Privacy Policy

We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Please read this policy carefully before using the Buz-co platform.

1. Who We Are

Buz-co Pty Ltd ("we", "us", "our") operates the Buz-co mobile platform ("the Platform"). We are an Australian company subject to the Privacy Act 1988 (Cth).

Our Privacy Officer can be contacted at: [email protected]

2. Information We Collect

We collect the following categories of personal information:

Account Information: Full name, email address, phone number, password (hashed — never stored in plain text).
Seller Information: Business name, Australian Business Number (ABN), business address (street, suburb, state, postcode).
Profile Information: Profile photo (if uploaded), vehicle garage (makes, models, years you add), star ratings and reviews.
Transaction Information: Order history, payment status, shipping details, tracking numbers, return and dispute records.
Communications: Messages exchanged with other users on the Platform, AI advisor conversation history.
Device Information: Device token for push notifications (with your consent), platform type (iOS or Android).
Usage Data: Search queries, listings viewed, pages accessed, timestamps. Collected in aggregate and used to improve the Platform.
Analytics & Diagnostic Data: Screen views, session duration, device type, operating system, app version, approximate (city-level) location derived from IP address, conversion events (such as searches, listing views, and purchases), and interaction data (clicks, scrolls, and navigation patterns). Used to understand product usage, diagnose errors, and improve the Platform. Collected via the third-party analytics services listed in section 4.

3. How We Use Your Information

We use your personal information to:

Create and manage your account;
Process transactions and payments;
Send order confirmations, shipping updates, and return/dispute notifications;
Send push notifications about account activity (with your consent);
Verify seller identity and ABN for onboarding to Stripe Connect;
Provide customer support and resolve disputes;
Improve the Platform through aggregated analytics;
Comply with our legal obligations under Australian law;
Detect and prevent fraud and misuse of the Platform.

We do not sell your personal information to third parties. We do not use your data for targeted advertising.

4. Third Parties We Share Data With

We share personal information with the following third parties only to the extent necessary to operate the Platform:

Stripe, Inc. — Payment processing, Stripe Connect seller onboarding, payout management. Stripe is PCI-DSS Level 1 compliant. See stripe.com/en-au/privacy.
Google LLC — Address autocomplete (Google Places API). Only the address text you type is sent — no other personal data. See policies.google.com/privacy.
Anthropic, Inc. — AI Parts Advisor powered by Claude. Your AI conversation messages are sent to Anthropic's API. See anthropic.com/privacy.
Google Firebase (FCM) — Push notification delivery. Your device token is shared with Firebase to route notifications to your device.
Google Cloud Platform — Our servers are hosted in the Australia region (asia-southeast1). All data is stored in Australia.
Google Analytics (Firebase), Google LLC — We use Google Analytics, delivered through Firebase, to understand how users interact with the Platform. Data collected includes screen views, session duration, device type, operating system, app version, approximate (city-level) geographic region, and event data (such as searches, listing views, add-to-cart, and purchases). Where you are signed in, a pseudonymous user identifier (your internal account ID) and coarse role attributes (buyer or seller) are sent so we can analyse behaviour by user segment. We do not send your name, email address, phone number, or payment details to Google Analytics. See policies.google.com/privacy.
Microsoft Clarity, Microsoft Corporation — We use Microsoft Clarity to record anonymised session activity (screen navigation, clicks, scrolls, and taps) and to generate heatmaps that help us diagnose usability issues. Clarity automatically masks sensitive inputs — it does not capture passwords, payment card details, or other sensitive form fields. Where you are signed in, your pseudonymous user identifier is passed so recordings can be filtered by user. See Microsoft's privacy statement at privacy.microsoft.com/en-us/privacystatement.
Meta Platforms, Inc. (Facebook SDK and Meta Pixel) — We use the Facebook SDK within our mobile app and the Meta Pixel on our website (buz-co.com) to measure the effectiveness of our marketing and to understand how users discover the Platform. Events shared include app opens, searches, listing views, registrations, and purchase values. On iOS, no advertising identifier is shared unless you grant permission via Apple's App Tracking Transparency prompt. See facebook.com/privacy/policy.
Sentry (Functional Software, Inc.) — We use Sentry for crash and error reporting. When an error or crash occurs, Sentry receives a stack trace, device model, operating system version, app version, and a pseudonymous user identifier where you are signed in. This helps us identify and fix defects. See sentry.io/privacy.
Mailgun (Sinch Email), Sinch AB — We use Mailgun to send transactional and account-related emails (order confirmations, shipping updates, password resets, and optional marketing newsletters). Your email address and the content of those messages are processed by Mailgun. See mailgun.com/privacy-policy.

We may also disclose personal information to law enforcement or regulatory authorities where required by law, or where necessary to protect our rights, your safety, or the safety of others.

Marketing emails. You can unsubscribe from marketing emails at any time using the unsubscribe link at the foot of every marketing message, or by updating your notification preferences within the Platform. Transactional emails (order confirmations, shipping updates, security notices, and similar) are required to operate the service and cannot be unsubscribed from while your account is active.

5. Push Notifications

With your consent, we send push notifications about order updates, new messages, return and dispute status changes, and important account notices. You can withdraw consent at any time through your device's notification settings or within the Platform's Settings screen.

We store your device token associated with your account. Tokens are deactivated when you log out.

6. Data Security

We take reasonable steps to protect your personal information. Our security measures include:

All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher;
Passwords are hashed using bcrypt and are never stored in plain text;
Authentication tokens are stored securely using your device's Secure Store;
Payment card data is handled exclusively by Stripe — we never receive or store raw card numbers;
Access to production systems is restricted to authorised personnel only;
Profile images and evidence photos are stored in Google Cloud Storage with private access controls.

Despite our efforts, no system can be completely secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect any unauthorised access to your account.

7. Data Retention

We retain your personal information for as long as your account is active, plus the following periods after closure:

Transaction and financial records: 7 years (required by Australian taxation law);
Dispute and return records: 3 years;
Communications (messages, AI conversations): deleted within 12 months of account closure unless required for an active dispute;
Device tokens: deleted immediately upon logout or account closure.

You may request deletion of your account and personal data by contacting [email protected]. We will process deletion requests within 30 days, subject to our legal retention obligations.

8. Your Rights Under the Privacy Act 1988

Under the Australian Privacy Principles, you have the right to:

Access: Request a copy of the personal information we hold about you;
Correction: Request correction of inaccurate or incomplete personal information;
Deletion: Request deletion of your personal information (subject to legal retention requirements);
Complaint: Lodge a complaint about our handling of your information.

To exercise these rights, contact our Privacy Officer at [email protected]. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Cookies, Local Storage, and Analytics SDKs

Within the mobile app. The mobile app does not use browser cookies. We use similar technologies on your device (such as AsyncStorage and the Secure Store) to remember your login session, save your selected vehicle and preferences, and cache search filters. This data is stored locally on your device.

The mobile app also integrates analytics and diagnostics software development kits (SDKs) from Google (Firebase Analytics), Microsoft (Clarity), Meta (Facebook SDK), and Sentry. These SDKs collect the categories of data described in section 4 and transmit it to those providers for processing on our behalf.

On our website (buz-co.com). Our website uses first-party and third-party cookies and similar technologies to operate the site and to measure its effectiveness. This includes Google Analytics (gtag.js), Microsoft Clarity session replay, and the Meta Pixel. You can control cookies through your browser settings — blocking cookies may affect site functionality.

Your choices. You can limit analytics collection by:

On iOS — declining the App Tracking Transparency prompt when the app first asks;
On Android — opting out of ad personalisation in your device's Google settings;
In your browser — using its "Do Not Track" setting, blocking third-party cookies, or installing a privacy extension.

10. Children's Privacy

The Platform is not directed at persons under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at [email protected] and we will delete the information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Platform. The "Last updated" date at the top of this policy reflects the date of the most recent revision. Continued use of the Platform after notification of changes constitutes acceptance of the revised policy.

12. Contact Us

For privacy inquiries, requests, or complaints:

Email: [email protected]

We aim to respond to all privacy inquiries within 5 business days.