Privacy Policy

BruBiz is operated by H Biznees Enterprise, registered in Brunei Darussalam under registration number P30017653. In this policy “BruBiz”, “we”, “us” and “our” mean that business.

This policy covers brubiz.com, the subscriber dashboard, and the storefronts we host at subdomains of brubiz.com. It applies alongside our Terms of Service.

If you have a question about anything here, write to us at support@brubiz.com. We would rather answer a question than have you guess.

This is the most important thing to understand about privacy on BruBiz, because it decides who is responsible for what and who you should ask when you want something done.

In data protection language, we are the controller of subscriber account data and a processor of storefront customer data. The practical consequence: if you ordered from a business hosted on BruBiz and you want your details changed or erased, the business is the right place to start — see section 3.

You placed an order or made a booking on a site such as yourfavouritecafe.brubiz.com. That site belongs to that business. BruBiz is the software behind it.

• The business holds your details — your name, phone number, email address, delivery address if you gave one, what you ordered or booked, any notes, and any payment proof you uploaded. They can see all of it in their dashboard.
• We store it for them. We do not use it for our own purposes, we do not sell it, and we do not add you to any BruBiz marketing list.
• Your payment did not go through us. Cash, bank transfer and QR payments go directly to the business. We never receive or hold your money and we do not store card details — BruBiz does not accept cards at all.
• To access, correct or delete your details, ask the business directly using the contact details on their storefront. If they do not respond, or you cannot reach them, contact us at support@brubiz.com and we will help — though we may need the business’s instruction before we can change their records.
• Emails you receive about your order or booking come from our mail servers, showing the business’s name, with the business’s address for replies. This is a technical requirement for the messages to be delivered reliably; the content is the business’s.

If you subscribe to BruBiz, we collect and hold:

• Account details — your name, email address, phone number, business name, and the role and permissions of each person you give access to.
• Login credentials — your password, stored only as a cryptographic hash that cannot be reversed. Nobody at BruBiz can see your password. If one-time login codes are enabled for your account, those codes are also stored hashed and expire quickly.
• Business and billing information — your business address and contact details, your plan, quotations, invoices, receipts and payment records.
• Your payout bank details — the account you ask us to display so your customers can pay you. This is treated as sensitive: it is never included in the public data served for your storefront, it is delivered separately only at the point a customer needs to pay, and within your own team it is visible only to the manager account.
• Your site content — everything you publish: business description, menu and prices, services, photographs, opening hours, team members, testimonials and so on. Some of this is personal information about you or your staff, and most of it is deliberately public.
• Support correspondence — emails, contact form submissions and WhatsApp messages you send us, so we have a record of what was asked and what we did.
• What you agreed to, and when. When you accept a quotation we record the date, which version of our terms was in force, and the IP address the acceptance came from. When you accept the terms in your dashboard we record the date, the version and which of your logins clicked. This is kept as evidence of the agreement between us — a quotation page is open to anyone holding the link, so the IP address is the only independent signal of who accepted it.
• A record of activity in your account — which section of your business was changed, by which member of your team, and when. This exists so you can answer “who changed my prices”. It deliberately records the section touched and not the values, so it is not a diary of your staff’s work.

Aggregate visitor numbers for your storefront are also shown on your public directory listing. These are counts, not information about individuals — tell us if you would prefer not to be listed in the directory at all.

If you send us a rights complaint

This part is for people who are neither subscribers nor their customers. If you tell us that material on brubiz.com or on a storefront we host infringes your copyright or trade mark, we keep a record of it: your name and contact details, what you told us, when it arrived, what we decided, and when. We keep it because our Terms commit us to reviewing complaints and acting on well-founded ones, and we cannot show we did that without a record.

We will normally need to tell the business concerned what has been claimed and by whom, so that they can respond — you should assume your complaint will be passed on. These records are kept for as long as they may be needed to deal with a repeat or related complaint, or to defend a legal claim.

When someone orders, books or gets in touch through a storefront we host, the following is collected and stored for the business:

• Orders — name, phone number, email address if given, delivery address and delivery zone for deliveries, the items ordered and their prices, order notes, answers to any custom checkout questions the business added, chosen payment method, and any promotional code used.
• Bookings — name, email address, phone number, the service, staff member or resource booked, date and time, party size, notes, answers to custom questions, and any deposit paid.
• Enquiries — name, email address, phone number and the message sent through a contact form.
• Payment proofs — where a customer pays by transfer or QR and uploads a screenshot or photograph as proof. These images often show a bank account name, an account number, and sometimes a balance. They are stored in a folder specific to that one business, are not publicly listed, and are visible to that business and to our administrators only.

The business chooses which of these systems it uses and what custom questions it asks, so exactly what is collected varies from one storefront to the next.

• IP address and request information. Our servers receive the IP address, browser type and requested page for every visit, as any web server does. We use the IP address to apply rate limits — the mechanism that stops a public form being flooded, a password being guessed repeatedly, or our systems being overwhelmed. Rate-limiting records are held briefly in a temporary cache and expire on their own.
• Storefront visit counts. We keep a daily count of page views for each storefront, so businesses can see how their site is doing. This is a number per business per day — we do not build a profile of individual visitors, we do not record which visitor viewed which page, and we do not track anyone across different storefronts or across the web.
• Server logs and error reports, used to diagnose faults and keep the Services secure.
• Administrative audit records of significant actions by our own staff — such as accessing a subscriber account for support — so that access is accountable.

• To provide the Services — create and run your account, publish your storefront, take and manage orders and bookings, and send the confirmations and reminders that go with them.
• To bill you and keep financial records — quotations, invoices, payments and receipts, and the accounting and tax records we are required to keep.
• To support you — answer your questions, investigate faults, and restore your account when something goes wrong.
• To keep the platform secure — apply rate limits, detect and investigate abuse or unauthorised access, and maintain audit records.
• To communicate with you about your account — renewal reminders, invoices, service notices, security alerts and material changes to our terms. These are not marketing and you cannot opt out of them while you hold an account, because they are how the service is administered.
• To improve BruBiz — understand which features are used and where people get stuck, so we can fix and improve them.
• To comply with the law and to establish, exercise or defend legal claims.
• With your permission, to feature your business as an example of our work. You can withdraw this at any time.

We rely on the contract between us for most of this, on our legitimate interest in running and securing the platform for security and improvement, on legal obligation for financial records, and on your consent where this policy says so.

It is worth being explicit, because many privacy policies quietly reserve these rights and ours does not:

• We do not sell your personal information, or a business’s customer data, to anyone.
• We do not run advertising on brubiz.com or on any storefront, and we do not serve targeted advertising anywhere.
• We use no advertising or analytics trackers. There is no Google Analytics, no advertising pixel, and no third-party tracking script on our site or on the storefronts we host. We do keep two simple counts of our own: how many times each page of brubiz.com was loaded, and which business names were typed into the availability checker on our home page. Both are stored only as daily totals. Neither records your IP address, sets a cookie, or contains anything that identifies you or links one visit to another.
• We do not buy personal information from data brokers, marketing partners or public databases to enrich our records.
• We do not use social media logins, so we never receive your friends list, profile or contacts from a social network. Social links on a storefront are simply links the business typed in.
• We do not send SMS marketing.
• We do not store card or payment credentials, because we do not process card payments.
• We do not use your business data or your customers’ data to train machine learning models.

We use very few cookies, and every one of them is strictly necessary to make the service work. We set no advertising or analytics cookies, which is why you are not asked to accept a cookie banner.

Cookies we set

• Sign-in tokens — set when you log in to the dashboard or the admin panel, so you stay signed in between pages. They are removed when you sign out.
• Support session marker — set only while one of our administrators is accessing an account for support, so the dashboard can display the banner that says so.

Visitors to a storefront who only browse, order or book are not given any BruBiz cookie at all.

Local storage

Two things are kept in your browser’s own storage rather than sent to us: your shopping cart for a given storefront, so it survives a page reload, and a timestamp used to sign you out of the dashboard automatically after a period of inactivity. Clearing your browser data removes both.

Third-party embeds

If a business adds a map to its storefront, the map is embedded from Google Maps. When that page loads, your browser contacts Google directly, and Google may set its own cookies and receive your IP address under its own privacy policy. We do not control this and receive nothing from it. Pages without a map make no third-party requests.

We share personal information only in the following circumstances:

• With the business you interacted with. Orders, bookings and enquiries are visible to the business they were sent to — that is the point of them.
• With service providers who help us run the platform, listed below. They act on our instructions and may not use the information for their own purposes.
• Where the law requires it — in response to a valid legal request, or to establish, exercise or defend a legal claim.
• To prevent harm — where we reasonably believe disclosure is necessary to prevent fraud, a security threat, or a risk to someone’s safety.
• If our business is transferred — if BruBiz is sold or merged, information may transfer with it. We will tell subscribers before that happens and the buyer will be bound by this policy.

Categories of service provider

We work with a small number of processors to run BruBiz. We name the category of service each one performs, rather than the specific company, because the category is what tells you something meaningful about your data; the vendor name does not. We remain responsible for what each one does with your information.

• Server hosting — a commercial cloud infrastructure provider, located in Singapore. This is where the application and database run, so it holds everything described in this policy.
• Email delivery — a third-party transactional email provider. Message contents and recipient addresses pass through this provider.
• Google Maps — only on storefronts that embed a map, and only as described in section 9. Named specifically because it is directly visible in your browser whenever a map loads — there is nothing to disclose by naming it that the page itself does not already show.

We will keep this list current as our providers change, and can tell you the specific company behind a category on request.

Our servers are located in Singapore, chosen for its proximity to Brunei. Our email provider operates globally and may process message contents outside Singapore.

This means personal information collected through BruBiz — including the details of customers who order from Bruneian businesses — is stored outside Brunei Darussalam. By using the Services you accept that transfer. We take reasonable steps to ensure our providers protect the information to a standard consistent with this policy.

• Account and site content — for as long as your subscription is active. When it ends, your account is deactivated and retained for up to 90 days so it can be restored if you return or if it was suspended in error, and then permanently deleted. We will give you notice before permanent deletion, and you can ask for a copy of your data first. See “What happens to your site and data” in our Terms.
• Orders, bookings and enquiries — for as long as the business keeps them. Items a business deletes are hidden immediately and removed permanently thereafter.
• Financial records — invoices, receipts and payment records are kept for as long as tax and accounting law requires, even after an account closes.
• Records of what was agreed — quotation and terms acceptances, kept for as long as the agreement could still matter, which may be after an account closes. A record of an agreement is worth nothing if it is deleted before the dispute it exists for.
• Rights complaints — kept while they may be needed for a repeat or related complaint, or to defend a legal claim.
• Emails awaiting retry — if a message cannot be sent, it is held briefly so it can be tried again, and is deleted a few days after it succeeds. Sign-in codes, password reset links and new-account passwords are never held this way.
• Account activity records — kept for a limited recent window and then discarded automatically.
• Rate-limiting and sign-in code records — held in a temporary cache for minutes to hours and then expire.
• Backups — kept on a rolling cycle. Deleted information can persist in a backup until that backup expires, after which it is gone.

• All traffic to brubiz.com and to every storefront is encrypted with HTTPS.
• Passwords are stored only as irreversible hashes; nobody at BruBiz can read them.
• Changing a password immediately invalidates every existing session, so a password that may have been exposed cannot keep being used.
• Access within a business is limited by role: staff see only what the manager grants them, and sensitive items such as bank details are withheld from staff accounts entirely.
• Uploaded files are validated by content rather than by filename, are confined to the uploading business’s own folder, and cannot be used to reach other files on the server.
• Public endpoints are rate limited, and sensitive administrative actions require re-confirmation and are recorded in an audit log.
• Backups are taken regularly and stored separately from the live server.

No system is perfectly secure. We cannot guarantee that information transmitted over the internet will never be intercepted, and you share information with us at your own risk. If a breach occurs that is likely to affect you seriously, we will tell you and any relevant authority as promptly as we can.

Whatever your location, we offer you the following:

• Access — ask what personal information we hold about you and get a copy.
• Correction — have inaccurate information fixed. Subscribers can edit most of it directly in the dashboard.
• Deletion — ask us to delete your information, subject to anything we must keep for legal, tax or accounting reasons.
• A copy of your data in a common machine-readable format.
• Objection — ask us to stop a particular use, such as featuring your business as an example of our work.
• Withdrawing consent — where we relied on your consent, you can withdraw it at any time. This does not affect what was done beforehand.
• Complaint — tell us if you think we have handled your information badly, and complain to a data protection authority where one has jurisdiction over you.

To exercise any of these, email support@brubiz.com or use the contact form. We will respond within 30 days. We may need to verify who you are first, so that we do not disclose someone’s information to the wrong person. There is no charge unless a request is repetitive or excessive.

Marketing: if you receive occasional marketing from us, every message has an unsubscribe option and you can ask us to stop at any time. Messages about your account, billing and security will continue while you hold an account.

BruBiz is a service for businesses, and subscribers must be at least 18. Storefronts hosted on BruBiz are ordinary business websites intended for a general audience; we do not knowingly collect personal information from a child under 13 and we do not direct any part of the Services at children.

If you believe a child has given us personal information, contact us at support@brubiz.com and we will delete it.

Some browsers offer a “Do Not Track” setting. There is no agreed standard for how sites should respond to it, so we do not act on it specifically — but the point is largely moot here: we run no advertising or analytics trackers at all (section 8), so there is no cross-site tracking to switch off.

We may update this policy as BruBiz changes or the law develops. The date at the top shows when it was last updated.

If a change materially affects how we handle your information, we will tell subscribers by email and in the dashboard before it takes effect. Otherwise, the updated policy applies from the date it is published. Please check back from time to time.

For any privacy question, request or complaint: