Privacy Policy

1. Introduction

This Privacy Policy explains how TruzBiz ("we", "us", "our") collects, uses, discloses, and protects personal data when you visit or use the TruzBiz website, business directory, and related services (collectively, the "Service").

TruzBiz operates a business identity, directory, and verification platform. We enable businesses to establish a public identity, claim and verify their listings, and allow visitors to discover and verify business information.

TruzBiz verification is an evidence-based administrative review. It does not constitute a guarantee of business reputation, financial standing, commercial performance, product or service quality, solvency, or current trading activity. Verification is not an endorsement.

2. Who We Are

The Service is operated by Mergershare Ltd (registered in England and Wales, company no. 14343247), whose registered office is Office 4544, 182–184 High Street North, East Ham, London, United Kingdom, E6 2JA. In this policy, "TruzBiz", "we", "us" and "our" refer to that company.

For privacy inquiries, contact us at: truzbizco@gmail.com

3. Information We Collect

We collect only the information necessary to operate the Service and fulfill our obligations. Categories include:

A. Account Information

• Email address (unique identifier)
• Password (stored only as a bcrypt hash, never in plaintext)
• Name
• Phone number (optional)
• Account role (business user or administrator) and status
• Email verification status
• Last login timestamp

B. Business Information

• Legal business name
• Trading name (optional)
• Registration number (optional)
• Registration jurisdiction
• Country
• Date of establishment (optional)
• Company type (optional)
• Source status and labels (from public/authoritative sources)
• Verification level and verification ID

C. Business Profile Information

• Business description
• Logo (stored as uploaded file)
• Website URL (optional)
• Public contact email (optional)
• Public telephone number (optional)
• Business category

D. Business Location Information

• Country
• City
• Address (optional)

E. Products and Services

• Product names and short descriptions
• Service names and short descriptions

F. Claim Information

• Business ID being claimed
• User ID of claimant
• Claim status, submission timestamp, decision timestamp, decision reason
• Reviewer ID (if decided)

G. Verification Information

• Business ID and contact verification status
• Verification status, submission timestamp, verification timestamp
• Due date, expiry date, reviewer ID
• Review notes (administrative), business-facing reason
• Verification level, verification ID, verification basis, source registry
• Verification history (status changes with timestamps, actors, reasons)

H. Verification Documents

• Uploaded files (PDF, JPEG, PNG, WebP, DOCX) with original filenames
• Document type, status, upload timestamp, uploader ID
• Reviewer ID and review timestamp (if reviewed)
• Files are stored in private, access-controlled storage (local or S3-compatible)

I. Technical and Security Information

• IP address (used for rate limiting and fraud prevention; collected via trusted proxy headers when configured)
• Session tokens (stored in HttpOnly, SameSite=Lax cookies; 14-day expiry)
• Audit log entries: actor user ID, action, entity type, entity ID, timestamp, result, metadata
• Rate limiting keys derived from IP address

J. Communications

• Email address and message content when you contact us via the contact form or email

K. Payment Information

Online card payments are not currently enabled. TruzBiz does not collect or store card numbers today. When online payments are enabled, card details will be collected and processed by a third-party payment processor engaged for that purpose; TruzBiz will store only the payment record (a payment reference, amount, currency, status, and the related consent and audit entries) and not full card numbers. The processor will be named in this policy before any payment is taken.

• Payment reference and status (for example, pending, paid, refunded)
• Amount, currency, and what the payment was for (application fee or activation fee)
• Whether the payer was a business or a consumer, and any express request to start the service
• Records of the consent given before payment, and of any refund or dispute (kept for accounting and audit)

4. Information From Public and Authoritative Sources

TruzBiz may obtain business information from legitimate public, governmental, regulatory, or other authorised data sources (e.g., government business registries, commercial data providers, industry regulators, professional bodies). This data is imported into our system to enrich the directory and support verification workflows.

We distinguish between the following states in our directory:

• Directory Listing — A business profile published in the directory, which may originate from an imported public record or a user submission.
• Active/Current Status — The status reported by the source at the time of retrieval (e.g., active, dissolved, struck off). This reflects the source's record, not necessarily current trading activity.
• Claimed Business — A listing where a user has asserted a relationship and submitted a claim, which is pending or approved.
• TruBiz Verified Business — A business that has completed TruzBiz's evidence-based verification process and holds a current "Verified" status.

Information obtained from an external source does not automatically mean that the business is verified by TruzBiz. Source data is used to enrich the directory and support verification workflows, but it is not a substitute for TruzBiz verification. We do not imply that a government registry confirms current trading activity unless the source itself provides such status at the time of retrieval.

5. How We Use Information

We process personal data for the following legitimate operational purposes:

• Creating and managing user accounts
• Operating the business directory and search functionality
• Maintaining public business profiles
• Processing business claims and evaluating claim evidence
• Conducting verification reviews and maintaining verification status
• Sending OTP-based verification emails for registration, claims, re-verification, and contact changes
• Preventing fraud, abuse, and unauthorized access (rate limiting, audit logging)
• Maintaining platform security and integrity
• Responding to inquiries and support requests
• Complying with applicable legal obligations
• Processing verification and application fees, where paid features are enabled, including any refunds due
• Enforcing our Terms of Service

We do not use personal data for marketing, advertising, or profiling purposes.

6. Legal Basis / Permitted Processing

The applicable legal basis for processing depends on the specific activity and the applicable law. Where relevant, processing may be based on:

• Performance of a contract or pre-contractual measures (e.g., providing the directory, verification, and account services you request)
• Compliance with legal obligations (e.g., record-keeping, responding to lawful requests)
• Legitimate interests (e.g., fraud prevention, security monitoring, audit logging, service improvement)
• Consent where required (e.g., for optional communications or specific processing activities)
• Other lawful bases available under applicable law

No single legal basis applies to every processing activity. The basis is determined by the specific purpose and context. This policy does not claim universal GDPR compliance; privacy rights and obligations vary by jurisdiction.

7. Business Profiles and Public Information

Certain business information is displayed publicly as part of the TruzBiz directory and public business profiles. This is core to the Service's purpose as a business discovery platform.

Public information may include:

• Legal name, trading name, registration number, registration jurisdiction, country
• Business description, website, public contact email, public telephone
• Category, location (country, city, address)
• Products and services offered
• Verification status indicators (e.g., Verified, Pending, Verification Due)

Sensitive or restricted information (private documents, internal review notes, account credentials, non-public contact details) is not intended for public display.

Public listing does not necessarily mean that the business has been verified by TruzBiz. The platform distinguishes between Directory Listing, Claimed Business, and Verified Business as described in Section 4. Verification status is displayed clearly on public profiles so visitors can distinguish between these states.

8. Verification Evidence and Documents

Businesses and claimants may provide evidence and documents for verification (e.g., registration certificates, utility bills, correspondence, identity documents). Supported formats include PDF, JPEG, PNG, WebP, and DOCX, subject to size limits (5 MB for documents, 2 MB for logos).

Access to verification documents is restricted to authorised personnel and systems:

• The submitting business (controlling user) and authorised administrators
• Claimants for documents linked to their own pending claims

Documents are stored in private, access-controlled storage (local filesystem or S3-compatible, depending on configuration). They are not publicly accessible via direct URLs. Access requires authentication and authorisation checks on every request.

Evidence may be retained as necessary for verification, audit, security, legal, and operational purposes, subject to applicable law and retention requirements. We do not specify fixed retention periods in this policy as they vary by data category and legal requirement.

9. How We Share Information

TruzBiz does not sell personal data.

We may disclose information only in the following circumstances, and only to the extent necessary:

• Authorised personnel — TruzBiz administrators and reviewers performing verification, claim review, or platform operations
• Service providers necessary to operate the platform — Cloud hosting (Vercel); a managed PostgreSQL database; transactional email delivery (Resend, SendGrid, or Postmark, as configured for the deployment); file storage (local filesystem or S3-compatible object storage, as configured); and, in production, a Redis instance used for rate limiting
• Payment processing — Where online card payments are enabled, the third-party payment processor engaged for that purpose. Online card payments are not enabled today, and no payment processor is in use at this time; the processor will be named here before any payment is taken
• Legal and regulatory authorities — Where required or permitted by law, regulation, or valid legal process
• Security and fraud-prevention providers — Where integrated for platform protection

The providers above are the categories we actually use, named where the deployment fixes the vendor (for example, cloud hosting) and qualified where the vendor is chosen per deployment (email delivery, file storage) so the policy does not misstate a configuration. Disclosures are limited to what is necessary for the stated purposes and are subject to appropriate contractual and technical safeguards.

10. International Data Transfers

Because TruzBiz is intended to operate internationally, data may be processed or stored in countries other than your country of residence, depending on where our service providers and infrastructure are located (for example, cloud hosting regions, email delivery networks, or storage buckets).

International transfers are handled in accordance with applicable data protection requirements and appropriate safeguards where required (such as standard contractual clauses or adequacy decisions). We do not claim that all transfers are GDPR-compliant unless that has been separately verified for a specific deployment.

11. Data Retention

TruzBiz retains information only for as long as reasonably necessary for:

• The purposes for which it was collected
• Account and service operation
• Verification history and status records
• Audit and security logging
• Dispute resolution and correction handling
• Legal and regulatory obligations

We do not specify fixed retention periods in this policy because they vary by data category, legal requirement, and operational need. Account data is retained while the account is active; verification and audit records are retained for compliance and historical integrity; documents are retained while relevant to the associated verification or claim.

12. Data Security

We implement security measures appropriate to the nature of the data and the risks involved, including:

• Access controls and role-based permissions (business user, administrator)
• Authentication with bcrypt-hashed passwords (cost factor 12) and HttpOnly, SameSite=Lax session cookies
• OTP-based verification for sensitive actions (registration, claims, contact changes, re-verification)
• Audit logging of significant actions
• Secure transmission (HTTPS in production)
• Controlled document access with authorisation checks on every request
• Rate limiting to mitigate abuse and credential stuffing
• File type validation with magic-byte verification for uploads
• Session version tracking for immediate revocation on password reset

No internet-based system can guarantee absolute security. While we take reasonable measures, we cannot eliminate all risk of unauthorized access, disclosure, alteration, or destruction.

13. Your Rights

Depending on your jurisdiction and the applicable law, you may have rights concerning your personal data, including:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion / erasure — request deletion where permitted (subject to legal and operational limitations)
• Restriction / blocking — request restriction of processing in certain circumstances
• Objection — object to processing based on legitimate interests or for direct marketing
• Withdrawal of consent — where processing is based on consent, withdraw it at any time
• Other rights provided by applicable law

Requests may be subject to legal and operational limitations (for example, we may retain data needed for verification integrity, audit compliance, or fraud prevention).

To exercise your rights or ask questions, contact us at: truzbizco@gmail.com

14. Business Data Corrections

If publicly displayed business information on TruzBiz is inaccurate, the business or an authorised representative may request a correction by contacting us at truzbizco@gmail.com.

Corrections may require supporting evidence. Identity-critical changes (legal name, registration number, jurisdiction, country) are subject to controlled review and may trigger re-verification. We do not promise immediate changes; each request is assessed on its merits and in accordance with platform policies.

15. Cookies and Similar Technologies

TruzBiz uses only essential cookies required for the platform to function:

• Session cookie (tr_session) — an HttpOnly, SameSite=Lax, Secure (in production) cookie that maintains your authenticated session for up to 14 days. It contains a signed token identifying your session; it does not store your password or sensitive personal data directly.

We do not currently use non-essential analytics cookies, advertising cookies, third-party tracking pixels (such as Google Analytics, Meta Pixel, or similar), or cookie consent banners. If such technologies are added in the future, this policy will be updated and appropriate consent mechanisms will be implemented where required.

16. Children's Privacy

TruzBiz is a business platform and is not directed toward children. We do not intentionally collect personal data from children. If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will take steps to delete it.

17. Third-Party Websites and Services

TruzBiz may contain links to external websites (for example, business websites listed in profiles). These external sites have their own privacy practices and policies. TruzBiz is not responsible for the privacy practices or content of third-party websites outside its control.

18. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in our practices, the Service, or applicable law. When material revisions are made, the "Last Updated" date at the top of this page will be changed. We encourage you to review this policy periodically.

19. Contact Us

For privacy questions, requests, or concerns:

Email: truzbizco@gmail.com