Privacy Policy

This policy explains how TuaniBiz handles personal information: what we collect, where it comes from, why we use it, who receives it, how long we keep it and the choices you have. It covers our own website and apps, the websites, booking pages, phone lines and messaging we run for the businesses that use TuaniBiz, our sales outreach to businesses, and our affiliate program.

Who we are

TuaniBiz is operated by Tuanilabs LLC. You can write to us at dennis@tuanibiz.com or by mail at 15333 Culver Drive, Ste 340 #2211, Irvine, CA 92604. To make a privacy request, use our Privacy Center.

Our two roles

We handle personal information in two capacities, and what applies depends on which one.

• We decide how the information is used (we are its controller, or "business"). This covers the business owners, managers and staff who hold a TuaniBiz login, our affiliates and the people who apply to become one, visitors to our own website, and the businesses we contact as prospects (see Businesses we may contact).
• We handle the information for a business that uses TuaniBiz (we are its service provider, or "processor"). This covers that business's customers and visitors: people who use its website, chat with its assistant, call its phone line, book, request a quote, pay, message it on Facebook or Instagram or leave it a review. It also covers the business's employees we schedule and connect. The business decides what happens to that information; we use it to provide our service to that business under our Data Processing Addendum. If you are a customer of such a business, please also read its own privacy notice: every website we host links one.

What we collect, where it comes from and why

The categories below follow the ones used in California privacy law. For each one we list what it includes, where it comes from, why we use it and who receives it. "Our service providers" means the companies on our Subprocessors page.

Identifiers and contact details

• What: names, email addresses, phone numbers, postal and service addresses, account and customer ids, and the IP address of a device.
• From: you, when you sign up, book, chat, call, fill in a form or apply; the business you deal with, for its customers and staff; Google's public business listings and businesses' own websites, for prospects; Stripe, for payment confirmations.
• Why: to create and run accounts, deliver bookings, quotes, payments, messages and calls, verify identity, send account notices and, with consent, sales texts; to prevent fraud and abuse.
• Who receives it: our service providers; for a business's customers and staff, that business.

Account, sign-in and security information

• What: PINs (stored only as salted hashes), one-time codes sent by text, trusted-device tokens (stored as hashes), session cookies, sign-in times and failed attempts, and the IP address and browser behind sign-ins and sensitive actions.
• From: you and your devices.
• Why: to keep accounts secure, to require a fresh code for sensitive changes, and to detect and investigate abuse. Security events are also analyzed automatically, including by an AI provider, to spot attacks.
• Who receives it: our hosting, database and SMS-verification providers, and the AI provider used for security analysis.

Commercial and payment information

• What: the plans and add-ons a business buys, invoices and subscription status; the quotes, invoices and payments a business handles for its own customers (line items, amounts, tips, card brand and country); refunds and disputes. We never receive full card numbers: Stripe collects them. To answer chargebacks we keep evidence of a payment, such as the IP address and browser used to view, approve and pay a quote.
• From: you, the business and its customers, and Stripe.
• Why: to bill for our service, process the business's payments through Stripe, keep accounts and defend against disputes.
• Who receives it: Stripe, and the business the payment belongs to.

Messages, conversations and recordings

• What: website chat messages; texts; emails; Facebook, Instagram and TikTok messages and comments; messages the AI receptionist takes; written transcripts and summaries of calls; team chat messages and the photos, videos and voice notes shared in it; support tickets; conversations with Tuani IA, our dashboard assistant; and the audio of calls while they happen (see Calls, AI and transcripts).
• From: the people taking part in the conversation.
• Why: to answer and route conversations, let the business see its own history, take messages, book appointments and provide support.
• Who receives it: the business; our AI providers, which generate replies, transcripts and summaries; our phone, text and email providers; Meta, for Facebook and Instagram conversations.

Website and app activity

• What: on the websites we host, the pages viewed, the page that referred the visitor, whether the device is a phone, and taps on call, email and booking buttons (we store no IP address or visitor id with these statistics); when a website's assistant books or changes something for a visitor, the visitor's IP address and browser, logged with that action for security; in our dashboards, the features used, the device type and a session id kept only as a one-way hash; for the help and come-back emails we send business owners from news.tuanibiz.com, whether the email was opened and which link was clicked (through a small image and tracked links in those emails only — account, billing and sign-in emails carry neither); error reports; and the request logs our hosting provider keeps.
• From: your browser.
• Why: to give each business its own statistics, to keep the service working and to improve it.
• Who receives it: our hosting provider, and our email provider for the opens and clicks above. Google receives website statistics only where a business has connected Google Analytics and the visitor has agreed (see Cookies, Do Not Track and Global Privacy Control).

Location

• What: the business's address and service areas; the service address a customer gives for a home visit; and the general area of a caller's phone number, used to route calls. We do not ask your device for its precise location: our pages switch that browser feature off.
• From: the business, its customers and the phone network.
• Why: to show where a business works, send staff to the right place and route calls.
• Who receives it: the business and our service providers.

Business and professional information

• What: business names, services, prices, hours, photos and logos; team members' names, roles and photos; credentials a business tells us about; the business's Google Business Profile, including reviews with the reviewer's public name, photo and text; and, for prospects, information published on their own website, such as staff names and short bios.
• From: the business, Google and public websites.
• Why: to build and run the business's website and assistants, and to prepare demos for prospects.
• Who receives it: the public, when it appears on a published website; our service providers, including AI providers that write website content.

Inferences

• What: the language a caller used, kept with their phone number so the receptionist answers in that language next time; a phone number's spam score, used to block robocalls; for prospects, a summary of a sales conversation (interest, objections, next step) written by our AI assistant; for businesses, AI suggestions about which customers to follow up with.
• Why: to serve people in their language, block spam and run our sales follow-up.
• Who receives it: the business, for its callers; our AI providers.

Sensitive information

• What: the only sensitive personal information we ask for is what you use to sign in (your PIN, together with one-time codes). We do not ask for health information, government ids or financial account numbers. Stripe, not TuaniBiz, collects the identity, tax and bank details it needs to pay out a business or an affiliate.
• Why: to secure accounts. We do not use sensitive information to infer anything about you.

How we use personal information

• To provide the service: build and host websites, answer chats and calls, take bookings and messages, run quotes, invoices and payments, schedule staff, publish posts the business turns on, and give support.
• To create website and social content with AI, and to let assistants answer from what the business has told us.
• To bill for our service and to keep financial records.
• To communicate with you about your account, including billing notices and security codes.
• To contact businesses about TuaniBiz, by text only with consent (see Businesses we may contact).
• To keep the service secure, prevent fraud and spam, and enforce our terms. One use crosses businesses: when a number is reported as spam or a robocaller by one business using our receptionist, that reputation helps protect the others.
• To understand how the service is used and improve it.
• To comply with the law and respond to lawful requests.

We do not use one business's customer information to market to another business's customers, and we do not use it for anything other than providing our service, apart from the spam protection described above.

Who receives it

• Our service providers, which process it to provide their services to us. They are listed, with what each receives and where it processes data, on our Subprocessors page.
• The business you deal with. Information about a business's customers and staff goes to that business, in its dashboard and in the alerts it receives.
• Services a business connects. When a business connects Facebook, Instagram or Google, information flows to and from those accounts. When a business connects an AI assistant such as ChatGPT or Claude to its dashboard (our AI connector), that assistant can read the information the business allows. Those services are the business's choice and their own terms apply.
• The public, for content a business publishes on its website or social accounts.
• Authorities and others when the law requires it, or to protect people, our service or our rights.
• A buyer or successor, if our business is sold or merged, under this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Businesses we may contact

We help local service businesses get online, and we contact businesses we think could use TuaniBiz.

• Where we find businesses: Google's public business listings (through the Google Places service) and the business's own public website.
• What we keep: the business's name, address, phone number, website, category, rating and public reviews, and information published on its website, such as services, team members' names and short bios, and contact details.
• What we do with it: we may use AI to build a free demo website for the business from that information, and we may call the business. Calls with our sales team may be recorded and transcribed through our phone provider.
• Texts: we text a business only with consent for that number, given on our website or by telling one of our sales representatives. Texts can be composed and sent by our AI assistant, which introduces itself as TuaniBiz's AI assistant. We do not start sales texts before 8 AM or after 8 PM local time.
• Opting out: reply STOP to any text, tell the person you are speaking with, use the Privacy Center or write to dennis@tuanibiz.com. We keep the number on our do-not-contact list so the request sticks.
• Deleting your information: use the Privacy Center. We delete what we hold about the business. We keep only a one-way digest of its Google listing id and phone number, so that our searches do not add it back, and, if you asked us to stop texting, the number on our do-not-text list.

Calls, AI and transcripts

• The AI phone receptionist. When a business uses our AI receptionist, calls to its TuaniBiz number are answered by AI. Callers hear a notice at the start of the call, and the receptionist says it is the business's AI assistant. The audio is carried by our phone providers and processed in real time by our AI provider to hold the conversation. We keep a written transcript and summary of the call, the caller's number and any message or booking made; we do not keep an audio recording of the call.
• Calls to a business's team. Emergency alerts and announced transfers that our system places to a business's own staff use an AI-generated voice.
• Website chat and social messages. The assistant on a business's website, and the automatic replies on its Facebook, Instagram and TikTok, are AI and say so. Chat messages are saved for the business.
• Sales calls with TuaniBiz. Calls between our sales team and businesses may be recorded and transcribed by our phone provider, Zoom.
• AI providers. We send conversations, transcripts and business information to AI providers, currently OpenAI, xAI and Google (Gemini), and ElevenLabs for some older receptionist setups, to generate replies, transcripts, summaries, website content and images. Each one, and what it receives, is on our Subprocessors page. Our AI Disclosures explain where AI is used and its limits.

Text messages (SMS)

TuaniBiz may collect mobile phone numbers and SMS consent when people communicate with us or with businesses using our services. Our two text programs, demo and sales texts, and account alerts, are described in our SMS Terms.

We do not sell, rent, or share consumer mobile information, including phone numbers, with third parties or affiliates for marketing, promotional, or lead generation purposes.

SMS opt-in data and consent will not be shared with any third parties or affiliates for marketing or promotional purposes.

Information may only be shared with service providers when necessary to provide messaging, communications, or other services requested by the user.

Users may opt out of SMS communications at any time by replying STOP. Users may reply HELP for assistance. Message frequency may vary and message and data rates may apply.

A STOP sent to any of our numbers places that phone number on a single do-not-text list that every one of our text programs checks before sending. Replying START or UNSTOP from the same phone lifts it. When you give consent, we keep a record of it: the words you agreed to, the number and the time, and, when you agree online, the IP address and browser used.

Google user data

A business owner can connect a Google account to TuaniBiz. We then request these permissions:

• Your email address (userinfo.email, with openid), to show which Google account is connected.
• Google Business Profile (business.manage), to read your business profile and publish the changes you approve.
• Search Console (webmasters), to read your search queries, pages and indexing status and to submit your sitemap.
• Site Verification (siteverification), to verify your website in Search Console when it has never been verified.

We store the access tokens Google issues, the connected account's email, and the ids of your profile and properties. We use this data only to show you your Google performance in your dashboard, to suggest pages for your website, and to make the changes you approve. To write those suggestions, we send your search data to our AI provider. We do not sell data we receive from Google, use it for advertising, or use it to train AI models. People at TuaniBiz do not read it unless you ask us to, it is needed for security, or the law requires it. TuaniBiz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

There is no disconnect button in the dashboard yet. You can remove our access at any time from your Google Account's security settings (third-party apps with account access), and you can ask us through the Privacy Center to revoke our access and delete the tokens we hold. When an account is deleted, we revoke its Google connection before deleting the tokens.

Separately, TuaniBiz's own Google account registers the websites we host in Google Search Console so we can submit their sitemaps and watch their indexing. For a website on the business's own domain, this places our verification tag on the site we host and makes our account one of the property's verified owners; see our Terms of Service.

Facebook and Instagram data

Connecting a Facebook Page or Instagram account is optional and always started by the business owner. When they do, we store the access tokens Meta issues, the Page id and name, and the linked Instagram account id and username. We use them only to:

• publish posts the business creates or approves;
• read the account's own recent photos, when the business wants them on its website;
• receive messages and comments addressed to the business's account and, when the business turns this on, reply with its AI assistant, which says it is automated.

We do not read messages beyond the conversations addressed to the connected account, and we never sell this data or share it with advertisers or data brokers. There is no disconnect button in the dashboard yet: remove TuaniBiz in Facebook under Settings and Privacy, then Settings, then Business Integrations or Apps and Websites, and Facebook revokes our access. To have the tokens and data we hold deleted, use the Privacy Center or follow our Data Deletion instructions; when an account is deleted, we revoke its Facebook connection before deleting the tokens.

TikTok data

Connecting TikTok is optional and always started by the business owner, and there are two separate connections, each with its own TikTok sign-in.

Posting. When the business connects TikTok to post, we store the access tokens TikTok issues, the account's TikTok ID, display name and profile picture. We use them only to:

• read the account's posting settings from TikTok (its nickname, which privacy options it has, whether comments are on) each time the business opens the posting screen and right before a post goes out;
• publish the posts the business confirms on that screen, at the time it chose, with the settings it chose there (who can see the post, comments, and the commercial content disclosure);
• check with TikTok whether each post was published.

Nothing is sent to TikTok before the business confirms the post on the posting screen.

Comments and messages. When the business connects TikTok for comments, we store the access tokens TikTok issues and the account's TikTok ID, username and display name. We use them only to read the comments on the posts the business chooses, to reply to them when the business turns that on, and, where TikTok allows it, to answer the people who write to the account with its AI assistant, which says it is automated. We keep the username and comment of the people who show interest, so the business can follow up.

We never sell this data or share it with advertisers or data brokers. Each connection has a Disconnect button in the dashboard's Social tab; the account owner can also remove TuaniBiz in TikTok under Settings and privacy, then Security, then Apps and services. To have the tokens and data we hold deleted, use the Privacy Center; when an account is deleted, its TikTok tokens are deleted with it.

Cookies, Do Not Track and Global Privacy Control

Our own website and dashboards use only cookies needed to sign in, stay secure and take payments, plus browser storage for preferences and our own usage statistics; we do not use advertising cookies on them. On our own public pages (the home page, sign-up, checkout and these legal pages) we may count visits with Cloudflare Web Analytics, which sets no cookie, keeps no browser storage and does not follow you across sites; the dashboards have no third-party analytics. The websites we host set no cookies by default. Google Analytics runs on a business's website only if the business has connected it and the visitor chooses to allow analytics, and never in a browser that sends a Global Privacy Control signal. Details are in our Cookie Policy.

We treat a Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal information from that browser. We do not sell or share personal information in any case, and on the websites we host GPC also keeps optional analytics off. Our sites do not change their behavior in response to Do Not Track signals, because there is no common standard for them; GPC is the signal we honor.

Except for Stripe's fraud-prevention cookies on our payment pages, we do not allow other companies to collect information about your activity across websites over time on our own website. On a business's website, the third parties described in our Cookie Policy may do so only as described there.

How long we keep it

We keep personal information only as long as we need it for the purposes above, then delete it or strip what identifies a person. These are our default periods. Where a range is shown, it is the span a business may choose from for its own records; the default applies unless it asks for another period.

• Account and business profile: while the account is open. When a paid plan ends, 90 days after the end of the last paid period; we warn the owner before deleting.
• Demo websites nobody claims: 90 days after the demo period ends.
• A business's customer records (bookings, quotes, opportunities, contact-form submissions): contact details removed 36 months after the customer's last activity (12 to 84 months); form submissions that never became customers, 24 months.
• Invoices and payment records: 7 years, for tax and accounting.
• Payment evidence kept for disputes (IP address and browser): 24 months after the payment, or 1 year after a dispute closes.
• Dispute files: 2 years after the outcome.
• Text messages and emails: 24 months; delivery records, 90 days; sales texts with prospects, 24 months after the last contact.
• Proof of consent and of opt-outs: 5 years. The do-not-text list itself is kept for as long as we send texts, so an opt-out is never forgotten.
• Website chat and social messages: 12 months (1 to 36 months).
• Team chat: 12 months; photos, videos and voice notes, 6 months.
• Call records (who called, when and the outcome): 24 months (6 to 36 months).
• Call transcripts: 180 days, then only the summary is kept (30 to 730 days).
• Messages taken by the receptionist: 24 months (3 to 60 months).
• Alert delivery records: 90 days. Owner sign-in sessions by phone: 30 days after they expire.
• Website statistics: 25 months, then only totals.
• Dashboard usage analytics: 400 days.
• Security records: audit log of account actions, 400 days; security events, 90 days; resolved security incidents, 180 days; rate-limit records, about an hour.
• Expired sign-in codes, sessions and device tokens: 7 to 30 days after they expire.
• Prospects: businesses we never contacted, 12 months; copies of their websites, 90 days; conversations that did not lead to a sale, 24 months after the last contact; a minimal do-not-contact record, for as long as we contact businesses.
• Affiliates: applications we declined, 24 months; the profile of a partnership that ended, 24 months; payout and tax records, 7 years.
• Privacy requests: 24 months.
• Google and Facebook connection tokens: until the connection is removed or the account is deleted.
• Backups: [To be completed by the owner: how long database backups are kept].

We are rolling out automated enforcement of this schedule in stages. Each automated deletion job first runs in report-only mode, measuring what it would delete, before it deletes anything; until a category's automated deletion is switched on, information in it may be kept longer than shown here. You can always ask us to delete your information sooner through the Privacy Center. Some information is kept longer when the law requires it, to resolve a dispute or chargeback, or to keep an opt-out on record.

How we protect it

• Our websites and apps are served only over encrypted connections (HTTPS), and our storage providers encrypt the disks that hold our data.
• Our database is closed to direct public access: every table has row-level security, and apart from affiliates reading their own records, only our own servers can read or write it.
• PINs are stored only as salted hashes. Sensitive actions, such as billing changes and PIN resets, can require a fresh one-time code sent by text. Sign-in cookies cannot be read by page scripts and can be revoked.
• Messages from Stripe, Meta, Zoom, our email provider and our phone carrier are checked for their signatures before we act on them. Public forms are rate-limited, and automated monitoring alerts us to suspicious activity.
• Staff access is limited by role, and support access to a business's dashboard is time-limited and logged.
• Team chat photos, videos and voice notes are kept in private storage and opened through short-lived links.

No method of storing or sending information is completely secure, and we cannot guarantee security. If a breach affects your personal information, we will notify you and the authorities as the law requires.

Your rights and how to use them

Whatever law applies to you, you can ask us to:

• tell you what personal information we have about you, where it came from, why we use it and who receives it;
• give you a copy of it in a portable format;
• correct it if it is wrong;
• delete it;
• not sell or share it, and limit the use of sensitive information (we do neither, but you can still record the request);
• review a decision we made about one of these requests (an appeal).

How to ask. Use our Privacy Center, or write to dennis@tuanibiz.com. Account holders can also download their account data, and ask for their account to be deleted, from My account in their dashboard.

Verification. Before we act, we confirm the request comes from you, usually by sending a one-time link or code to the email address or phone number connected to the information. Account holders may be asked to sign in. We ask only for what we need to verify you, and use it only for that.

Timing. We respond within 45 days of receiving your request. If we need more time, we will tell you why before that deadline and may extend it once, by up to 45 more days, where the law allows.

Customers of a business that uses TuaniBiz. We hold your information for that business. Send your request to the business, or to us through the Privacy Center, and we will pass it to the business and help it respond.

Authorized agents. Someone you authorize can make a request for you. We will ask for your signed permission and may ask you to verify your identity with us directly.

What we may keep. We may keep information we need to complete a transaction, keep financial records the law requires, resolve disputes, protect the security of the service, or honor an opt-out.

No discrimination. We will not refuse service, charge a different price or provide a different quality of service because you used a privacy right.

Depending on our size, some privacy laws, such as the California Consumer Privacy Act, may not apply to us yet. We offer these rights to everyone anyway.

Health information

TuaniBiz is not designed for protected health information under HIPAA. TuaniBiz is not HIPAA compliant, we do not sign business associate agreements, and we do not offer our service to healthcare providers that would need one. Healthcare businesses whose websites we built earlier keep their websites, but their chat assistant and online booking collect nothing; visitors are asked to call the business instead. Businesses must not use TuaniBiz to collect or store health information. If you are a customer of a spa, wellness or other business that uses TuaniBiz, please do not share health details in a chat, booking or call; give them to the business directly.

Children

TuaniBiz is a tool for businesses and is not directed at children under 13. Accounts are for people 18 or older, who confirm their age when they sign up. We do not knowingly collect personal information from children under 13; if we learn that we have, we delete it. If you believe a child has given us information, write to dennis@tuanibiz.com and we will remove it.

Where we process information

We operate TuaniBiz from the United States, and our service providers process information in the United States and, for some, in other countries. If you use TuaniBiz from outside the United States, your information is transferred to and processed in the United States.

Changes to this policy

When we change this policy, we post the new version here with a new version number and date. If a change is material, we will tell account owners by email before it takes effect.

Contact

• Tuanilabs LLC
• Email: dennis@tuanibiz.com
• Mail: 15333 Culver Drive, Ste 340 #2211, Irvine, CA 92604
• Privacy requests: Privacy Center