Privacy Policy

1. Who we are

bbiz.shop is run by BBIZ AI TECH PTE LTD (“BBiz”, “we”), which is responsible for your personal data as the “data user” under the PDPA. You can reach us at the email address at the end of this page.

2. What we collect

Account: your email address, your preferred language, and records of your sign-ins.

Your shop: the link you submit and the public information of that shop (shop name, products, prices, images, policies and public reviews, which may include reviewers’ display names), files you upload, your edits, and any WhatsApp number or payment link you add.

Payments: handled by Stripe. We receive your Stripe customer reference and subscription status. We never see or store your full card number.

Technical: your IP address (stored only as a one-way hash for abuse limits), browser and device type, the cookies needed to keep you signed in, the result of Cloudflare Turnstile’s bot check, and — if you came from an ad — the campaign that sent you (UTM parameters) and Meta’s cookie identifiers (_fbp, _fbc).

Messages you send us, such as support emails.

3. Why we use it

To build, host and update your AI shop; to sign you in; to send emails about your service (sign-in codes, your shop’s progress, payment and shop status); to process payments; to measure and improve our advertising on Facebook and Instagram; to prevent abuse and fraud; to answer you; to improve the service; and to meet legal obligations.

We do not sell your personal data. If you reserve an address but don’t go live, we send up to four reminder emails within a week; each one has a one-click unsubscribe link, and you can also reply to ask us to stop.

4. What becomes public

Once you go live, everything in your AI Agent Shop — including your shop name, products and any WhatsApp number or payment link you add — is public and can be read by anyone, including AI assistants and search engines. Free previews are not public and are not indexed.

5. Who we share it with

We use these service providers, who process data for us under contract: Supabase (database, sign-in and file storage, Singapore region); Stripe (payments); Resend (sending email); DeepSeek (AI processing of shop content — we send only shop information, never your email or payment details); Vercel (website hosting); Cloudflare (bot protection); and Meta Platforms (measuring our Facebook and Instagram ads).

Meta: when you visit, reserve an address, start checkout or subscribe, the Meta Pixel in your browser and our server send Meta that event, your browser details and IP address, Meta’s cookie identifiers and a one-way hashed (SHA-256) copy of your email address, so Meta can tell which ads work. Meta handles this under its own privacy policy; you can limit it in your Facebook or Instagram ad preferences.

Google Analytics: we use Google Analytics to see how visitors move through the site — which pages and steps they reach, where they leave, and whether they subscribe. It receives those events, your browser and device details, an approximate location from your IP address, a random cookie identifier and, once you have an account, our internal account number (never your email or name). We use it only to improve the site; Google handles it under its own privacy policy, and you can opt out with Google’s browser add-on or by blocking cookies.

We may also disclose data when the law requires it, or to a buyer of our business if BBiz is sold, under the same protections.

6. Transfers outside Malaysia

Some providers process data outside Malaysia, for example in Singapore, the United States and China. We choose providers with appropriate safeguards and send them only what they need.

7. How long we keep it

Account data: while you have an account. Unpaid previews stop being available after 7 days; their data is deleted within 12 months. Paused or cancelled shops: kept for up to 12 months so you can come back, then deleted. Billing records: 7 years, as Malaysian tax law requires. Security logs: up to 90 days.

You can ask us to delete your data sooner, except what we must keep by law.

8. How we protect it

Data is encrypted in transit, access is restricted by role, and each user can only reach their own records in our database. No system is completely secure, but we take reasonable steps under the PDPA’s security principle.

9. Your rights

Under the PDPA you can ask to access your personal data, correct it, withdraw your consent or limit how we use it, and ask us to delete it. Email us from the address on your account; we answer access and correction requests within 21 days.

Giving us your email address is necessary to use BBiz. If you do not want to provide it, we cannot build a shop for you.

10. Cookies

We use cookies the service needs: to keep you signed in and to remember your language. Cloudflare Turnstile may use cookies to tell people from bots. We also use the Meta Pixel, which sets Meta’s cookies (_fbp, _fbc) to measure our ads, and Google Analytics, which sets Google’s cookies (_ga, _ga_…) to measure how the site is used. You can block these in your browser settings, or limit ad tracking in your Facebook or Instagram ad preferences.

11. Children

BBiz is not meant for anyone under 18, and we do not knowingly collect their data.

12. Changes

We may update this policy and will tell you by email or on the site about significant changes. This policy is available in English and Bahasa Melayu; if they differ, the English version applies.