Privacy policy (GDPR)
Last updated: 28 October 2026
1. Controller
André Miguel Caetano Dias, sole trader (empresário em nome individual), Portuguese tax no. (NIF) 243367805, based in Portugal, email suporte@bizu.live. Contact for privacy and data-subject rights: suporte@bizu.live. This is a contact channel, not the formal appointment of a data protection officer.
Bizu network brands. The same controller processes the data of every Bizu network brand: Bizu (app.bizu.live), Meetlyn («Lyn», meetlyn.live), Privspark («Spark», privspark.live), Shoala (shoala.live), FlightAttendants («Flight Attendants Live», flightattendants.live), Motek (motek.live), ChatBizu (chatbizu.com), Chat4Mobile (chat4mobile.com) and Conocer (conocer.live). There is a single account for the whole network: account, coin, payment, call and report data are the same on every brand, and this Policy applies to all of them. To run and measure each brand, on the basis of legitimate interest (GDPR art. 6(1)(f)), we record the brand where the account was created, the brands you log in on and the brand of each purchase and call. Visits to each brand’s pages are counted in aggregate, without cookies and without storing IP addresses. Hosts’ public profiles (stage name, approved photos, bio, languages, price and online status) may be shown on several brands; each host can stop appearing on a brand from her dashboard, with immediate effect.
2. Data we process
- Account: email, username, password (stored only as a hash), date of birth (Bizu is for adults 18+ only), country, language and settings; if you sign in with Google, the name and verified email Google sends us.
- Profile: photos and videos you publish, bio, interests and languages.
- Payments (clients): orders, purchase and coin history, refunds. Card and Pix data are handled by Stripe; Bizu never receives them.
- Hosts — identity and age verification: a photo of the ID document (front and, where there is one, back), a short video selfie holding the document, your legal name, date of birth and document country. The files are stored encrypted and reviewed manually by our team. An automatic face comparison between the document and the selfie may be used as an aid only: the decision is always made by a person.
- Hosts — earnings: tax details and payout details (e.g. IBAN, Wise, Paxum, USDC address or Pix key), stored encrypted; the app only shows a masked version.
- Usage: calls (start, end, duration and amount), direct messages between users, gifts, ratings, reports and blocks.
- Security and fraud prevention: IP address, approximate country (derived from the IP), device and browser type, sign-in and security logs.
- Notifications: if you turn on notifications, the push subscription of your browser or device.
- Support requests: email, topic, message and reference.
- Report/panic images: when you use a safety tool (Panic/Report), images of the call are captured automatically — both participants' video at that moment and in the few seconds before — as evidence, accessible only to the moderation team and deleted after 90 days.
Call video and audio are not recorded by Bizu: they pass through a relay server (TURN) only to reach the other side. In-call chat messages are only relayed to the other side, not stored.
3. Purposes and legal bases (GDPR art. 6)
- Providing the service and managing the account — contract.
- Host age and identity verification, content moderation and preventing abuse, fraud and illegal content — legal obligation and legitimate interest; for the face comparison, your explicit consent, given when you start the verification.
- Payments to clients and hosts, billing and accounting — contract and legal obligation.
- Marketing — only with consent, withdrawable at any time.
- Host photos in posts on Bizu's Instagram and Facebook — only the photos the host chooses, with her host name, and only with her consent given in the app (off by default). She can withdraw it at any time in the app: we stop using the photos and delete the posts with them.
4. Recipients
Hosting and infrastructure (Render, USA/Oregon), database and files (Neon, USA), payments (Stripe, EU/Ireland), call video relay (TURN: Cloudflare and Metered), email forwarding (Forward Email), app emails — sign-in codes and support-request confirmations (Resend), automatic translation of messages and captions (MyMemory/Translated, Italy — text is sent with emails, phone numbers and links removed), Google sign-in (Google, only if you choose it) and authorities where required by law. Host identity verification is done by our team, with no external verification provider. We do not sell personal data or use it for advertising (except photos a host authorises for Bizu's social media, section 3). Transfers outside the EEA only with appropriate safeguards (adequacy decision or standard contractual clauses).
5. Retention
- Account data: while the account is active and up to 12 months after closure, unless there is a specific need (e.g. a dispute).
- Direct messages: up to 30 days, unless linked to a report, dispute or legal obligation.
- Host verification documents and selfies: kept encrypted for as long as needed to meet legal obligations (proof of identity and age verification, fraud prevention): up to 5 years after approval, or up to 90 days if verification is refused; deleted afterwards.
- Verification result (approved/refused, date): up to 24 months after the relationship ends.
- Technical and security logs: up to 12 months, unless there is a specific incident.
- Reports, evidence and support requests: up to 24 months after the case is closed.
- Invoices and payment records: for the statutory tax and accounting period (in Portugal, usually 10 years).
Where we must keep data for longer, we limit access to that purpose.
6. Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent — requests to suporte@bizu.live. You can delete your account directly in the app or ask for deletion by email: see Delete your account. We reply within the legal deadline (in the EU, usually one month). You may complain to the supervisory authority (in Portugal, CNPD — www.cnpd.pt). If you are in Brazil, you also have the LGPD rights (incl. confirmation of processing and information on sharing) and may complain to the ANPD (www.gov.br/anpd).
7. Security
Encrypted connections (HTTPS/DTLS-SRTP), hashed passwords, optional 2FA, verification documents and payout details encrypted (AES-256-GCM) with restricted access, security headers and file validation. In case of a data breach we notify the authority and the people affected where the law requires it.
8. Age
Bizu is exclusively for adults aged 18 or over. We ask for the date of birth at sign-up and do not admit minors. If you know of an account belonging to a minor, report it in the app or write to suporte@bizu.live.
9. Cookies and local storage
Bizu sets no cookies of its own; it uses technical local storage (session, language, theme). Advertising cookies only from Google Ads, to measure purchases that come from ads, and only with consent in the EU/EEA, the UK and Switzerland. Details in the Cookie policy.
10. Changes
If we change this policy we update the date at the top of this page and, for important changes, let you know in the app.