Last updated: October 24, 2026

Privacy policy

This page describes how Bizleen collects, processes and protects your personal data. We apply the General Data Protection Regulation (GDPR, EU 2016/679) and the amended French Loi Informatique et Libertés. The French version is the legal reference.

1. Data controller

Bizleen is a service operated by Dan Nutu EI, which is the data controller.
SIRET 83515065700012.
137 Rue des Landes, 78400 Chatou, France.
Contact: rgpd@bizleen.com
Institutional site: mindvisionstudio.com

2. Data we collect

2.1 Account data

• Email address: to create your account, identify you, and send you service messages (address confirmation, password reset).
• Password: if you create your account with an email address, it is never kept in plain text. All we keep is an irreversible fingerprint of it, computed with a hashing function known to resist brute-force attacks. Nobody here can read your password back.
• Email verification status (verified or not).
• Account creation date.
• If you sign in with Google: your Google account identifier, your name and your profile picture when Google provides one, instead of a password (full detail in section 10).

2.2 Content you publish (card available at /@your-handle)

• Professional identity: first name, last name, title, company, tagline, monogram, card number.
• Contact details you choose to display: phone, contact email, website, location, links to your social networks.
• Images you upload: profile photo, logo, custom background, photos of your venue, plus a PDF document (menu, brochure) where applicable.
• For a venue page: description, address, opening hours, menu and prices, services, events, frequently asked questions, testimonials.
• Chosen appearance: visual theme and accent colour.
• If you enable other languages: the translations of the matching fields.
• If you link your Google listing: the average rating and the number of reviews (never the text of the reviews), and the coordinates derived from your address to display the location map.

These data are public by design: your card is accessible to anyone who knows the URL. That is the point of the service. Do not enter sensitive data.

2.3 Subscription and payment

• If you take out a paid plan, the payment is handled by Stripe. Your card number is entered on Stripe's side: we never see it and never store it.
• On our side, we keep the plan you subscribed to, the state of the subscription, its renewal date, and the customer and subscription references Stripe sends us, so we can give you access to what you paid for.
• Stripe separately collects, on its own account and for its own legal obligations, the billing information it needs (name, address, country, payment method).

2.4 Messages sent from a public card

When a card offers a contact form, the visitor who uses it sends us their name, email address and message. That message is forwarded by email to the card holder, who can reply to the visitor directly. The holder's email address is never displayed on the card. We do not keep the content of these messages once they have been forwarded.

2.5 Booking and map, loaded from another site

Some cards display a booking module provided by Orbit and a location map provided by OpenStreetMap. Neither of those comes from our servers: the visitor's browser fetches them directly from the provider, and therefore hands it their IP address, exactly as when they visit any other page.

• Booking: the module is only loaded when the visitor opens the booking window. As long as nobody taps the button, nothing is requested from Orbit and no IP address reaches it. What is then entered in that form (identity, contact details, booking details) goes to Orbit and is processed by it for the venue: it does not travel through our servers, we never see it and we never store it. On our side we only record that a booking button was tapped, with no visitor identifier (see 2.6).
• Location map: it loads when it comes into view, and at that point hands the visitor's IP address to OpenStreetMap. It sets no cookie, and all we send it is the coordinates of the point to display.

2.6 Technical data and card view statistics

• IP address: used to limit sign-in, sign-up and message sending attempts, in order to protect accounts against automated attacks. Kept for 24 hours at most, then erased.
• Session: once you are signed in, a technical cookie keeps your session open for 30 days from your last visit; after that it expires and you sign in again.
• Language preference: a cookie remembers for one year the language you pick with the switcher.
• Card view statistics: every time a public card is displayed and every time one of its buttons is tapped (phone, email, website, directions, menu, vCard, booking), we record the date, the approximate country reported by the network, where the visit came from (QR code, direct link, social network), the language the card was displayed in, the language of the visitor's device as their browser declares it (without the region: "fr", "es"), and, if it appears in the address, the campaign label. We also record how long the tab stayed in the foreground (never the time spent in the background), capped at 30 minutes; this measurement only exists since 30 September 2026, earlier visits carry none. No visitor identifier is recorded: these statistics cannot recognise a person from one visit to the next. They are visible to the card holder.

2.7 Internal alert to the publisher

Bizleen is published by one person. To know that an account has just been created or that a subscription has just changed, the publisher receives an alert on his Telegram messaging app. It is sent to him and to nobody else.

• On sign-up: first name, last name, email address and, when that address is not from a consumer provider, its domain; the handle of the card created, the language of the form filled in, the date and time, and a link to your record in our administration tool.
• On a subscription change (new subscription, change of plan, cancellation, failed payment): email address, plan before and after the change, billing frequency, number of monthly payments already collected, date and time.

This processing rests on the legitimate interest of the publisher in knowing what is happening on his service and being able to react quickly: it is not necessary to perform the contract, and you can object to it by writing to us. Telegram is established outside the European Union (see section 4).

2.8 Legal bases

3. Cookies

The following cookies may be set (audience measurement cookies only after your consent):

That list is complete: these are the only cookies the site sets. Only the audience measurement ones ask for your consent. All the others are strictly necessary to the service you have just asked for, or remember a choice you have just made: they require no consent and cannot follow you on any other site.

We use no advertising cookies and we never resell data. For audience measurement of our site and our public cards we use Google Analytics 4. These cookies are set only after your explicit consent through the banner ("Accept" button). If you decline, no Google script is loaded and no data is sent to Google. Your choice is stored locally by your browser (it is not a cookie) and you can change it at any time with the button below.

Change my cookie choice

4. Sub-processors and recipients

We only call on the providers the service needs to run. Each one only accesses the data it needs for the task it is given. The last line of this list, Orbit, is the exception: it is not a provider working for us but a third-party service processing on its own account. It is named here because data reaches it.

• Cloudflare (Cloudflare, Inc., United States / Cloudflare Switzerland GmbH, Switzerland): hosting the site, keeping account and card data, storing the images and documents you upload, protection against attacks. Cloudflare's network is worldwide: your data may be processed outside the European Union, covered by the standard contractual clauses. Cloudflare policy.
• Stripe (Stripe Payments Europe, Ltd., Ireland / Stripe, Inc., United States): collecting subscription payments and handling invoicing. Receives your email address as well as the billing and payment details you enter on its side. Stripe policy.
• Resend (Resend, Inc., United States): delivering our emails (address confirmation, password reset, invitation to co-edit a card, forwarding a message received through the contact form). Receives the recipient address and the content of the message. Resend policy.
• Anthropic (Anthropic PBC, United States): machine translation of your content and reading the photos you take (a menu; your business card or your shopfront, to pre-fill your card; the business card someone gave you, to save it in your contact book, see section 11), only when you trigger the feature yourself. Receives the text or the image to process, never your sign-in credentials. Anthropic policy.
• Google (Google Ireland Limited, Ireland / Google LLC, United States): first, audience measurement through Google Analytics 4, only after your consent (page views, approximate country and device type); second, if you link your business listing, sending the name and the address of that business so the listing can be found and its average rating and number of reviews read. Transfers outside the EU are framed by the standard contractual clauses and the Data Privacy Framework. Google policy.
• Institut national de l'information géographique et forestière, IGN (France): geocoding service of the Géoplateforme (Base Adresse Nationale, data.geopf.fr). Receives the locality (postcode or town) that a visitor types into the service-area check on a public card, sent from our servers: never their IP address or any identifier. Purpose: telling whether that locality lies within the venue's service area. Bizleen keeps neither the input nor the reply; only the resulting geographic point is held for at most one day in the Cloudflare network cache, under a hashed key that does not contain the input. For hosting and retention at IGN, see its data protection policy, published on ign.fr.
• OpenStreetMap Foundation (OpenStreetMap Foundation, Nominatim service, United Kingdom): three distinct uses, not to be confused. First, converting the published address of your venue into coordinates, done once from our servers: only that address, already public on your page, is sent. Second, displaying the map on the public card: that one is loaded by the visitor's browser, which hands their IP address to OpenStreetMap (see 2.5). Third, and only as a fallback when the Base Adresse Nationale does not recognise the locality (outside France in particular), the locality a visitor types into the service-area check of a public card, sent from our servers without their IP address or any identifier (see the IGN entry above). OSMF policy.
• Area search in the Bizleen Events directory (IGN and OpenStreetMap Foundation, see both entries above): when a visitor types a city, a district or a postcode into "Near", that text is sent from our servers to the Géoplateforme geocoding service (data.geopf.fr) and, as a fallback, to Nominatim, without the visitor's IP address or any identifier. A text that looks like a street address (a house number and a street, such as "12 Baker Street") is never sent or kept: the page asks for a town instead. Purpose: finding the centre of the area to list nearby events. Bizleen keeps the point of the town found, under a fingerprint of the text that does not contain it in clear, for 30 days at most. The location given by the "Near me" button is neither sent nor stored. The addresses of public event venues, already published, are also converted into coordinates by these two services, once, from our servers.
• Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates): delivering the internal alerts described in 2.7, to the publisher of the service and to him alone. Receives the content of those messages, so your name and your email address. The United Arab Emirates are covered by no adequacy decision from the European Commission: this transfer outside the European Union is limited to those alerts, and you can object to it. Telegram policy.
• Orbit (app.bizleen.com): the booking module displayed on the cards that enable it. It is not a sub-processor: Orbit processes on its own account and on the venue's whatever the visitor enters in the booking form, as well as the IP address the browser hands it when loading the module. We receive neither that information nor the booking.

The publisher's access to your account. An administration feature lets the publisher open your workspace as you see it, to help you out or handle a request. It is reserved to the publisher of the service and is only used for support and maintenance. It does not open your contact book (section 11).

No data is sold, shared for advertising purposes, or handed over to a third party outside those named above, all of which are necessary for the service to run or for a feature you have enabled.

5. Retention periods

• Account, card and published content: for as long as your account exists. Immediate deletion on request (see section 6).
• Session: 30 days without a visit, then automatic deletion.
• Sign-in attempt log (IP address): 24 hours at most, purged automatically.
• Links sent by email: an address confirmation link is good for 24 hours, a password reset link for 1 hour, and each one works only once. After that the link is worth nothing; the record standing for it is erased as soon as you ask for a new link, and in any case along with your account.
• Invitations to co-edit a card: 14 days. After that the link no longer works, and the invitation, which carries the invited person's email address, is erased the next time an invitation is sent or accepted.
• Messages received through a contact form: not kept once forwarded to the card holder.
• Photos read to pre-fill a card or a contact (your business card, your shopfront, or the business card someone gave you): not kept. They are only used for as long as it takes to read them, and the raw text drawn from them is not kept either: only the information you approve is saved. One exception: the shopfront photo you expressly choose as your cover photo, which is then kept like the other images of your card.
• Contact book (section 11): each contact for as long as you keep it. A contact neither opened nor changed for three years is flagged to you, then deleted three months after that flag if you do not answer it. The whole contact book is erased along with your account.
• Internal alerts to the publisher (see 2.7): the message stays in his Telegram conversation until he deletes it.
• Card view statistics: kept for as long as the card exists, and deleted along with it.
• Subscription data: for the duration of the subscription, then for as long as our accounting and tax obligations require.
• Backups: our host keeps technical backups on its own cycles; they cannot be consulted on request.

6. Your rights

Under the GDPR (articles 15-22) and the French Loi Informatique et Libertés, you have the following rights:

• Access and portability: download a complete JSON export of your data from your Account page ("Download my JSON export" button). Your contact book is exported separately, from the contact book itself (section 11).
• Rectification: change your data at any time in your dashboard.
• Erasure (right to be forgotten): delete your account instantly from your Account page (Danger zone). Deleting it also deletes your card, your content, your statistics, your contact book, your sessions and every one of your files: profile photo, logo, background, photos of the venue, event posters, photos of the menu items, PDF document, along with the images the service built from yours (contact thumbnail, signature QR code). Gone too are the log of your calls to the artificial intelligence features, the invitations to co-edit that carried your email address, and the traces of your sign-in attempts. Your handle becomes available again.
  One condition only: as long as a subscription is running, deletion is refused. Cancel it first, then delete the account. We prefer those two clear steps to an account deletion that would decide on its own to stop a subscription you are paying for.
• Withdrawal of consent: for audience measurement, change your choice with the button in section 3, at any time and without giving a reason.
• Objection: deleting the account is equivalent.
• Restriction: to restrict without deleting, contact us.
• Complaint: you can file a complaint with the CNIL (cnil.fr), the French data protection authority.

We answer any request sent to rgpd@bizleen.com within one month, in accordance with article 12 of the GDPR.

7. Security

• Your password is never kept in plain text and cannot be read by anyone, including us.
• Traffic between your browser and the site is encrypted end to end by HTTPS.
• The cookie that keeps your session open is not readable by the scripts on the page and is only sent over an encrypted connection.
• Sign-in, sign-up and message sending attempts are limited in number, to slow down automated attacks.
• The files you upload are checked before being accepted: only certain image and document formats are allowed, within the size limits the editor reminds you of at upload time. We check what the file really is, not just its extension.
• Sensitive actions (changing your password or your email address, deleting your account) require you to enter your password again.

No online service is infallible. Should a data breach be likely to create a risk to your rights, we will notify the CNIL and, if the risk is high, we will inform you directly, in accordance with articles 33 and 34 of the GDPR.

8. Minors

The service is not intended for minors under 16. If you are a parent or guardian and a minor has created an account, contact us for immediate deletion.

9. Changes

This policy may be updated. The last update date is shown at the top of the page. For substantial changes, we will notify you by email.

10. Signing in with Google and Google user data

Bizleen lets you create your account or sign in with your Google account, in addition to signing up with an email address and password (section 2.1). This sign-in only requests three scopes, the narrowest Google offers for identifying an account: openid, email and profile.

• Data received: your Google account identifier, your email address and its verification status, your name, and your profile picture when Google provides one.
• Use: this information is only used to create your Bizleen account or sign you in, and to pre-fill your name. Nothing else.
• Retention: your Google account identifier is attached to your Bizleen account, with the same security guarantees as the rest of your account (section 7). We keep no access or refresh token for this sign-in alone.
• Sharing: no sale, no sharing for advertising purposes, no transfer to a third party.
• Advertising use: none.
• Model training: information received from Google is never used to train an artificial intelligence model, including the ones used elsewhere for translation (section 4).
• Deletion: deleting your account (section 6) erases this link. You can also, at any time and independently of your Bizleen account, revoke Bizleen's access to your Google account from your Google Account's "Security" page (myaccount.google.com/permissions).

Separately from this sign-in, Bizleen also queries the Google Places API with a key issued to our application, to display a business's average rating and number of reviews (see 2.2). That call never reaches anyone's personal Google account: it carries none of the scopes above and is unrelated to signing in with Google.

Bizleen's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (developers.google.com/terms/api-services-user-data-policy).

11. Contact book

The contact book lets you keep the details of the people you meet: you photograph the business card someone gave you, or you type in their details yourself. The data concerned here therefore belong to people other than you, and the roles are not those of the rest of this policy.

11.1 Who is responsible

• You are the controller of the details you save: you decide who goes into your contact book, what you keep about them and why. If you keep this contact book for strictly personal use, outside any professional activity, the GDPR does not apply to that use (article 2.2.c).
• Bizleen is your processor (article 28 of the GDPR): we keep your contact book for you, on your instructions, and for no other purpose.
• Anthropic is a sub-processor, solely for reading the photo of a business card, when you take one.

11.2 Purpose and legal basis

The contact book serves one purpose only: finding and getting back in touch, in a professional setting, with the people who gave you their details. This processing rests on your legitimate interest (article 6.1.f of the GDPR): keeping the professional details that a person handed you themselves, by giving you their card, which is what they can reasonably expect. It is up to you to inform the people you save (article 14 of the GDPR) and to answer their requests.

11.3 The data saved

• The information on a business card, and nothing else: last name, first name, job title, company, phone, email address, website, postal address, social networks, and the address of the person's public Bizleen card if their business card shows one.
• What you add yourself: a note, tags, the place and date you met.

When you photograph a business card, the image is sent to Anthropic solely so that its text can be read. Bizleen keeps neither the image nor the raw text drawn from it: only the information you approve is saved. Do not write down any sensitive information about a person (health, opinions or religion, for instance): the screen reminds you of this when you write a note.

11.4 Who has access

Your contact book is attached to your account alone. Nobody else has access to it: not a colleague, not a person who co-edits one of your cards, not a member of your team, not the publisher of the service, whose support tool does not open the contact book (section 4). Bizleen makes no other use of it: the contact book feeds neither email sending, nor statistics, nor any directory, nor Orbit. The administration of the service only sees how many contacts each contact book holds, never what they contain, including during the search described in 11.7.

Sub-processors: Cloudflare, which hosts the service and therefore keeps your contact book, and Anthropic, solely for reading a photo of a business card (section 4).

11.5 Retention period

• Each contact is kept for as long as you keep it.
• A contact you have neither opened nor changed for three years is flagged in your contact book, which asks you whether you want to keep it. If you do not answer, it is deleted three months after that flag.
• Deleting your account erases your whole contact book.

11.6 Your rights over your contact book

• Deletion: you delete a contact whenever you like; deletion is immediate and permanent.
• Export: you can export your complete contact book at any time, as vCard and CSV, from the contact book itself.

11.7 If your details are in a user's contact book

You can turn to the person who saved them, who is responsible for them, or write to rgpd@bizleen.com. Bizleen does not search through contact books: on your written request, and only then, the publisher of the service can search the contact books for your exact email address. He alone can run this search, and each one is recorded in a log that does not keep your address in plain text. The contacts found are deleted, or your request is passed on to the user concerned.

12. Contact

For any question about your personal data: rgpd@bizleen.com.

Last updated: October 24, 2026