Privacy Policy

This policy explains how Bisux Limited ("we", "us", "our") uses personal data when you visit our website, ask for a free menu preview, create an account, pay for Bisux or contact us. We are the controller for these activities.

Restaurants that use Bisux run their own websites on our platform. When a guest books a table on a restaurant's website, the restaurant decides how that data is used and we process it on the restaurant's behalf. The restaurant's own privacy information covers that. Section 9 explains the parts we control on restaurant websites.

1. Who we are

Bisux Limited is an Irish private company limited by shares, registered in Ireland under company number 816985, with its registered office at 51 Bracken Road, Dublin, D18 CV48, Ireland.

For privacy questions or to use your rights, email privacy@bisux.net. For anything else, email hello@bisux.net. Our privacy contact handles privacy questions and requests.

2. Visiting our website

What we collect

When you visit bisux.com, your browser sends us technical information such as your IP address, browser type, the page you asked for and the page you came from. We use this to deliver the page and to protect the service. Legal basis: our legitimate interest in running a secure website.

Visit statistics

We count visits to our pages and campaign links (for example, utm_campaign). To count unique visitors, we create a code from your IP address and browser type that changes every day and every month. We do not store your IP address or browser type in these statistics, and we set no statistics cookie. Where our trusted infrastructure supplies it, we also receive an approximate country code. These codes can still be personal data. We keep individual visit records for 30 days. After that we keep only totals that do not identify anyone.

Legal basis: our legitimate interest in understanding how our website is used and which campaigns work. You can object at any time by emailing us.

Anonymous totals on our preview pages

On our restaurant preview pages we keep plain daily totals of how often each step is reached: page views, searches, restaurants chosen, requests sent, previews opened, websites claimed, payment pages opened and payments. Each total is stored per page, day and step, and per campaign and ad version (the utm_campaign and utm_content values in the link) only when they are on our own list of campaigns and ads. Requests, claims and payments are counted once each. The stored total rows contain no cookie, visitor or lead identifier, IP address or browser information. Ordinary request and customer records may be used to produce business-event totals; those records remain personal data under the rules below. We do not combine these totals with other information to identify anyone. We keep them indefinitely to understand what our advertising costs and achieves. We count them for every visitor, whatever your cookie choice.

Security checks

To stop spam and abuse, some forms (such as the preview request, sign-up, sign-in and contact forms) use Cloudflare Turnstile, which checks your browser before you submit. Cloudflare also runs our domain name system (DNS) and receives emails sent to bisux.com addresses. Legal basis: our legitimate interest in keeping the service secure.

Maps and address search

Our pages load their fonts and code from our own servers. If you use a map or address search in the free preview, during sign-up or in your dashboard, your browser loads map images from OpenStreetMap and sends the address you type to OpenStreetMap's search service (Nominatim) or, during sign-up, to Photon (komoot). They receive your IP address and browser information. We do not use your IP address to find your precise location; the approximate country code described above is the only location information derived from it.

Cookies

Our Cookie Policy lists the cookies we use and how to change your choices.

3. Free menu preview

What we collect

When you ask for a free preview, we collect:

• your email address, and your name if you give it;
• the business name, town or the Google listing you choose;
• a website address, files, photos or PDFs you upload, and the changes you make;
• your choice about marketing emails, with the wording you saw and the date;
• the version of this Privacy Policy and the language shown when you sent the request;
• if you had already made a cookie choice, the random reference of that choice (see section 13), so we can tell which choice applied to your request.

What we look up for you

To build the preview, we look up your restaurant in public sources:

• Google Places: we search Google's business listings and show the listing you choose, and may suggest one of its photos for your website. We keep only Google's place reference and the details you confirm.
• Your restaurant's website: we visit the public website you give us or that we find, to read the menu, contact details and opening hours.
• Google Maps photos: we may retrieve public photos of your menu or restaurant from Google Maps listings.
• Google Gemini: an AI model reads menus and pages and turns them into a structured draft menu. It also helps find your official website.

Public material can include personal data about other people, such as a staff member's name or a photographer's name on a photo. We use it only to prepare the preview you asked for and keep it only with that preview. Legal basis: our legitimate interest and that of the requesting business in preparing a requested preview from public business information. If you are named or shown in such material, you can object and we will remove it.

Why we use it

We use your details to prepare the preview, send you the link, ask for missing information and tell you when the preview is ready or about to expire. Legal basis: steps you asked us to take before a contract if you are the prospective contracting individual; otherwise our legitimate interest in serving the business you represent.

Emails about your preview

We send only emails about the preview you asked for, from hello@notify.bisux.com through Amazon SES:

• a confirmation shortly after your request;
• a request to choose your official website, if we found more than one;
• up to four reminders in the first six days if your menu or required details are missing;
• a message when your preview is ready, and one follow-up two days later if you have not opened it;
• reminders two days and one day before your preview expires;
• a link to reopen your preview, if you ask for one.

Every email has a link to stop these reminders, and your email app may also show an unsubscribe button that does the same in one click. Stopping reminders does not delete your preview.

We send marketing emails only if you ticked the separate marketing box. You can withdraw that permission at any time from any email or by contacting us. Withdrawing does not delete your preview.

Preview journey statistics

Only if you accept advertising cookies, we record which steps of the preview journey your browser reaches: opening the page, searching, choosing a restaurant, sending a request, opening your review and claiming your website. We link these steps through the private preview cookie (see our Cookie Policy) and, once you send a request, to that request. We also record the campaign that brought you, if it is on our list, and whether you arrived by clicking an ad, but not the click identifier itself. We use this to measure our ads, for example the cost of each request and each new customer per campaign. If you do not accept, we create no browser-linked journey record; if you withdraw, we stop that recording. Anonymous totals and the ordinary service records described below are separate. Legal basis: your consent.

Whatever your cookie choice, after you send a request we record the cost of the services we used to prepare your preview, and our records show whether the request led to a website being claimed and a subscription being paid for. We use this, without cookies, to understand what the preview service costs and achieves. Legal basis: our legitimate interest in managing the costs and results of our service.

We keep the campaign name and ad version with your request only if you agreed to marketing emails or to advertising cookies, and only when they are on our list of campaigns and ads.

4. Your account and website

What we collect

• Account: name, email, username, password (stored only as a secure hash) or your Google sign-in identifier, language, email confirmation status and sign-in history.
• Your website: the business details, menus, photos, opening hours and other content you publish. This content is public by design.
• Google Business Profile: if you connect it, an encrypted access token and the business information needed for the features you turn on.
• Legal acceptance: which version of our terms you accepted, when, and the IP address and browser type used to accept them.
• Menu confirmation: when you claim a website from a preview, your confirmation that you checked the menu, prices and allergen information, with the time and the version of our terms.

Legal basis: the contract with your business, or our legitimate interest in managing the business relationship when you act for a company.

Account and service emails

We send emails needed to run your account: confirming your email, password resets, security warnings, the start and end of your free period, billing notices, a warning if your website goes offline, and important changes to our terms. These are not marketing.

Security

We keep a log of sign-ins and security events, including the IP address, browser type, time and whether the attempt succeeded. We use it to detect suspicious sign-ins and to email you a warning that shows the IP address and device. We do not send your IP address to any location service. Legal basis: our legitimate interest in protecting accounts.

Maps in your dashboard

Maps and address search in your dashboard and during sign-up work as described in section 2.

5. Billing

Payments are handled by Stripe. We store your plan, subscription status, invoices, billing contact, business name and address, VAT number, and Stripe's customer and subscription references. We never see or store your full card number.

Legal basis: the contract, and our legal obligation to keep tax and accounting records.

Stripe also uses payment data for its own purposes, such as fraud prevention and meeting financial regulations. For that, Stripe is a separate controller under its own privacy policy.

6. Marketing emails

We send marketing emails only with your permission, given through a separate, unticked box. We record the wording you saw, the date and the language. You can withdraw at any time using the link in any marketing email or by emailing us. Accepting our terms, asking for a preview or accepting cookies never counts as permission for marketing emails.

If an email to you bounces permanently or you mark it as spam, we keep a coded version of your email address (a one-way digest, not the address itself) so that we do not email you again. Legal basis: our legitimate interest in respecting your wishes and in reliable email delivery.

7. Optional advertising measurement (Meta)

We advertise on Facebook and Instagram. To measure which ads work and to show them to people more likely to become customers, we use the Meta Pixel and Meta's Conversions API, but only on a few pages and only after you accept advertising cookies. These pages are our restaurant landing pages (including the review page you see after sending a request), our waitlist page, and one view of your dashboard after you claim your website or pay. We never use them on restaurant websites, checkout or payment pages, or pages whose web address contains a private access link.

We tell Meta when you view one of these pages and when you:

• send a preview request or join our waitlist (Lead);
• claim your website (CompleteRegistration);
• start a paid subscription (Subscribe).

If you had not made a cookie choice when you sent a preview request and you accept advertising cookies on the page that follows, we can report the Lead for that request then. We use an event reference to avoid counting the same action twice. Events are eligible only within 24 hours of the action; network retries may use the same reference.

What Meta receives.

• From your browser (Meta Pixel): your IP address, browser information, the page address, the previous page and Meta's cookies. We have also switched on these options in Meta's settings: automatic advanced matching, which lets the pixel find contact details you type into forms on these pages, such as your email address, and send them to Meta in hashed form; collection of page information such as page titles. Meta may also do part of its measurement on your device when that option is enabled.
• From our server (Conversions API): the event name, an event reference, the time, a fixed page address, your IP address, your browser type and Meta's cookie values if present. For preview requests, waitlist sign-ups and claims, we also send a hashed (SHA-256) version of the email address you gave us and of our internal reference for you, so that Meta can match the event to a Meta account and link the events of the same person. Hashing turns the value into a code but does not make it anonymous. Meta can match or link these codes to people and other data.
• Our server does not send your name, phone number, menu, reservations or payment amounts.

Who is responsible. Bisux Limited and Meta Platforms Ireland Limited are joint controllers for collecting this data on our pages and sending it to Meta, under Meta's Controller Addendum and Business Tools joint-processing terms. We are responsible for asking for your consent and giving you this information. Meta is responsible for its own processing after it receives the data: it uses it to give us reports on our ads and, as a separate controller, for its own purposes, such as matching events to Meta accounts, delivering and improving ads and its other products, under Meta's Privacy Policy. You can use your rights with either of us; for Meta's own processing, contact Meta. Meta may transfer data to the United States and other countries under its own safeguards.

Legal basis: your consent. You can withdraw it at any time in Cookie settings. Withdrawing stops future measurement and deletes Meta's cookies from your browser where we can. It cannot recall data already sent; to ask Meta about that, use Meta's privacy tools.

8. Contact and support

When you email us or use a contact or waitlist form, we use your name, contact details and message to answer you. Our mailboxes are provided by Zoho. Legal basis: steps you asked us to take, the contract, or our legitimate interest in answering business enquiries.

Support chat in your dashboard

When support chat is available in your dashboard, it identifies your signed-in account when it loads, before you send a message. It receives your account identifier, name, email, restaurant website names, language and dashboard context. It also processes your messages and technical connection information. A secure verification code links the chat to your account; authorised support staff can read and answer your messages.

We host the Chatwoot software ourselves. A person on our team answers, rather than AI. Our hosting and email providers still process the relevant data. If you close the chat before we reply, we may email our reply to your account address. Legal basis: our contract if you are the customer, or our legitimate interest in supporting the business account you represent. We keep conversations for 24 months after resolution. Account-removal handling includes a separate chat-erasure step, subject to lawful retention. The chat uses browser storage described in our Cookie Policy.

9. Restaurant websites built with Bisux

A restaurant is responsible for its website and for the guest data it collects, such as reservations and requests. For that data, we are the restaurant's processor. Guests should contact the restaurant first. We help restaurants answer requests.

We are the controller for:

• visit statistics on restaurant websites, measured as described in section 2. Restaurants see only totals, not visitor codes;
• security and abuse prevention for the platform.

10. AI

We use AI to read menus and web pages, prepare draft menus and short texts, and translate content.

• Menu reading and website search use Google Gemini. Google's paid-service terms exclude use of submitted content to improve its products; search grounding has a separate 30-day retention rule for prompts, context and results for debugging and testing.
• Short texts, such as a website description or a banner line, are written by a model accessed through OpenRouter. For these texts we send business details: the business name, type, area, language and the description you entered. The route we use may let the model provider keep these inputs and use them to improve its models, and business names or free text can identify people. Do not enter guest data or personal or sensitive material into these text-generation fields.
• Translations use a model running on our own servers.

AI results can be wrong, so restaurants must check them. We do not use AI, or any other automated means, to make decisions about you that have legal or similarly significant effects. Please do not upload health details, card numbers or other sensitive documents.

11. Who receives your data

• Our staff, only where they need it.
• FyfeWeb Ltd, which hosts our servers in the United Kingdom.
• Cloudflare, for DNS, the Turnstile security check and receiving emails sent to bisux.com addresses.
• Amazon Web Services (Amazon SES), for sending email.
• Zoho, for our bisux.net mailboxes.
• Stripe, for payments.
• Google, for sign-in, Google Business Profile, Places and Gemini.
• OpenRouter and the model provider it routes to, for short texts.
• OpenStreetMap, for maps and address search, and Photon (komoot), for address search during sign-up.
• Meta, only with your advertising consent (section 7).
• Professional advisers, authorities when the law requires it, and a buyer if our business is sold, with appropriate safeguards.

Our list of service providers explains the services and their roles. You can ask us about the safeguards for a particular transfer.

12. International transfers

Our servers are in the United Kingdom, which the European Commission recognises as giving adequate protection to personal data. Some providers are based in, or give access to data from, countries outside the European Economic Area, mainly the United States. When they do, we rely on an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses, with extra safeguards where needed. You can ask us for a copy of the relevant safeguards.

13. How long we keep data

• Private preview: 7 days after your request if you do not open it. Once you open it, until the end of the viewing period shown on the page. Then we delete it.
• Preview request record: if there is no remaining draft and no link to a customer website, a request without marketing permission is eligible for deletion once it is 60 days old. With marketing permission, after 60 days we reduce it to contact, permission, source and limited request metadata. We delete that record when its creation, last activity and permission decision are all more than 24 months old. Activity includes draft updates and visits. Withdrawal brings it under the ordinary 60-day rule, subject to the draft and customer-link exceptions. Customer-linked requests stay while linked; after website or account removal, we apply these rules using the original dates, rather than starting a new 60-day period.
• Preview journey statistics and preparation costs: deleted 60 days after they are recorded, even if you gave marketing permission.
• Anonymous totals on our preview pages: kept indefinitely; they are not personal data.
• Account and website: while your account exists. When you delete your account or website, or your website goes offline because a free period or subscription ended, we remove it after a waiting period and email you the date. Today the waiting period is 30 days after you delete your account, 14 days after you delete a website, and 90 days after a website goes offline.
• Billing and tax records: 6 years after the end of the relevant financial year, as Irish law requires.
• Payment notifications from Stripe: raw copies of completed payment messages are cleared 90 days after processing. A minimal event record remains to prevent duplicate processing. These are only copies of messages: the billing records we need to keep charging you and for our accounts (your subscription, payments and invoices) are kept separately while you are a customer and then for 6 years, as tax law requires. Stripe keeps its own records under its own privacy policy.
• Visit statistics: individual records for 30 days; totals that do not identify anyone for longer.
• Cookie choices: your choice is stored in your browser for 180 days. Our record of the choice holds the random reference, the choice, the date, the page, the language, and the versions of the notice and of our Cookie and Privacy Policies you saw, but not your name, email or IP address. If you send a preview request, the request record keeps that reference (section 3). The record is kept for about 3.5 years so we can prove consent if asked.
• Records that Meta events were sent: 7 days.
• Email suppression digest: kept for as long as needed so that we do not email you again.
• Sign-in/security records in our database: 365 days. Error records in our database: 90 days. Infrastructure and provider logs have separate operational schedules.
• Records of terms acceptance and menu confirmation, including the IP address and browser type used: while the contract lasts and for 6 years after, to handle legal claims.
• Support chat conversations: 24 months after the conversation is resolved, or until we remove your account if that is sooner.
• Emails and other messages: for as long as we need them to deal with your enquiry and our relationship with you; messages about a contract are kept with the contract records.
• Backups: deleted data must remain protected and excluded from ordinary use in any remaining backup copies. If a backup is restored, deletion instructions must be reapplied.

We may keep data longer when the law requires it or to handle a legal claim, only for that purpose.

14. Your rights

You can ask us to:

• give you a copy of your data and information about how we use it;
• correct it;
• delete it;
• restrict how we use it;
• give your data to you or another provider in a machine-readable format, where the law gives this right;
• stop using it based on our legitimate interests. You can always stop direct marketing.

If you gave consent, you can withdraw it at any time. This does not affect what we did before.

Email privacy@bisux.net. We answer without undue delay and within one month. If a request is complex, we may extend this by up to two months and will tell you why within the first month. We may ask for information to confirm your identity. When we correct, delete or restrict data, we also tell everyone we disclosed it to, unless this is impossible or needs disproportionate effort. You can ask who they are.

You can download a copy of your account data at any time in your dashboard, under Settings › Download your data. For anything it does not include, such as uploaded files, preview requests or support conversations, email us and we send you a complete copy.

You can complain to the Irish Data Protection Commission or to the authority where you live or work, such as the Agencia Española de Protección de Datos (AEPD) in Spain.

15. Security

We protect data with measures suited to the risk, including protection for data in transit, access controls, protected sign-in tokens and checks against abuse. No system is completely secure.

16. Information you must give us

To create an account or pay, we need your name, email and billing details. Without them we cannot provide the service. Marketing and advertising choices are optional.

17. Changes

We update this policy when our processing changes and show the date below. If a change needs your consent, we will ask for it.

Last updated: 10 November 2026

---

Company details

Bisux is operated by Bisux Limited, an Irish private company limited by shares.

Legal name

BISUX LIMITED

Registered office

51 Bracken Road
Dublin
D18 CV48
Ireland

Registered in

Ireland (Companies Registration Office)

Company registration number

816985

Contact

hello@bisux.net

Privacy contact

privacy@bisux.net

For privacy matters, Bisux Limited is the controller for Bisux account, billing, support, security, marketing and website data. For reservations and other guest processing that a restaurant directs through its website, the restaurant is normally the controller and Bisux Limited its processor. Other activities have the roles described in this policy.