App privacy notice.

Who is responsible?

ProBizMate is operated by BG NAPPIES LIMITED, registered in Ireland, company number 470115, at Ardcullen, Omeath, Co. Louth, A91 Y7WK, Ireland. Contact me@maebhcollins.com for privacy questions.

This notice covers the ProBizMate app at probizmate-app.pages.dev and these public app pages. We are the controller for our account administration, support and service security. A business using ProBizMate normally controls its own customer, job, review and message records; we process those records to provide the functions it instructs us to perform. Its own privacy notice also applies to its relationship with you.

Data we handle and why

• Account and access details: owner name, business membership, email, linked diary identity, invitation and session records. These let an authorised owner access the right business. When you link or sign in with an existing diary account, your email and password pass to that account's verifier. ProBizMate does not store your password or the source system's login token.
• Connected business records: customer names, contact details, addresses or Eircodes, jobs, dates, notes, prices, quotes and available invoice information. The app reads the connected diary and sends authorised job or project changes back to it. The diary remains the source of those records.
• Website reviews: the author's name, general area, rating, title, review text, submission details and moderation decision. All ratings start private. An approved review's name, area, rating, text and date become available on the business's website. Notifications send review details and a private app link to the authorised business recipient.
• Post packs: the service, general area and work notes you supply, editable drafts, approvals and download content. These remain private in ProBizMate. You choose whether and where to post a downloaded pack. The app does not copy private customer records into these drafts or send them to an external AI service.
• Support and security: messages you send us, request information such as IP addresses and browser details handled by hosting services, hashed sign-in rate-limit identifiers, and records of changes, approvals and delivery attempts. These help us answer questions, protect accounts and investigate faults or misuse.

WhatsApp connection being prepared

The current pilot has no active ProBizMate WhatsApp connection. If enabled after the business's authorisation and Meta onboarding, the direct Meta integration will handle business account and phone identifiers, customer phone numbers and display names, message text, timestamps, business-app message echoes, reply drafts, delivery status and opt-out records. This supports a private conversation inbox and owner-approved replies. It does not import a historical message archive or contact directory into the current app. Unsupported attachments are not downloaded.

Only a new customer message can open the provider's reply window. An owner must check and approve each reply. A message containing only STOP or unsubscribe blocks replies in ProBizMate. Disconnecting does not erase records already received. Contact us to confirm that the connection is disabled and to request deletion. See data deletion instructions.

Our legal grounds

For account administration and support, we process information needed to provide the service under our agreement with you, or to take steps you request before an agreement. Where you act for a company, we rely on our legitimate interest in administering that company's service. We also rely on legitimate interests in securing the service, preventing misuse and keeping an accurate record of authorised actions. We consider the impact on individuals when using these grounds.

We may retain or disclose specific information where necessary to meet a legal obligation or establish, exercise or defend legal claims. The customer business is responsible for the lawful grounds and notices for its customer records, communications and public reviews. Required account details are necessary for access; without them we cannot sign you in. Optional content is supplied when you choose to use a feature.

We do not sell personal data or use this app's records for advertising profiles. The current app does not make solely automated decisions with legal or similarly significant effects on individuals.

Who receives information?

• Cloudflare: app hosting, request processing, security and the D1 database containing account, review, post-pack, audit and any connected WhatsApp records.
• The connected JobDiary service and its NocoDB source: verification of an existing account and the business records the owner opens or edits. ProBizMate does not expose source credentials to other users.
• Resend: authorised service emails, including the recipient address, notification content and delivery information.
• Support email providers: receiving and responding to messages sent to our contact address.
• Meta/WhatsApp, when connected: the identifiers, messages and delivery information needed for the direct WhatsApp integration. Meta also processes information under its own applicable terms and privacy notices.
• Authorised people and intended recipients: the business's permitted users, service personnel who need access for support or administration, and recipients selected by the business. Approved website reviews are public. We may disclose information to legal advisers or authorities where necessary and lawful.

Our app database is configured in Cloudflare's EU jurisdiction. This does not mean every provider operation stays in the European Economic Area. Hosting, email and connected platforms can involve processing outside the EEA, including the United States. Cloudflare's data processing terms and Resend's data processing terms describe their international transfers and EU Standard Contractual Clauses. Contact us for information about the safeguards applicable to your data or a copy of relevant safeguards.

Sign-in cookie and browser storage

The app sets pbm_session when you sign in. It keeps you signed in to your business for up to 30 days. It is marked Secure, HttpOnly and SameSite=Strict; the server stores a hash rather than the cookie's secret value. Signing out removes the current server session and expires its cookie. Blocking this necessary cookie prevents sign-in.

We use this cookie to deliver the account access you request. The app has no advertising or analytics cookies, third-party tracking scripts, or persistent browser localStorage/sessionStorage. Loaded work records are held in the page's memory while you use it. A file you deliberately download remains on your device under your control. Public policy pages can be read without signing in.

How long we keep records

The current pilot has no fixed content-retention schedule or automatic account or content purge. Content remains stored until it is manually removed. Cookie expiry, a review-link expiry, signing out or disconnecting a provider does not delete the underlying business records. Deletion requests are handled manually.

During a manual account-closure or deletion assessment, we consider the purpose and continuing necessity of each record: whether account access is still authorised; whether the business still needs operational content for the relevant customer work or publication; whether a support issue is unresolved; and whether security or approval evidence is needed for an incident or legal claim. We identify any specific legal obligation or claim that requires continued retention and explain it in our response.

On account closure or a deletion request, we assess which records can be removed or returned, which belong to the business's source system, and whether any specific retention ground remains. Backup copies and provider records may have a separate lifecycle; a request does not imply instant removal from every backup or a recipient's own records. See how to request deletion.

Your rights and how to use them

Subject to the GDPR's conditions, you can request access, correction, erasure, restriction and portability of your personal data, and object to processing based on legitimate interests. If processing relies on consent, you can withdraw that consent without affecting earlier lawful processing.

Email me@maebhcollins.com. For customer records controlled by a trade business, contact that business or tell us which business is involved so we can help direct your request. We may need proportionate information to confirm your identity and locate the records. Do not send passwords or identity documents unless specifically needed and requested securely.

We respond without undue delay, normally within one month. Where the law permits an extension for a complex or numerous request, we explain the reason within that first month. You can complain to Ireland's Data Protection Commission, or your relevant supervisory authority. You do not have to contact us first.

We update this notice when the app's data handling changes and identify the revision date above.