Privacy policy

1. Data collection

We collect the following types of data:

1.1. Registration and authentication data

• When registering by phone: mobile number (for OTP verification)
• With a Google account: first name, last name, email, profile photo (through Google OAuth 2.0)

1.2. Data provided by the user

• profile information (name, bio, photo)
• review texts and photos
• business information (name, description, address, contact details, opening hours, category)
• uploaded photos and files
• B2B marketplace listings and inquiries
• tender information and offers
• deal descriptions, prices and photos
• job listing information
• AI search queries

1.3. Geolocation data

• geographic coordinates of the business address (when marked on the map)
• the user's location (only with your permission, when using the "My location" feature)

Geolocation data is used to show nearby businesses and to place a business correctly on the map. You can turn geolocation off at any time from your browser settings.

1.4. Automatically collected data

• IP address
• browser type and version
• device type and operating system
• page view statistics
• search history on the Platform
• cookies
• referral source (where you came to the Platform from)

1.5. Payment data

When a paid plan is purchased, the payment is processed through the TBC Pay or BOG iPay system. biznesebi.ge does not store the bank card number, the CVV code or any other bank details. We store only the transaction identifier, the amount and the status.

2. Use of data

The collected data is used for the following purposes:

• creating, authenticating and managing an account
• ensuring that all services of the Platform function
• business search, filtering and recommendations
• processing B2B marketplace inquiries
• delivering tenders and offers
• displaying deals and discounts
• publishing job listings
• generating AI search results
• personalising the user experience
• statistical analysis and improvement of the Platform
• communication with users (notifications, updates)
• SMS verification (one-time codes)
• security and fraud prevention
• providing analytics to businesses (in aggregated, anonymous form - the number of views, searches and clicks)
• processing payments and financial reporting

3. Cookies

The Platform uses cookies to improve its functioning and the user experience. The types of cookies used are:

• Essential: session management, authentication, CSRF protection, security
• Analytics: Google Analytics (GA4) - page view statistics, user behaviour analysis, the top.ge counter
• Functional: storing user preferences (recent searches, bookmarks)

You can manage cookies from your browser settings. Turning off essential cookies may limit the functionality of the Platform.

4. Third-party services

To operate the Platform we use the following third-party services, which may have access to certain data:

4.1. Authentication

• Google OAuth 2.0: for signing in with a Google account. Google's privacy policy: policies.google.com/privacy

4.2. Payment systems

• TBC Pay: the payment system of TBC Bank - processes bank card data
• BOG iPay: the payment system of the Bank of Georgia - processes bank card data

Bank card data is processed only on the bank's certified servers. biznesebi.ge has no access to the full card number or to the CVV code.

4.3. SMS service

• BulkSMS.ge: for sending the OTP code during phone authentication. The phone number is passed to the SMS service provider only in order to send the message

4.4. File storage

• Cloudflare R2: uploaded photos and files are stored in Cloudflare's cloud storage. Cloudflare's privacy policy: cloudflare.com/privacypolicy

4.5. Analytics and monitoring

• Google Analytics (GA4): for analysing website traffic. Collects anonymous data about views, devices and behaviour
• Sentry: for monitoring technical errors. Collects technical details of errors (not personal data)

4.6. Maps

• OpenStreetMap: for loading map tiles. The browser automatically sends the IP address to OpenStreetMap's servers

4.7. Advertising and conversion measurement

• Meta (Facebook) Pixel, Conversions API: to measure the performance of advertising campaigns. Browser and ad identifiers, the IP address and browser data are transferred, while a phone number and email address are sent only as hashed, irreversible values. Your number or address cannot be recovered from a hash. Meta's privacy policy: facebook.com/privacy/policy

4.8. Automatic CV filling (Google Gemini)

When you choose to import a CV, the PDF or photo, or text extracted from a Word/Excel file, is sent to Google Gemini to recognize information. This content may include your name, contact details, education and work experience. We do not store the uploaded file: it is processed temporarily in memory. Only information you review and select is saved in your draft. Import is optional; you can also fill in the form manually. Google’s applicable terms govern its processing, including retention. Google Gemini terms

We do not sell your personal data. To measure advertising campaign results, only hashed, irreversible values and technical signals are shared with a third party - see section 4.7.

5. Data security

We use modern technical and organisational measures to protect your data:

• HTTPS/TLS 1.2+ encryption for all communication
• protection against CSRF, XSS and SQL injection
• rate limiting - protection against automated attacks
• Content Security Policy (CSP)
• automatic session validation and expiry
• regular security audits
• restricted access - only authorised employees have access to the data
• automatic creation of data backups
• server monitoring and error tracking (Sentry)

Despite our efforts, no system can guarantee 100% security. In the event of a security incident we will notify you immediately.

6. Data retention periods

• Account data: stored while the account is active. After a deletion request - within 30 days
• Reviews: stored while the account is active
• Business listings: stored until the business owner requests deletion
• Transaction records: stored for 5 years for financial reporting
• Analytics data: stored in aggregated form for an indefinite period
• Server logs: stored for 90 days

7. User rights

You have the right to:

• Access: request a copy of your data that we store
• Rectification: request the correction of inaccurate data
• Erasure: request the deletion of your data (the "right to be forgotten")
• Restriction: request the restriction of data processing
• Portability: receive your data in a structured format (JSON)
• Opt-out: refuse the use of analytics cookies

To exercise these rights, contact us: [email protected]. We will consider your request within 15 business days.

8. Children's privacy

The Platform is not intended for persons under the age of 16. We do not knowingly collect data from persons under the age of 16. If you learn that a minor has registered on the Platform, please contact us at [email protected] so that the account can be deleted.

9. Changes to the policy

We may update this privacy policy. In the event of significant changes, users will be informed by a notification on the Platform. The date the policy was last updated is always shown at the top of this page.