Privacy Policy

The short version

• We never record your calls. No audio from a buzz is recorded or stored, and no person listens to it.
• We never store your IP address. Where we need to count requests to stop abuse, we store a salted one-way hash instead, so the table cannot identify anyone.
• We never see your card. Payment details go straight to Stripe.
• We never sell your data. Not to advertisers, not to data brokers, not to AI companies, not to anyone, at any price.
• We never use it to train AI. Not our own models and not anybody else’s.
• Not even if BuzzMeBro is bought. Your data is deleted before any sale. A buyer never gets it.
• We show no ads. We do buy a few ads of our own on Google, and one Google tag on our public pages tells us which ad a sign-up came from. It never runs inside your account.

What we collect

To run the service we hold:

• Your phone number, and the phone number of every person on your resident list. This is the core of the product: it is what the buzzer rings.
• A name, if you give one. It is optional and it exists so your roommates can tell each other apart in the app.
• Where your apartment is — your postal or ZIP code, your unit label as your building lists it, and your building’s address. We need the first to find a local number and the others so a visitor reaches the right unit.
• The buzzer number we buy for you, and your building’s panel line where it is known.
• A record of each buzz: when it started, what happened (answered, opened, missed), who opened the door, and how long it took. Not who was at the door, and not what was said.
• How you first found us, as one word from a short fixed list: a search engine, one of our ads, an AI assistant, social media, email, one of our messages, another website, or typed in directly. Never the page, the link or what you searched. We record it once when you start, so we can see which channels bring customers and what each costs.
• Billing records — your Stripe customer and subscription identifiers, invoice status and referral credits. Card numbers are held by Stripe, never by us.
• Free-month checks: when you start a free month, one-way coded versions of your phone number, email, apartment and Stripe’s card fingerprint, so each person gets one free month. They cannot be turned back into the originals, and they are used for nothing else. We also ask Twilio whether your number is a mobile line.
• If an AI assistant sets BuzzMeBro up for you: the postal code, unit and mobile number it sends us, the name it gives itself, when you opened any link it gave you, and when a confirmation code was texted to you and confirmed. We use them only to set up your account, to show that assistant your progress, and once you have finished, your BuzzMeBro number and the message for your building. When your assistant asks, we text a confirmation code only to the mobile number it gave us, at most three times per setup, and you choose whether to read it back. Your card goes to Stripe on Stripe’s own page; the assistant and BuzzMeBro never see it.
• A log of messages we send you, and the basis on which we sent each one, so we can prove a promotional message had your consent.

Anonymous visit counts

We count visits to our public pages and the steps of signing up, so we can see which pages are useful and where people get stuck. A count holds the page, the first page of your visit, the website or campaign link that sent you, whether it was a phone or a computer, which of our buttons or free tools you used and the kind of answer a tool gave (never what you typed into it), and a random number your browser makes up and forgets when you close the tab.

It sets no cookie. It holds no name, phone number, address or IP address, and it is never linked to an account or a household. Pages in your account are not counted. The sign-up steps right after you verify your phone are counted by step only. Some steps happen on our servers rather than in your browser, such as starting a free month or getting your number. We count those as plain tallies, with only the plan, the city region and whether a referral was used. A count of a checkout can also say what kind of place your visit came from, such as a search engine or one of our emails, never the page or link itself. Each tally has its own random number, so it is never linked to you, to a visit or to an account. If your browser sends Do Not Track or Global Privacy Control, you are not counted at all. The counts are stored by PostHog, along with our own daily business totals, such as revenue and costs for the whole company, which hold nothing about any customer. PostHog receives nothing else from us.

Google Ads measurement

We buy a small number of Google search ads. To learn which of them actually lead to sign-ups, Google’s ad tag loads on our public pages: the home page, the articles, the free tools and the sign-up steps. It never loads in your account, on the residents page, or on a guest pass, setup, referral or partner link.

When it loads, Google receives the address of the page (with any link details removed except ad and campaign tags), your IP address and browser details, as any website request does, and Google sets cookies in your browser, including one that remembers that you came from one of our ads. Google handles this under its own privacy policy and may connect it to a Google account you are signed in to. When a free month starts, the tag tells Google that a sign-up happened, so Google can match it to one of our ad clicks; it carries no order number and nothing about you. We never give Google your name, phone number, email, address or anything about your household.

If your browser sends Do Not Track or Global Privacy Control, the tag does not load at all. You can also block it in your browser, or turn off personalised ads at myadcenter.google.com.

What we deliberately do not collect

• Call audio or recordings. The system bridges a call; it does not capture it. The one automated thing that hears a call is our phone provider’s voicemail check, which listens to the first moments to tell a person from an answering machine and keeps nothing.
• Raw IP addresses. Rate-limiting stores a salted digest, and the salt lives outside the database, so a leaked table cannot be reversed to identify visitors.
• Location beyond your postal code. We never ask for or track device location.
• Advertising profiles. We never build or buy one, and nothing in your account is shared for advertising. The one outside script we allow is the Google Ads tag on our public pages, described under “Google Ads measurement” above; a strict Content-Security-Policy blocks every other third-party script, and blocks that one inside your account. Visits to our public pages are counted anonymously, as described under “Anonymous visit counts” above.
• Your contacts, photos, microphone or anything else on your phone.

Never sold, to anyone, ever

A buzzer service ends up holding an unusually complete picture of a household: the phone number of every adult who lives there, the address and unit, and a log of when the door was opened. That is worth money to people you have never heard of, so this is what we commit to in writing.

• We do not sell, rent, license or trade your personal information. Not to advertisers, data brokers, marketers, landlords, property managers, insurers or anyone else, and not in an “anonymised” or aggregated form built from your records.
• We do not use your information to train AI models, and we do not sell, license or give it to any company so that they can train theirs.
• The subscription is the whole business. You pay us, and that is the only way this service makes money. There is no second customer on the other side of your data.
• If BuzzMeBro is ever bought, merged or closed, your data is deleted. It is never part of a sale. Before any sale or merger completes, we delete every customer’s personal information: the phone numbers, the addresses and units, and the door log. A buyer gets the name and the software and none of your data. We will tell you at least 30 days ahead, because your buzzer number stops working when that happens. If you want service from a new owner, you sign up with them yourself. The only thing kept is what Canadian tax law makes any business keep, which is invoice records, and those are never sold or used for anything else.
• This section is permanent. We will not weaken it, remove it or add exceptions to it. It covers everything we hold about you, for as long as we hold it.

The providers listed under “Who else sees it” are the only other parties that touch your information, each to do one job for us.

Why we use it, and on what basis

We use the information above to provide the service, verify that a phone belongs to the person adding it, buy and operate your number, take payment, prevent fraud and abuse, answer your support requests, and meet legal obligations.

We rely on your consent, given when you sign up and when each resident verifies their phone, and on the necessity of processing to deliver a service you asked for. Promotional messages are sent only with express opt-in under Canada’s anti-spam legislation (CASL) — the box is never pre-ticked, and every promotional message we send records which consent it relied on. You can withdraw consent at any time.

Who else sees it

We use a small number of service providers, each for one job. Apart from Google, whose ad tag is described under “Google Ads measurement”, none of them is an advertising, data-broker or AI-training company, and none of them is paid in data. We do not sell personal information, and we do not share it for anyone else’s marketing.

We may also disclose information where the law requires it, or to protect someone’s safety or our legal rights.

Where your data goes

Several of the providers above process data in the United States. That means your information may be stored or handled outside Canada and can be accessible to courts and authorities in that country under its laws. We use providers that commit to appropriate contractual protections, and we keep the amount of personal information sent to them to what each one needs to do its job.

How long we keep it

• Your account and resident list: while your account is open. Removing a resident removes their number from the list immediately.
• Your buzzer number: held for 15 days after cancellation so you can change your mind, then released.
• The buzz log: kept as an append-only record. Entries cannot be edited or removed one by one, by us or by anyone, because a door log that can be rewritten is not a log. It holds no audio and no visitor identity. If BuzzMeBro is ever sold or closed, the whole database is destroyed, this log with it.
• Billing records: kept as long as Canadian tax and accounting law requires.
• AI assistant setups: the link works for 3 days, and the record is deleted 30 days after the assistant created it.
• Abuse-prevention records: short-lived, and identify no one.

Your rights

Under Canadian privacy law (PIPEDA) and equivalent provincial laws, you may:

• ask what personal information we hold about you and get a copy;
• have inaccurate information corrected;
• withdraw consent, including for promotional messages, at any time;
• ask us to delete your account and its personal information, subject to records we are required to keep, and to the append-only buzz log described above;
• complain to us, and to the Office of the Privacy Commissioner of Canada.

Email privacy@buzzmebro.com and we will respond within 30 days. We may need to verify your identity by the phone number on the account before acting on a request.

How we protect it

Security is built into how the data is stored, not added afterwards. In particular:

• every table holding customer data enforces row-level isolation at the database, so one apartment cannot read another’s rows even if application code is wrong;
• signed-out visitors have no database access of any kind;
• the buzz log and the credit ledger are append-only, with update and delete permanently revoked from every role;
• everyone on an apartment gets a text, by name, whenever someone is added or removed;
• data is encrypted in transit, the site runs a strict Content-Security-Policy with no third-party scripts, and credentials are never stored in our source code.

No system is perfectly secure. If you believe you have found a vulnerability, tell us at security@buzzmebro.com and we will work with you in good faith.

Children

The service is not for children. We do not knowingly collect information from anyone under 18. If you believe a child’s number is on a resident list, contact us and we will remove it.

Changes to this policy

If we change how we handle your information we will update this page and change the date at the top. Where a change is material we will tell you directly before it takes effect. That covers ordinary housekeeping, such as naming a new provider. The “Never sold” section above is not part of it. That section is permanent.

Contact

BuzzMeBro, Toronto, Ontario, Canada. Privacy questions and requests: privacy@buzzmebro.com. Everything else: support@buzzmebro.com.