Privacy Policy

This Website Privacy Policy explains how Built by Shah LLC, doing business as Built for Business, collects, uses, discloses, and retains Personal Information through its own Website and related direct business interactions. It also explains available privacy choices and rights.

1. SCOPE, COMPANY IDENTITY, AND PRIVACY ROLES

1.1 Who We Are

Built by Shah LLC, a California limited liability company doing business as Built for Business (“Built for Business,” “Built by Shah,” “Company,” “we,” “us,” or “our”), operates the Website and is responsible for the practices described in this Privacy Policy.

Built for Business is a trade name and is not a separate legal entity.

1.2 What This Privacy Policy Covers

This Privacy Policy applies to Personal Information we collect through:

1. our primary public website at builtforbiz.io;
2. Built for Business landing pages, campaign pages, forms, scheduling pages, chat tools, assessments, downloads, webinars, and public resources that link to this Privacy Policy;
3. our direct communications with prospective clients, clients, website visitors, business contacts, and authorized users;
4. our own sales, marketing, event, consultation, onboarding, billing, support, and relationship-management activities; and
5. Built for Business Portal or account activity to the extent a separate privacy notice or client agreement does not control.

These channels are collectively called the “Website” for this Privacy Policy.

1.3 What This Privacy Policy Does Not Cover

This Privacy Policy does not govern:

1. an independent third-party website, platform, app, social network, advertising platform, payment processor, communications service, or other provider;
2. the privacy practices of a Built for Business client;
3. Personal Information submitted to a client-owned website, advertisement, telephone number, form, CRM environment, or campaign when the client determines why and how the information is used; or
4. employee or contractor information governed by a separate workforce notice, if applicable.

When Built for Business processes Personal Information on behalf of a client, the client ordinarily acts as the business or controller and Built for Business acts as a service provider or processor under the applicable client agreement. Section 11 explains that relationship.

1.4 Relationship to Other Agreements

The Website Terms of Service govern public Website use. A signed Service Agreement, Master Client Service Terms, data-processing addendum, or other accepted agreement may provide additional privacy, security, retention, or processing terms for a client relationship.

If a service-specific privacy or data term conflicts with this general Privacy Policy, the more specific accepted term controls the applicable client processing to the extent permitted by Applicable Law.

1.5 Meaning of Personal Information

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable individual or household. It may also be called personal data under some laws.

Personal Information does not include information that is lawfully made public from government records, information that Applicable Law excludes, or information that has been deidentified or aggregated so that it cannot reasonably be linked to an individual.

“Applicable Law” means a law, regulation, binding court order, or governmental requirement that lawfully applies to the relevant person, organization, conduct, or information.

2. PRIVACY SUMMARY

This summary provides a quick orientation. The complete sections below control.

3. CAT­EGO­RIES OF PERSONAL INFOR­MATION WE COLLECT

The categories collected depend on how you interact with us, the features used, your selections, and the services involved.

3.1 Identifiers and Contact Information

We may collect:

1. name;
2. business name and customer-facing brand;
3. postal or business address;
4. email address;
5. telephone or mobile number;
6. username, account identifier, or Portal identifier;
7. Internet Protocol address;
8. device, cookie, advertising, or similar online identifiers; and
9. signature, signer identity, or authentication record.

3.2 Business and Professional Information

We may collect:

1. job title, role, department, ownership status, and authority;
2. company type, industry, location, size, service area, website, and business profile;
3. products, services, licenses, qualifications, offers, goals, challenges, and operational needs;
4. marketing, sales, lead, advertising, Website, CRM, workflow, technology, or staffing information;
5. professional biography, business social-media information, and publicly available business information; and
6. information used to evaluate service eligibility, technical fit, compliance, risk, or a possible engagement.

3.3 Inquiry, Scheduling, and Relationship Information

We may collect:

1. contact-form responses;
2. requested service or resource;
3. scheduling selections, meeting details, attendance, and time zone;
4. referral source and campaign attribution;
5. sales stage, follow-up status, preferences, notes, and relationship history;
6. proposal, application, onboarding, or support information; and
7. consents, opt-ins, opt-outs, communication preferences, and suppression records.

3.4 Account, Authen­ti­ca­tion, and Security Information

We may collect:

1. account credentials or credential-verification records;
2. authentication events, password-reset records, access roles, and permissions;
3. device, browser, network, login, session, and activity records;
4. suspected fraud, abuse, compromise, or security-event information; and
5. identity and authority verification information.

We generally do not need your passwords for unrelated accounts. When access to a connected business account is required, we prefer supported manager access, delegated access, tokens, service accounts, or provider authorization methods.

3.5 Transaction, Billing, and Commercial Information

We may collect:

1. services considered, purchased, renewed, canceled, or requested;
2. transaction dates, invoices, receipts, credits, refunds, disputes, and account balances;
3. billing contact, billing address, tax status, and related records;
4. payment-method type, last digits, expiration information, transaction tokens, and processor responses; and
5. purchasing history, usage, plan, wallet, allowance, or other commercial information.

Payment processors generally collect and process full payment-card or bank details on our behalf. We do not need you to send full card numbers or security codes through ordinary forms, email, WhatsApp, or chat.

3.6 Com­mu­ni­ca­tions and Content

We may collect the content and metadata of:

1. emails, Portal messages, SMS, WhatsApp messages, chat messages, and support requests;
2. forms, documents, files, images, logos, website content, prompts, and other submissions;
3. meeting, telephone, or video recordings, transcripts, summaries, and notes when recorded with notice or consent required by Applicable Law;
4. social-media interactions and public comments directed to us; and
5. feedback, testimonials, reviews, survey responses, and preferences.

3.7 Website, Device, and Usage Information

We may automatically collect:

1. Internet Protocol address and approximate location derived from it;
2. browser type, device type, operating system, language, screen characteristics, and network information;
3. referring and exit pages, URLs, campaign parameters, and referral source;
4. pages, content, buttons, forms, videos, and features viewed or used;
5. dates, times, session duration, navigation paths, clicks, scrolling, interactions, errors, and performance data;
6. cookie, pixel, tag, local-storage, advertising, or similar identifiers;
7. login, authentication, fraud, and security signals; and
8. consent-banner and privacy-preference records.

3.8 Approximate Geolocation

We may infer approximate city, region, state, country, or time zone from an Internet Protocol address, device settings, scheduling selection, business information, or other context. We do not intend to collect precise device geolocation through the public Website unless a feature clearly requests it and provides any notice or consent required by Applicable Law.

3.9 Inferences and Profiles

We may derive inferences about:

1. service interests and likely business needs;
2. lead quality, eligibility, or readiness;
3. communication, scheduling, or content preferences;
4. Website engagement and campaign attribution;
5. fraud, security, or abuse risk; and
6. likely relevance of an offer, resource, or follow-up.

We do not use public Website inferences to make a final decision concerning credit, housing, insurance, medical care, education admission, employment eligibility, or another legally significant high-impact decision.

3.10 AI Inputs and Outputs

When an AI-assisted feature is used, we may collect prompts, questions, instructions, messages, uploaded content, conversation context, generated output, feedback, and technical or usage information associated with the interaction.

3.11 Applicant Information

If the Website offers a job or contractor application, we may collect contact details, work history, education, qualifications, availability, compensation expectations, references, interview information, work authorization, and other information voluntarily provided for recruiting. A separate applicant notice may supplement this Privacy Policy.

3.12 Sensitive Personal Information

Depending on the interaction, we may process limited information treated as sensitive under some laws, such as account credentials, payment-related information handled through a processor, communication contents, or identity-verification records.

Do not submit protected health information, full government identifiers, biometric templates, payment-card security codes, children's data, or other highly sensitive information through a public Website feature unless we expressly request it through a supported secure process.

4. SOURCES OF PERSONAL INFOR­MATION

We may collect Personal Information from:

1. you, including through forms, scheduling, accounts, meetings, communications, downloads, surveys, payments, and submissions;
2. your business or representatives, including owners, employees, contractors, administrators, colleagues, and authorized users;
3. our clients, when they provide contact, account, user, or project information;
4. automated Website technologies, including cookies, pixels, tags, logs, local storage, analytics, attribution, security, and similar tools;
5. advertising, social-media, referral, and lead-generation sources, when lawfully provided;
6. service providers, including scheduling, communications, CRM, payment, analytics, advertising, identity, fraud-prevention, hosting, security, and AI providers;
7. connected accounts and integrations that you or a client authorizes;
8. publicly available sources, including business websites, government registries, directories, public social-media pages, search results, maps, professional profiles, and public reviews;
9. partners, advisers, and other business contacts, when lawfully shared; and
10. inferences we generate from information described in this Privacy Policy.

5. HOW WE USE PERSONAL INFOR­MATION

We may use Personal Information for the following purposes.

5.1 Operate the Website

We use information to provide pages, forms, scheduling, downloads, chat, accounts, authentication, preferences, navigation, media, demonstrations, and other Website functions.

5.2 Respond to Requests and Develop Business Relationships

We use information to respond, schedule, qualify, understand needs, prepare for meetings, conduct consultations, provide demonstrations, develop proposals, evaluate fit, follow up, and manage prospective or current business relationships.

5.3 Provide and Administer Services

When a client relationship exists, we use information to onboard, configure, build, host, manage, support, maintain, communicate, train, bill, report, troubleshoot, secure, improve, and perform the purchased services under the applicable agreement.

5.4 Communicate

We use information to send confirmations, reminders, responses, account notices, security alerts, service messages, billing communications, support information, surveys, resources, and marketing permitted by your consent, relationship, preferences, and Applicable Law.

5.5 Personalize and Improve

We use information to understand Website use, diagnose errors, assess performance, improve navigation, prioritize content, evaluate features, conduct research, develop services, test changes, train personnel, and tailor communications or offers.

5.6 Analytics, Attribution, and Advertising

We use information to measure traffic, engagement, form completion, campaign performance, conversions, source attribution, audience relevance, advertising effectiveness, frequency, and return on marketing activity. We may create or use audiences and deliver or measure advertising on third-party platforms as permitted by Applicable Law and your available choices.

5.7 AI and Automation

We use information to operate AI-assisted research, drafting, classification, extraction, transcription, summarization, routing, recommendations, support, analysis, and automation, subject to Section 9.

5.8 Security, Integrity, and Abuse Prevention

We use information to authenticate users, manage permissions, prevent spam, detect fraud or misuse, investigate suspicious activity, protect systems and people, enforce rate limits and agreements, preserve evidence, and respond to incidents.

5.9 Billing, Accounting, and Admin­is­tra­tion

We use information to process payments, issue invoices and receipts, manage accounts, handle refunds or disputes, maintain tax and accounting records, evaluate credit or risk where lawful, and administer our business.

5.10 Legal Compliance and Rights

We use information to comply with law, respond to lawful process, establish or defend legal claims, exercise contractual rights, investigate violations, conduct audits, meet insurance or recordkeeping needs, and protect the rights, safety, and property of Built for Business and others.

5.11 Corporate Transactions

We may use information to evaluate, plan, conduct, or complete a financing, merger, acquisition, reorganization, sale of equity or assets, due diligence review, bankruptcy, or other corporate transaction, subject to appropriate confidentiality and legal safeguards.

5.12 Deidentified and Aggregated Information

We may deidentify or aggregate information and use it for lawful analytics, research, benchmarking, security, service improvement, business planning, and marketing. We will not attempt to reidentify information that Applicable Law requires us to maintain as deidentified, except to test whether deidentification remains effective where permitted.

6. COOKIES, ANALYTICS, ADVER­TIS­ING, AND ONLINE TRACKING

6.1 Technologies We May Use

Depending on Website configuration, we and our providers may use:

1. cookies;
2. pixels, web beacons, and tags;
3. local storage and session storage;
4. scripts and software-development kits;
5. device, browser, and advertising identifiers;
6. server logs and event records;
7. analytics and attribution tools;
8. session-interaction, heatmap, or replay-style tools; and
9. similar technologies.

These technologies may collect or receive identifiers, device and browser information, Website activity, approximate location, referral information, campaign parameters, conversions, and inferences.

6.2 Categories of Cookies and Similar Technologies

6.3 Cookie and Privacy Controls

The current public Website does not display a cookie banner or provide a separate video-permission or privacy-preference panel. You may use browser or device settings to block or delete cookies and other browser storage, although doing so may affect functionality. Video players load as described in Section 6.7.

Browser and device settings are generally specific to that browser or device. For questions about our use of information or to exercise an applicable privacy right, use the email instructions in Section 14.4. Before activating new analytics, advertising, or replay integrations, we will provide the notices and controls required by Applicable Law.

6.4 Advertising Choices

Advertising platforms and industry groups may provide additional controls for interest-based advertising. Opting out of personalized advertising does not necessarily eliminate advertising; it may make ads less tailored and does not remove information already lawfully retained for security, measurement, legal, or other permitted purposes.

6.5 Do Not Track and Opt-Out Preference Signals

Traditional browser Do Not Track signals do not have a single universally accepted technical or legal standard. The Website may not respond to a traditional Do Not Track setting as an opt-out unless Applicable Law requires that response.

A qualifying opt-out preference signal, such as the Global Privacy Control, communicates a request to opt out of legally defined sale, sharing, or targeted advertising where Applicable Law requires it. The video players described in Section 6.7 load as described even when a Global Privacy Control signal is present. The public Website does not currently display a browser-signal status panel. The planned advertising and analytics integrations listed in Section 6.7 are inactive; before activating them, we will implement any opt-out preference signal processing required by Applicable Law.

6.6 Third-Party Collection

Analytics, advertising, social-media, embedded-content, and other third parties may collect information about your online activity over time and across different websites or services when their technologies operate on the Website. Their processing is governed by their own notices and controls in addition to any obligations they owe to us.

6.7 Website Providers and Current Configuration

The current public Website offers a meeting-request form for your name, work email, required U.S. phone number, business name, optional website, and main goal. The form displays a short submission agreement linking to the Website Terms of Service, this Privacy Policy, and the SMS Program Terms. By submitting after that notice, you agree to nonmarketing texts from Built by Shah LLC dba Built for Business about your inquiry, including related follow-up, scheduling, confirmations, and meeting reminders. Consent is not a condition of purchase. Submission does not enroll you in promotional text campaigns or authorize WhatsApp marketing, automated marketing calls, or unrelated messages.

We use received meeting requests to respond and arrange a meeting. Associated consent records may include your name, email, phone number, the submission action, disclosure and policy versions presented, date and time, and source form or page. We may use providers acting on our behalf for those purposes. Submission does not withdraw an existing marketing preference or override a prior opt-out or suppression record. To withdraw consent, use the methods in Section 10. A meeting request does not confirm a meeting time or guarantee availability of text messaging; we confirm the meeting separately.

Privacy requests use email links. Opening an email link does not send the message or grant marketing consent. Email is handled by our email provider after you choose to send it. The Website does not provide applicant intake, account signup, file upload, or payment collection.

Vercel is the planned production hosting provider for this Website. Hosting and security providers may process connection, device, request, and security information necessary to deliver and protect the Website.

The homepage Vidalytics video player loads automatically when you visit the homepage and uses its configured autoplay behavior. YouTube privacy-enhanced embeds load when you open a YouTube video on the Website. Neither player waits for a separate cookie or video-permission prompt. Video providers may receive device, connection, viewing, and interaction information and may use cookies or similar technologies when their players load or are used. YouTube privacy-enhanced mode does not mean that the provider receives no information. Review Vidalytics’ Privacy Policy and Google’s Privacy Policy for their practices.

In the audited video configuration, Vidalytics uses a vidalytics_uid cookie and browser storage for a visitor identifier, session identifier, returning-viewer state, and playback preferences. Its statistics service receives viewing events. These video analytics are active even though the separately planned advertising and replay integrations below are inactive. Provider settings and browser controls affect storage and retention. We do not describe the video player as anonymous or limited to essential hosting functions.

The Website removes query parameters and unrecognized fragments from the page address before initializing its video players, to reduce disclosure through video telemetry, and sends a no-referrer policy. This does not erase the initial request already received by the host. Please do not put sensitive information in a Website link or address.

We plan to use Meta Pixel, Google conversion tracking, and PostHog for advertising measurement, analytics, session replay, and heatmaps. Those integrations are not active on the public Website as of this version. Before activating them, we will update the Website’s controls and configuration to reflect the actual purposes and applicable choices. We will not send inquiry contents, privacy requests, payment information, private messages, or other sensitive information to those tools.

The current public Website does not load the planned Meta Pixel, Google conversion-tracking tags, or PostHog session replay and heatmaps. Hosting and video providers may still receive information as described above. Cookie and browser choices are explained in Section 6.3; privacy request instructions are in Section 14.4.

7. HOW WE DISCLOSE PERSONAL INFOR­MATION

We may disclose Personal Information to the following categories of recipients for the purposes described in this Privacy Policy.

7.1 Hosting, Infrastructure, and Security Providers

We may disclose information to providers that supply hosting, cloud infrastructure, content delivery, databases, storage, backup, monitoring, authentication, fraud prevention, cybersecurity, error logging, and technical operations.

7.2 Business-Operations Providers

We may use providers for CRM, project management, scheduling, email, telephone, SMS, WhatsApp or similar messaging, customer support, forms, file transfer, electronic signatures, document management, collaboration, accounting, invoicing, payment processing, tax, analytics, and administration.

7.3 AI and Automation Providers

We may disclose relevant prompts, messages, content, context, business information, account information, usage information, and output to AI, transcription, automation, data-processing, or model providers as described in Section 9.

7.4 Analytics and Advertising Partners

We may disclose identifiers, device information, Website activity, approximate location, campaign data, conversions, hashed or otherwise transformed contact information where permitted, and inferences to analytics, attribution, advertising, and social-media platforms.

These disclosures may help measure campaigns, create or use audiences, personalize or deliver advertising, attribute conversions, limit frequency, and evaluate performance. Depending on Applicable Law, some may be treated as sale, sharing, or targeted advertising even when no money is exchanged.

7.5 Connected Services and Integrations

When you or a client directs or authorizes a connection, we may disclose information to the selected account, integration, platform, provider, application, telephone system, email system, calendar, advertising account, analytics account, website, CRM, or other destination.

7.6 Clients and Their Authorized Users

When we process information on a client's behalf, we may make it available to that client and its authorized users, representatives, systems, and providers. The client determines who is authorized and how the information is used, subject to its obligations.

7.7 Affiliates, Personnel, and Contractors

We may disclose information to our affiliates, employees, contractors, specialists, and other personnel who reasonably need it for the purposes described in this Privacy Policy and are subject to appropriate duties or safeguards.

7.8 Professional Advisers, Insurers, and Financing Sources

We may disclose information to attorneys, accountants, auditors, consultants, insurers, lenders, investors, and other advisers or financing sources subject to professional, contractual, or legal confidentiality protections as appropriate.

7.9 Legal, Safety, and Enforcement Recipients

We may disclose information to courts, arbitrators, law enforcement, regulators, government agencies, process recipients, affected parties, security researchers, providers, or others when we reasonably believe disclosure is necessary to:

1. comply with Applicable Law or lawful process;
2. protect a person from serious harm;
3. detect, prevent, investigate, or respond to fraud, abuse, security incidents, or unlawful activity;
4. enforce an agreement or protect legal rights; or
5. establish, exercise, or defend a claim.

7.10 Corporate Transaction Recipients

We may disclose information in connection with actual or proposed due diligence, financing, merger, acquisition, reorganization, bankruptcy, sale of equity or assets, transfer of the Website or business, or similar transaction. Recipients may include counterparties and their advisers, subject to appropriate restrictions where required.

7.11 Public or Directed Disclosure

We may disclose information publicly or to a person you direct when:

1. you intentionally submit a public review, testimonial, comment, or post;
2. you authorize portfolio or marketing use under an agreement;
3. you direct us to share information with another provider or recipient; or
4. the information is already lawfully public and our use is permitted.

We do not intentionally publish private lead records, credentials, payment information, private messages, nonpublic financial details, legally privileged information, or trade secrets merely because we provide services to a business.

8. SALE, SHARING, TARGETED ADVER­TIS­ING, AND PRIVACY SIGNALS

8.1 No Sale for Money

Built for Business does not sell Personal Information in exchange for money.

8.2 Advertising Disclosures That May Be Legally Defined as Sale or Sharing

Some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly enough to include disclosures of identifiers, device information, Website activity, approximate location, campaign data, conversions, or inferences to advertising, social-media, or analytics partners for cross-context behavioral advertising or related purposes.

Depending on the Website technologies in use and the law that applies, the following categories may have been disclosed for those purposes:

We do not knowingly sell or share Personal Information of individuals we know are under sixteen years old for cross-context behavioral advertising.

8.3 Opting Out

Where Applicable Law grants the right, you may contact privacy@builtbyshah.com to exercise an applicable opt-out right concerning information we hold. Section 14.4 explains how to submit a request.

The planned advertising integrations listed in Section 6.7 are inactive. Before activating integrations that require an online opt-out mechanism or recognition of browser-based opt-out preference signals, we will provide those mechanisms and update these disclosures. The current Website does not offer a separate on-site advertising preference control; Section 6.5 explains the current handling of browser signals and video players.

An opt-out applies prospectively and may be limited to the browser, device, identifier, or information reasonably connected with the request. We may request information reasonably necessary to apply the choice across identifiable records.

8.4 Financial Incentives

We do not currently offer a program in which a consumer receives a price or service difference in exchange for Personal Information in a manner requiring a notice of financial incentive under California law. If we introduce one, we will provide the required terms before enrollment.

9. ARTI­FI­CIAL INTEL­LI­GENCE AND AUTO­MATED PRO­CESS­ING

9.1 How AI May Be Used

We may use AI, machine learning, rules, and automated tools to assist with:

1. drafting, rewriting, summarizing, and translation;
2. research and content organization;
3. transcription and meeting notes;
4. lead routing, classification, prioritization, and follow-up suggestions;
5. extracting information from documents or messages;
6. support, search, chat, and question answering;
7. advertising, Website, CRM, SEO, and AEO analysis;
8. detecting spam, fraud, abuse, or security concerns;
9. analytics, predictions, recommendations, and workflow automation; and
10. service development, testing, evaluation, and quality improvement.

9.2 Information Sent to AI Providers

Depending on the feature, relevant prompts, messages, conversation context, files, Website content, business information, account information, usage data, and generated output may be transmitted to and processed by selected third-party AI or automation providers.

We seek to limit information to what we reasonably consider relevant for the function, but a User or client is responsible for not submitting restricted or unnecessary sensitive information through an unsupported feature.

9.3 Human Review and Limitations

AI output may be inaccurate, incomplete, biased, nonunique, outdated, or unsuitable. We may review, edit, reject, regenerate, or test output, but do not guarantee that every output receives human review.

We do not intend to use public Website AI features as the sole basis for a final decision concerning credit, housing, insurance, medical care, education admission, employment eligibility, or another legally significant high-impact decision.

9.4 Provider Terms and Data Controls

AI providers may process information under their contracts with us and their applicable terms. Provider functionality, retention, training controls, processing locations, models, and security practices may vary and may change.

Where we act as a processor for a client, AI use may also be governed by the client agreement, configuration, or data-processing addendum.

10. EMAIL, TELE­PHONE, SMS, WHATSAPP, AND RE­CORD­INGS

10.1 Operational and Relationship Com­mu­ni­ca­tions

We may use the contact information you provide to respond to requests, confirm or reschedule meetings, provide requested information, administer an account or agreement, address support or billing, provide security notices, and manage an existing business relationship.

The meeting-request form’s disclosed submission agreement covers only nonmarketing inquiry-related texts to the supplied number. Providing a phone number without that notice or accepting the Website Terms outside the form does not by itself grant SMS permission. Marketing texts, WhatsApp marketing, and automated marketing voice calls require any separate applicable consent.

10.2 Marketing Com­mu­ni­ca­tions

Where permitted by your consent, relationship, preferences, and Applicable Law, we may send marketing email, telephone calls, SMS, WhatsApp messages, or similar communications about resources, events, offers, and services.

You may unsubscribe from promotional email using the link in the message. For supported SMS programs, you may use a recognized opt-out word such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE, or another reasonable method that clearly communicates revocation. We will honor legally valid opt-out requests within the period required by Applicable Law.

10.3 Consent Records

We may retain records of the language presented, source, date, time, telephone number or email, Internet Protocol address, form, submission action or checkbox state where applicable, campaign, and other evidence associated with consent, revocation, suppression, or communication preferences.

Mobile numbers and SMS opt-in information are not sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. We may disclose this information to providers that process inquiries, deliver messages, or maintain consent and suppression records on our behalf, and when legally required. These providers do not receive permission to market independently using that information.

10.4 Effect of Opt-Out

We honor your opt-out within its scope and as required by Applicable Law. You may ask us to stop all texts to a number. A necessary or nonmarketing purpose does not itself authorize further texts covered by a revoked permission. A permitted nonmarketing confirmation of the opt-out does not re-enroll you.

Where lawful, we may use another available channel to respond to a request, provide a purchased service, administer an account or agreement, or send security, legal, billing, or service notices. Opting out of messages does not itself cancel a service agreement. A later inquiry does not withdraw an existing marketing preference or reverse a previous opt-out.

10.5 WhatsApp and Similar Services

If you communicate through WhatsApp, iMessage, social-media messaging, or another provider, that provider may collect and process information under its own terms and privacy notice. An ordinary inquiry or responsive conversation is not blanket consent to marketing through those channels. Where applicable, we obtain opt-in for promotional or recurring messages and honor requests to stop them. Do not send highly sensitive information through an informal messaging channel.

10.6 Recordings and Transcripts

Where permitted by Applicable Law and after any notice or consent required, we may record, transcribe, summarize, or analyze telephone calls, video meetings, demonstrations, and support interactions for documentation, training, quality, security, note-taking, follow-up, and service improvement.

If a recording is optional and you do not consent, tell us before recording begins. We may offer an unrecorded method or decline to continue through the proposed channel when recording is reasonably necessary for the activity.

11. INFOR­MATION WE PROCESS FOR CLIENTS

11.1 Client as Controller; Built for Business as Processor

Built for Business may provide managed websites, lead forms, hosting, Portal functions, communications, automation, advertising management, CRM systems, analytics, scheduling, AI-assisted features, and related services to business clients.

When a client determines why and how Personal Information from its leads, customers, prospects, personnel, or users will be collected and used, the client ordinarily acts as the business or controller and Built for Business acts as the client's service provider or processor.

11.2 Client Privacy Notices and Instructions

The client is responsible for its own privacy notices, consent, legal basis, communication practices, data instructions, user permissions, retention duties, and responses to individuals, subject to its agreement with Built for Business and Applicable Law.

Built for Business processes client-controlled information according to the client agreement, documented instructions, product configuration, provider requirements, and legal obligations. We may also process limited information for security, billing, compliance, service improvement, deidentification, legal claims, and other purposes permitted by the agreement or Applicable Law.

11.3 Requests Concerning Client-Controlled Information

If your Personal Information was submitted to a Built for Business client's website, advertisement, telephone number, form, CRM, or campaign, direct your request to that client first. The client is usually best positioned to verify your identity, understand the relationship, and determine the appropriate response.

If we receive a request concerning client-controlled information, we may:

1. refer the request to the client;
2. notify the client;
3. request information needed to identify the relevant client or account; and
4. assist the client as required by the client agreement and Applicable Law.

11.4 Client Data Access and Retention

Client Data access, export, active retention, backup retention, and deletion are governed by the applicable client agreement. Unless a more specific agreement applies, active-system data may remain available for a limited post-service export period and residual copies may remain in ordinary backups for a longer rotation period.

The Website Privacy Policy does not enlarge a client's contractual export right, extend a client environment, or guarantee that every record, provider field, log, relationship, or data type is exportable.

11.5 No Ownership of Individual Rights

Neither Built for Business nor a client obtains ownership of an individual's privacy, publicity, or other personal rights merely because information is processed through a service. Ownership and access to business records remain subject to the client agreement, third-party rights, and Applicable Law.

12. DATA RETENTION

12.1 General Retention Standard

We retain Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Website and services, maintain relationships, honor choices, secure systems, comply with law, keep business records, resolve disputes, and enforce agreements.

Retention depends on:

1. the nature, amount, and sensitivity of the information;
2. the purpose for which it was collected and whether that purpose continues;
3. the relationship and applicable agreement;
4. legal, tax, accounting, insurance, audit, limitation-period, and recordkeeping requirements;
5. security, fraud, abuse, dispute, and litigation risk;
6. provider functionality and backup architecture;
7. whether the information can be deidentified; and
8. a valid deletion request or legal hold.

12.2 Typical Retention Framework

The following describes our intended general framework. A shorter or longer period may apply when reasonably necessary and lawful.

12.3 Deletion, De­iden­ti­fi­ca­tion, and Backups

At the end of an applicable retention period, we may delete, destroy, overwrite, aggregate, or deidentify information. Residual copies may remain temporarily in backups, logs, archives, caches, fraud records, or legal-preservation systems and may be isolated from ordinary use until overwritten or deleted through routine processes.

We are not required to alter an immutable backup immediately when Applicable Law permits continued protected retention and the information is not restored to ordinary use except for recovery, security, or legal need.

13. INFOR­MATION SECURITY

13.1 Safeguards

We use commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Website and information we reasonably expect to process. Measures may include:

1. access controls and role management;
2. authentication and multifactor authentication where supported;
3. encryption in transit and other provider security features where supported;
4. credential, device, network, and account practices;
5. monitoring, logging, backups, and incident procedures;
6. provider review and contractual protections;
7. personnel confidentiality and access restrictions;
8. software updates, vulnerability management, spam and fraud controls; and
9. data minimization and retention practices.

13.2 No Absolute Security

No method of transmission, storage, authentication, provider access, or security control is perfectly secure. We cannot guarantee that information will never be accessed, disclosed, altered, lost, or destroyed without authorization.

13.3 Your Security Respon­si­bil­ities

You should use unique passwords, multifactor authentication, secure devices and networks, current software, appropriate user permissions, and caution with links and credential requests. Do not send sensitive information through an insecure or unsupported channel.

Notify us promptly through Section 20 if you suspect unauthorized activity involving a Built for Business Website account or communication.

13.4 Security Incidents

We may investigate, contain, remediate, document, and notify affected parties or authorities concerning a security incident as required by Applicable Law. We may act immediately to reset credentials, block traffic, suspend access, isolate information, disable an integration, preserve evidence, or contact a provider without advance notice.

14. YOUR PRIVACY CHOICES AND REQUESTS

14.1 Com­mu­ni­ca­tion Choices

You may:

1. unsubscribe from promotional email through the message link;
2. opt out of supported SMS programs using recognized words or another reasonable revocation method;
3. request changes to ordinary communication preferences through the applicable channel; and
4. continue to receive nonmarketing service, security, legal, billing, and relationship communications where permitted.

14.2 Cookie and Advertising Choices

You may use browser or device settings and contact our privacy team as described in Sections 6 and 8. Section 6.7 identifies active video providers and planned integrations; the current Website does not offer a separate on-site cookie or video preference control.

14.3 Privacy Rights That May Apply

Depending on your location, relationship, and the law that applies to Built for Business, you may have the right to request:

1. confirmation whether we process your Personal Information;
2. access to or a copy of Personal Information;
3. correction of inaccurate Personal Information;
4. deletion of Personal Information;
5. portability of certain Personal Information;
6. categories or specific pieces of Personal Information collected, sources, purposes, and recipient categories;
7. restriction of or objection to certain processing;
8. opt-out of sale, sharing, targeted advertising, or certain profiling;
9. limitation of certain uses or disclosures of sensitive Personal Information;
10. withdrawal of consent where processing is based on consent; and
11. appeal of a denied request where Applicable Law provides an appeal right.

These rights are subject to definitions, thresholds, exceptions, verification, and limitations under Applicable Law. A right may not apply to business-contact information, client-controlled data, deidentified information, legal records, security data, or information we must retain.

14.4 Submitting a Request

To ask about your Personal Information or exercise an applicable privacy right, email privacy@builtbyshah.com with the subject “Privacy Request.” You may also write to the mailing address in Section 20. Opening an email link does not send a request; review and send your message in your email app.

Please include:

1. your name, reply email address, and state and country;
2. your relationship to Built for Business and the right you wish to exercise;
3. a brief description of the information or time period concerned, if relevant; and
4. whether you are acting for someone else and whether the request concerns Built for Business or one of our clients.

If the request concerns a business that uses our services, contact that business first because it ordinarily determines how its customer information is used. Identify the business in your message if you need help finding the appropriate contact, as explained in Section 11.

Do not send a government ID, password, full payment-card number, or other unnecessary sensitive information through ordinary email. We will request only information reasonably needed to verify identity or authority through an appropriate process. Our team handles requests and replies by email; opening an email link does not create a request number or automatic confirmation.

14.5 Verification

We may verify a request by matching information you provide with records we maintain, confirming control of an email address or telephone number, requesting account authentication, asking relationship-specific questions, or using another reasonable method.

We will request only information reasonably necessary for verification. If we cannot verify identity, authority, jurisdiction, or the information involved, we may deny or limit the request and explain as required.

14.6 Authorized Agents

Where Applicable Law permits an authorized agent to submit a request, we may require proof of the agent's authority and may ask the individual to verify identity or confirm the authorization directly, unless a valid power of attorney or other law requires a different process.

14.7 Appeals

If Applicable Law provides an appeal right, you may appeal a denied request by replying to the decision or emailing privacy@builtbyshah.com with the subject “Privacy Request Appeal.” Include any request reference you received and a concise explanation.

14.8 Non-Dis­crim­i­na­tion

We will not unlawfully discriminate against you for exercising an applicable privacy right. We may offer different services or functionality when the difference is reasonably related to information needed to provide the service or where Applicable Law permits it.

14.9 Requests We May Decline or Limit

We may decline or limit a request when permitted, including when information is needed to:

1. complete a transaction or provide a requested service;
2. secure systems, prevent fraud, investigate abuse, or protect rights;
3. comply with law or legal process;
4. maintain tax, accounting, insurance, dispute, or contractual records;
5. exercise free-speech or another legal right;
6. conduct protected internal research or maintain deidentified information;
7. honor another person's rights or confidentiality;
8. preserve legal claims or evidence; or
9. respond to a request that is unverifiable, manifestly unfounded, excessive, repetitive, or outside the applicable law.

15. CALI­FOR­NIA AND OTHER U.S. STATE PRIVACY DIS­CLO­SURES

15.1 Applicability

U.S. comprehensive state privacy laws generally apply only when statutory thresholds and other conditions are met. Built for Business will provide rights required by a law that applies to the relevant processing. We may voluntarily respond to additional requests but do not represent that every state privacy statute applies to every interaction.

15.2 California Notice at Collection

California law may require a notice describing categories of Personal Information collected at or before collection. The categories we may collect, the purposes, and retention framework are summarized below and described more fully in Sections 3, 5, and 12.

We collect these categories from the sources in Section 4 and may disclose them to the recipient categories in Section 7. Sections 6 and 8 explain advertising disclosures that may be treated as sale or sharing.

15.3 California Rights

If the California Consumer Privacy Act applies to Built for Business and the relevant information, a California resident may have rights to know, access, correct, delete, and obtain information; opt out of sale or sharing; limit certain uses of sensitive Personal Information; and receive nondiscriminatory treatment, subject to exceptions and verification.

Requests may be submitted through Section 14.4. Sections 6.5 and 6.7 explain the current browser-signal and video behavior, and the controls we will implement before activating the planned advertising integrations where legally required.

15.4 California “Shine the Light”

California Civil Code section 1798.83 may permit certain California residents to request information about disclosures of Personal Information to third parties for their own direct-marketing purposes. We do not disclose Personal Information to third parties for their own direct marketing in the manner covered by that law without providing an applicable choice.

15.5 Nevada and Other State Opt-Outs

Residents of Nevada and other states may have a right to opt out of certain covered sales or targeted advertising. Built for Business does not sell Personal Information for money. Submit any applicable request through Section 14.4.

15.6 State-Specific Appeals and Regulatory Contacts

Where Applicable Law grants an appeal right, use Section 14.7. If an appeal is denied, we will provide any regulator or attorney-general contact information that Applicable Law requires with the decision.

16. CHILDREN'S PRIVACY

The Website and Built for Business services are directed to adults acting for business or commercial purposes. They are not directed to children under thirteen, and we do not knowingly collect Personal Information online from a child under thirteen without legally sufficient authorization.

Users of forms, accounts, scheduling, and interactive features must be at least eighteen years old. If you believe a child submitted Personal Information to our Website, contact us through Section 20 and provide enough information to identify the submission without sending additional sensitive information.

We may delete or restrict the information after reasonable verification. This Section does not prevent processing of information by a client when the client has a lawful basis and a separately supported agreement, but our standard public Website and services are not designed for children's data.

17. INTER­NA­TIONAL VISITORS AND DATA TRANSFERS

17.1 United States Operations

Built for Business is based in the United States. The Website and services may be hosted, supported, or processed in the United States and other countries where our personnel and providers operate.

Privacy and data-protection laws in those locations may differ from the laws where you live. Where Applicable Law requires a transfer mechanism or safeguard, we will use a legally recognized mechanism appropriate to the processing.

17.2 Legal Bases Where Required

Where a law requires us to identify a legal basis, processing may be based on:

1. performance of a contract or steps you request before entering a contract;
2. our legitimate interests in operating, securing, analyzing, improving, and marketing our business and services, balanced against applicable rights;
3. your consent;
4. compliance with a legal obligation; or
5. protection of vital interests or legal claims where applicable.

The basis depends on the information and purpose. You may contact us for additional information about a specific processing activity.

17.3 International Rights

If privacy law outside the United States applies to our processing, you may have rights described in Section 14 and the right to complain to a competent data-protection authority. The availability of those rights depends on jurisdiction, territorial scope, exemptions, and our role.

The Website is not represented as being specifically directed to every country or compliant with every local industry requirement. A business seeking services outside the United States must identify material localization or regulatory requirements before engagement.

18. THIRD-PARTY WEBSITES, SOCIAL MEDIA, AND EMBEDDED FEATURES

18.1 External Services

The Website may link to or embed third-party websites, video, maps, calendars, reviews, social media, payment tools, chat, documents, or other services. Those third parties may collect information directly from you or automatically when their feature loads.

Their privacy practices are governed by their own notices. A link or embed does not make Built for Business responsible for their processing or establish endorsement, partnership, or control.

18.2 Social-Media Interaction

If you interact with us through a social-media platform, the platform may provide us with public profile information, messages, comments, engagement, advertising information, or other data according to your settings and its policies.

Information you post publicly may be visible, indexed, copied, or redistributed by others. Use privacy settings and avoid posting information you do not want public.

18.3 Payment and Account Providers

Payment processors, banks, advertising platforms, communications providers, and other account providers may collect information directly and act as independent businesses or controllers for some purposes. Review their notices and account controls.

19. CHANGES TO THIS PRIVACY POLICY

19.1 Prospective Updates

We may update this Privacy Policy prospectively to reflect changes in law, Website features, services, providers, technology, security, business operations, or privacy practices.

The updated policy will identify a revised effective or “Last Updated” date and will be posted through a conspicuous Website link using the word Privacy.

19.2 Material Changes

For a material change, we may provide additional notice through the Website, a banner, email, account, Portal, or another reasonable method. If Applicable Law requires consent for a new use, posting an updated policy alone will not substitute for the required consent.

19.3 Prior Versions

We may retain prior versions and records of material changes. A new policy does not retroactively authorize a materially different use of previously collected Personal Information when Applicable Law requires additional notice or consent.

20. CONTACT US

For privacy questions, requests, or concerns, contact:

Built by Shah LLC dba Built for Business
Website: https://builtforbiz.io
Privacy Request Instructions: Section 14.4 — Submitting a Request
Privacy Email: privacy@builtbyshah.com
Support Email: support@builtbyshah.com
Mailing Address: 590 West Freedom Avenue, Orange, California 92865

Please identify the nature of the request and whether the information relates to our own Website or to a Built for Business client. Do not send unnecessary government identification, financial account information, health information, passwords, or other sensitive documents through ordinary email.

If your request concerns information controlled by one of our clients, we may direct you to that client as explained in Section 11.