name, contact details, IP address and browser) are kept for 3 years after the visit, then removed in the same way.
- Reports about a venue: if you block a venue's chat and report it, we keep the reason and the time for 1 year to review venues. The report does not include any message text.
We keep anonymous activity counts (for example, how many people a venue served each day) for analytics. They contain no personal data.
Backups: we keep encrypted backups of our database for disaster recovery for up to 400 days. Details removed from our live systems remain in those backups until the backups expire. Backups are only restored to recover from a failure, and if that happens we apply the removals above again.
9. Your Rights (GDPR)
Under GDPR, you have the following rights:
- Right of Access: Request a copy of your personal data
- Right to Rectification: Request correction of inaccurate data
- Right to Erasure: Request deletion of your personal data
- Right to Restrict Processing: Request limitation of data processing
- Right to Data Portability: Receive your data in a portable format
- Right to Object: Object to processing of your personal data
- Right to Withdraw Consent: Withdraw consent at any time
To exercise any of these rights, please contact us at info@bzz-app.com
10. International Data Transfers
Some of our third-party service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your personal data.
11. Children's Privacy
Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected data from a child, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we may also notify you via email.
13. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at: info@bzz-app.com
You also have the right to lodge a complaint with the Irish Data Protection Commission if you believe your data protection rights have been violated.