Last updated: 17 October 2026
Bizzlet is an app that lets small businesses and makers run a shop from their phone: an online storefront, card and cash sales, stock, orders, customers, invoices and reports. This policy explains what personal information Bizzlet handles, why, who it’s shared with, how long it’s kept and what rights you have. It’s written for the UK General Data
Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications
Regulations (PECR).
Contents
1. Who we are
2. Who this policy covers
3. Information we collect about shop owners
4. Information we handle about shoppers
5. How we use information, and our legal reasons
6. Emails we send
7. Who we share information with
8. International transfers
9. How long we keep information
10. Cookies and browser storage
11. How we protect information.
12. Your rights
13. Complaints
14. Children
15. Automated decisions
16. Changes to this policy
17. Contact us
1. Who we are
Bizzlet is provided by Tiny Grove UK , a company registered in England. In this policy, “Bizzlet”, “we”, “us” and “our” mean that company. You can reach us about anything in this policy at support@bizzlet.com.
2. Who this policy covers
Bizzlet handles information about two groups of people, in two different roles:
Shop owners (“makers”): people who sign up to run a shop on Bizzlet. For your account, subscription and use
of the app, we are the controller: we decide how and why that information is used.
Shoppers and a shop’s customers: people who buy from, or contact, a shop that runs on Bizzlet, and the
customers a maker records in the app. Here the shop is the controller. Bizzlet is the shop’s processor: we hold
and process that information on the shop’s behalf, to provide the shop’s service to you. Each shop’s own
privacy policy (linked from its shop pages and checkout) explains what it does with your details, so please read
that too.
We’re also a controller for a small amount of shopper information that we use for our own purposes: keeping the
platform secure, preventing abuse and meeting our legal obligations (see section 5).
3. Information we collect about shop owners
Type What it includes Where it
comes from
Account Email address and password. Passwords are stored only as a secure
hash by our authentication provider; we never see them.You, when you
sign upShop profile Business name, bio, profile and banner images, shop colour and
headline, currency, whether you take cash, your returns and privacy
policies, and the contact email and phone number you choose to
show shoppers.YouBusiness details Business address, VAT registration status, VAT number and VAT
scheme, used for your invoices and VAT reports.YouSubscription Your plan, plan status and renewal date, and Stripe customer and
subscription references. Card details are entered on Stripe’s
payment page and never reach Bizzlet.You and StripePayouts (Stripe
Connect)Your Stripe account ID and whether it can take payments. Stripe
collects your identity, bank and business details directly for its own
legal checks; we don’t receive or store them.StripeYour business
recordsProducts (names, descriptions, prices, cost prices, SKUs, stock
counts, photos and downloadable files), orders, sales rung up in
person, stock history, discount codes, customer records, invoices
and notes.You, and your
shoppers’
ordersSupport Messages you send us through in-app support, our replies, and the
email address you want us to reply to.YouEmail records A log of service emails sent on your behalf or to you: type, recipient,
subject, date and whether it was delivered. The log does not keep the
content of the email.Created by the
app
Technical Information your device sends when you use the app, such as IP
address, browser type and the pages requested, handled by our
hosting provider to deliver and secure the service.Your device
4. Information we handle about shoppers
When you buy from or contact a shop on Bizzlet, we handle the following for that shop:
Order details: your name and email address. For anything that needs delivering, also your phone number and
delivery address. We also record what you ordered, the price, any discount code used, how you paid, and the
order’s status.
Payments: card payments are taken on Stripe’s secure payment page and paid straight into the shop’s own
Stripe account. Your card details go to Stripe and never reach Bizzlet or the shop. Stripe tells us whether the
payment succeeded and may confirm the email address you used.
Receipts and downloads: we email you a PDF receipt and, for digital products, download links that expire
after 7 days.
Messages to a shop: if you use a shop’s contact form, we pass your name, email address and message to the
shop by email so it can reply to you directly. We don’t keep a copy of the message.
Stock alerts: if you try to buy something that has just sold out, the shop is told that someone tried, and your
email address is attached so it can let you know when the item is back. The email address is removed from that
record after 90 days.
Address lookup: to help fill in your town at checkout, the post code you type (and only the post code and
country) is sent to the Zippopotam.us look-up service.
Your basket: what’s in your basket is saved in your own browser (see section 10), not on our servers, until you
check out.
Customer records: a shop may also add you to its own customer list or send you an invoice from Bizzlet. That’s
the shop’s decision and is covered by the shop’s privacy policy.
5. How we use information, and our legal reasons
Data protection law only lets us use personal information when we have a lawful basis for it. These are ours:
What we do Lawful basis
Create and run your account, host your shop, and
provide the features you use (selling, stock, orders,
invoices, reports, payouts)Contract: it’s needed to provide the service you
signed up forTake subscription payments and manage your plan ContractProcess shoppers’ orders, payments, receipts and
downloads for shopsAs the shop’s processor, on the shop’s
instructions (the shop relies on contract with its
shopper)Answer support requests Contract, and our legitimate interest in helping
our usersSend service emails (receipts, download links, account
and billing notices, messages to shops)Contract, or the shop’s instructions
What we do Lawful basis
Keep the platform secure: rate-limit and block abusive
traffic, prevent fraud and payment misuse, investigate
problemsLegitimate interests: protecting our users,
shoppers and the serviceKeep financial and tax records Legal obligation (for example HMRC record-
keeping rules)Improve the app and fix faults, using error reports and
usage informationLegitimate interests: running and improving a
reliable serviceRespond to legal requests and enforce our terms Legal obligation, and legitimate interestsSend news or offers about Bizzlet (only if you choose to
receive them)Consent, or for existing customers our legitimate
interest under PECR’s “soft opt-in”; you can opt
out at any time
Where we rely on legitimate interests, we’ve weighed them against your rights and interests. You can object to
that use at any time (see section 12).
6. Emails we send
Most email from Bizzlet is a service email you need in order to use the service: sign-up confirmation, receipts,
download links, messages from shoppers to shops, support replies, and important account or billing notices.
These aren’t marketing, so you can’t opt out of them while you have an account or an order in progress.We’ll only send you marketing email if you’ve agreed to it, or as an existing customer about similar Bizzlet services.
Every marketing email has an unsubscribe link. We never send marketing to a shop’s customers. Their details
belong to the shop.
7. Who we share information with
We don’t sell personal information, and we don’t share it for advertising. We share it only as follows:
With the shop you buy from: your order, delivery details and messages go to that shop so it can fulfil your
order and reply to you.
With our service providers, who handle it only on our instructions under written contracts that require them to
keep it secure:
Provider What they do for us Where data is held
Supabase Database, sign-in and file storage (product photos,
downloadable files)United Kingdom
(London region)
Provider What they do for us Where data is held
Cloudflare Hosting the app and protecting it from attacks Global network,
including outside
the UKStripe Card payments for shops, subscription billing and payouts to
shops. Stripe is also an independent controller for its own legal
checks (for example identity verification and fraud prevention)UK, EU and United
StatesMailtrap
(Railsware)Sending our service emails European Union
and United StatesZippopotam.us Post code to town look-up at checkout (receives the post code
and country only)Outside the UK
With authorities or others when the law requires it, for example in response to a court order, or to prevent
fraud or protect someone’s safety.
If our business changes hands: if Bizzlet is sold or merges with another business, information may pass to the
new owner, who must keep protecting it in line with this policy.
8. International transfers
Our main database is in the UK. Some providers above handle information outside the UK, including in the United
States. When that happens we make sure it stays protected by one of the safeguards UK law allows: a UK
“adequacy” decision for that country, the UK–US Data Bridge where the recipient is certified, or the UK
International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for
details of the safeguard used for a particular provider.
9. How long we keep information
We keep personal information only as long as we need it:
Information How long
Your account, shop and business records
(products, orders, customers, invoices,
stock history, support tickets)While your account is open. When you delete your account,
they’re deleted from our live systems straight away, and roll
out of our backups within [number] days.Subscription payment and billing records 6 years after the end of the financial year they relate to, to
meet tax lawA shopper’s order details As long as the shop keeps its Bizzlet account, or until the
shop deletes them. Shops are responsible for how long they
keep their own sales records.
Information How long
Shopper email addresses on stock alerts 90 days, then removedMessages sent through a shop’s contact
formNot kept by us. They’re passed to the shop by email.Email delivery records (no message content) 180 daysDownload links for digital products Stop working after 7 daysSecurity records (a one-way scrambled
version of your IP address used to limit
repeated requests)24 hoursHosting and security logs held by our
providersFor the short periods their own policies set
10. Cookies and browser storage
Bizzlet does not use advertising cookies or analytics and tracking tools, and doesn’t load fonts or scripts from ad
networks. Our fonts are hosted on our own servers. We only store what the app needs to work on your device,
which the law treats as “strictly necessary”, so it doesn’t need a consent banner:
What Why How long
Sign-in session (shop
owners)Keeps you signed in to your account Until you sign out, or the session
expiresBasket (shoppers) Remembers what you’ve added to a shop’s
basketUntil you check out or empty itOffline sales queue
(shop owners)Saves sales you ring up without signal, then
sends them when you’re back onlineUntil they’ve been sentSet-up draft (shop
owners)Keeps your shop set-up progress if the
page reloadsUntil you close the tabOffline copies of app
pagesLets the installed app open with a poor
connectionReplaced as you use the app;
cleared with your browser’s site
data
When you pay by card you’re on Stripe’s own payment page, and Stripe may set its own cookies to secure the
payment and prevent fraud. Those are covered by Stripe’s privacy policy. You can clear everything above at any
time in your browser’s settings. Doing so signs you out and empties your basket.
11. How we protect information
We use appropriate technical and organisational measures to protect personal information, including:encryption of all traffic between your device and Bizzlet (HTTPS);database rules so that each shop owner can only ever reach their own shop’s records;private file storage, with photos and downloads served only through short-lived links;card payments handled entirely by Stripe, so card numbers never touch our systems;limits on repeated requests to stop automated abuse;access to systems limited to the people who need it.No system is perfectly secure. If a breach puts your rights at risk, we’ll tell you and the ICO as the law requires.
Shop owners can help by using a strong, unique password and keeping their sign-in to themselves.
12. Your rights
Under UK data protection law you have the right to:
access your personal information and get a copy of it;
correct information that’s wrong or incomplete;
erase your information, in some circumstances;
restrict how we use it, in some circumstances;
data portability: receive the information you gave us in a machine-readable format;
object to our use of it where we rely on legitimate interests, and to any direct marketing at any time;
withdraw consent at any time, where we rely on it.
Shop owners can do much of this themselves: edit your details in Settings, and under Settings → Subscription →
Your data, download a copy of everything we hold for your shop or permanently delete your account.
Shoppers: the shop you bought from is responsible for your order details, so contact the shop first (its details are
on its contact page). You can also contact us at support@bizzlet.com and we’ll pass your request to the shop and
help it respond.There’s usually no charge, and we’ll reply within one month. We may need to confirm your identity before acting on
a request.
13. Complaints
If you’re unhappy with how we’ve handled your information, please contact us first at support@bizzlet.com so we
can try to put it right. You also have the right to complain to the Information Commissioner’s Office at
ico.org.uk/make-a-complaint or on 0303 123 1113.
14. Children
You must be 18 or over to open a Bizzlet shop account. Bizzlet shops aren’t aimed at children, and we don’t
knowingly collect information from children under 13. If you think a child has given us their information, contact us
and we’ll delete it.
15. Automated decisions
We don’t make decisions about you based solely on automated processing that have legal or similarly significant
effects. The only automatic checks are routine ones: a checkout is refused if an item has sold out, and too many
requests in a short time are briefly paused to stop abuse.
16. Changes to this policy
We’ll update this policy when the app or the law changes. The date at the top shows when it last changed. If we
make a significant change, we’ll tell shop owners by email or in the app before it takes effect.
17. Contact us
Questions about this policy, or requests about your information:Email: support@bizzlet.com
Post: [Company legal name] , [Registered office address]