BIG HOUSE ENTERPRISE PRIVACY POLICY

Last Updated: December 16th, 2025
Effective Date: December 16th, 2025

---

INTRODUCTION

Big House Enterprise, LLC (“Big House Enterprise,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://www.bighouseenterprise.com (the “Website”) or use our AI Authority engineering services (the “Services”).

By using our Website or Services, you agree to the collection and use of information in accordance with this Privacy Policy.

This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined in this Privacy Policy have the meanings given in our Terms of Service.

---

TABLE OF CONTENTS

1. INFORMATION WE COLLECT

A. Information You Provide to Us

Account Information:

• Name, email address, password
• Company name and website URL
• Phone number
• Job title and role
• Industry/vertical information

Billing Information:

• Billing name and address
• Payment method information (tokenized – we do not store full credit card numbers)
• Tax identification numbers (if applicable)

Business Information:

• Website URLs and domain names
• Business objectives and goals
• Competitive positioning information
• Industry and market data
• Assessment responses and scores

Communication Data:

• Support tickets and email correspondence
• Chat logs and phone call recordings (when applicable)
• Feedback and survey responses
• Marketing preferences

B. Information We Collect Automatically

Technical Data:

• IP address
• Browser type and version
• Device information
• Operating system
• Referring website
• Pages visited and navigation patterns
• Time and date of visits
• Time spent on pages

API Usage Data:

• API calls and usage patterns
• Implementation data
• Performance metrics
• Error logs and debugging information

Service Usage Data:

• Features accessed
• Login history
• Dashboard activity
• Implementation configurations
• Schema markup deployed

C. Information from Third Parties

We may receive information about you from:

• Payment processors (transaction confirmations)
• Third-party platforms where we provide services (Google, OpenAI, etc.)
• Public databases (for entity verification and Knowledge Graph establishment)
• Business partners (with your consent)

---

2. USER CATEGORIES AND DATA HANDLING

We categorize users into distinct groups with different data collection, processing, and retention practices:

A. WEBSITE VISITOR

Who: Users who browse our website without creating an account or engaging Services.

Data Collected:

• Technical data (IP address, browser type, device information)
• Website usage data (pages visited, time on site, navigation patterns)
• Cookie data per our Cookie Policy
• Referring source information

Data Retention:

• Technical data: 2 years from last visit
• Cookie data: Per expiry periods in Cookie Policy

Legal Basis: Legitimate interests (website operation and improvement)

---

B. ASSESSMENT PARTICIPANT

Who: Users who complete our Digital Authority Risk Assessment or similar diagnostic tools.

Data Collected:

• Name and email address
• Company name and website URL
• Industry/vertical information
• Assessment responses and calculated scores
• Business intelligence provided during assessment
• Marketing preferences (if consented)

Data Retention:

• If subscribed to marketing: Until unsubscribe
• If not subscribed: 2 years from assessment completion
• Assessment data: 2 years (used for methodology improvement)

Legal Basis:

• Assessment delivery: Performance of contract
• Marketing (if opted in): Consent

---

C. STANDARD SUBSCRIBER

Who: Users with active monthly or annual subscription to Standard Services (non-Performance Commitment).

Data Collected:

• Account information (name, email, password hash)
• Billing information (name, address, payment method token)
• Subscription details (plan, start date, renewal date)
• API usage logs and patterns
• Website/domain information
• Implementation data (schema markup deployed)
• Performance metrics (algorithmic visibility data)
• Support communications (tickets, emails, chat logs)
• Usage analytics (features accessed, frequency)

Data Retention:

• During relationship: All data maintained
• After cancellation: 30-day retention period (allows data export)
• Then: Permanent deletion (except items below)
• Financial records: 7 years (legal compliance)
• Aggregated/anonymized data: Indefinitely

Legal Basis:

• Service delivery: Performance of contract
• Financial records: Legal obligation
• Aggregated data: Legitimate interests

---

D. PERFORMANCE COMMITMENT CLIENT

Who: Users engaged under Performance Commitment terms with success criteria commitments.

Data Collected:

• All Standard Subscriber data (above), PLUS:
• Digital Authority Risk Assessment results and Readiness Score
• Detailed success criteria and measurement baselines
• Quarterly strategy review notes
• Progress reports against 5 success criteria
• Expert determination documentation (if applicable)
• Implementation timelines and compliance tracking
• Enhanced performance analytics

Data Retention:

• During relationship: All data maintained
• After successful completion: API access perpetual (implementation data retained indefinitely)
• After non-performance: 30-day retention, then deletion (except below)
• Financial records: 7 years (legal compliance)
• Expert determination records: 7 years (dispute prevention)
• Aggregated/anonymized data: Indefinitely

Legal Basis:

• Service delivery: Performance of contract
• Financial/legal records: Legal obligation
• Expert determination: Legal claims defense

---

E. FORMER CLIENT

Who: Users whose accounts have been terminated, canceled, or suspended.

Data Collected:

• Minimal account identifiers only (for fraud prevention)
• Financial records required by law

Data Retention:

• Most data: Deleted within 30 days of termination
• Financial records: 7 years from last transaction
• Fraud/abuse records: 3 years from termination
• Legal dispute records: Until resolution + 1 year
• Aggregated/anonymized data: Indefinitely

Legal Basis:

• Financial records: Legal obligation
• Fraud prevention: Legitimate interests
• Legal defense: Legal claims

---

F. Cross-Category Notes

Aggregated/Anonymized Data:
All user categories contribute to aggregated, anonymized datasets used to:

• Improve our AI Authority Method™
• Develop industry benchmarks
• Enhance service effectiveness
• Support research and development

This data cannot identify individuals and is retained indefinitely.

Marketing Communications:
Users in any category may receive marketing communications if:

• They have opted in via checkbox
• They have not unsubscribed
• They have active business relationship with us (existing clients)

Marketing preferences can be changed at any time via:

• Unsubscribe links in emails
• Account settings (if applicable)
• Email to [email protected]

Category Changes:
Users automatically move between categories based on actions:

• Website Visitor → Assessment Participant (when completing assessment)
• Assessment Participant → Standard Subscriber (when purchasing subscription)
• Standard Subscriber → Performance Commitment Client (when upgrading to PC)
• Any category → Former Client (upon termination)

Data handling changes accordingly, with 30-day notice for material changes affecting existing clients.

---

3. HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

A. Service Delivery

• Provide and maintain Services
• Process payments and manage billing
• Deliver schema markup via API
• Monitor performance and generate reports
• Provide customer support
• Communicate about Services

B. Service Improvement

• Analyze usage patterns
• Develop new features
• Improve methodologies
• Conduct research and development
• Create aggregated benchmarks

C. Business Operations

• Maintain account security
• Prevent fraud and abuse
• Comply with legal obligations
• Enforce Terms of Service
• Respond to legal requests

D. Marketing and Communications

• Send service updates and announcements
• Provide marketing communications (with consent)
• Conduct surveys and gather feedback
• Share industry insights and educational content

E. Legal and Compliance

• Comply with applicable laws and regulations
• Respond to legal process (subpoenas, court orders)
• Protect rights and property
• Prevent illegal activity

---

4. HOW WE SHARE YOUR INFORMATION

A. WE DO NOT SELL YOUR DATA

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

B. Service Providers

We share information with third-party service providers who perform services on our behalf:

Payment Processing:

• Stripe (credit card processing)
• PayPal (payment processing)
• ACH processors (bank transfers)

Infrastructure and Hosting:

• Amazon Web Services (AWS) – cloud hosting
• Google Cloud Platform – analytics and infrastructure
• Cloudflare – CDN and security

Communications:

• Email service providers (marketing and transactional emails)
• Customer support platforms
• Communication tools

Analytics:

• Google Analytics (website analytics)
• Performance monitoring tools
• Security monitoring services

All service providers are bound by confidentiality agreements and may only use your information to perform services for us.

C. Legal Requirements

We may disclose your information if required by law or in response to:

• Subpoenas or court orders
• Legal process or government requests
• Law enforcement investigations
• National security requirements
• Protection of rights, property, or safety

D. Business Transfers

If Big House Enterprise is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. Your information remains subject to this Privacy Policy and applicable laws.

E. With Your Consent

We may share information with third parties when you provide explicit consent:

• Case studies or testimonials (only with written permission)
• Portfolio inclusion (only with written permission)
• Marketing materials featuring your brand (only with written permission)

F. Aggregated/Anonymized Data

We may share aggregated, anonymized data that cannot identify you:

• Industry benchmarks and reports
• Research and publications
• Marketing materials
• Public presentations

---

5. DATA RETENTION AND DELETION

A. Retention Schedule by Data Type

Data Category	Active Account	After Termination	Legal/Compliance Retention
Account Data
Account credentials (email, hashed password)	Duration of relationship	30 days, then permanently deleted	None
Profile information (name, avatar)	Duration of relationship	30 days, then permanently deleted	None
Login history	12 months rolling	Deleted immediately upon termination	None
Billing & Financial Data
Billing information (name, address)	Duration of relationship	30 days, then permanently deleted	7 years for tax records only
Payment method tokens	Duration of relationship	Deleted immediately upon termination	None
Transaction records	Duration of relationship	30 days, then deleted	7 years (Iowa Code §422.25, IRS)
Invoices and receipts	Duration of relationship	30 days, then deleted	7 years (tax compliance)
Refund records	Duration of relationship	30 days, then deleted	7 years (financial compliance)
Credit Card Information
Credit card numbers	Never stored by us (Stripe/PayPal holds securely)	N/A	N/A
Last 4 digits (display only)	Duration of relationship	Deleted immediately	None
Technical & Usage Data
API usage logs	24 months rolling	Deleted after 30-daytermination period	None
Performance metrics	Duration of relationship	30 days, then deleted	None unless perpetual PC access
Website analytics data	24 months rolling	Deleted after 30-daytermination period	None
Error logs and debugging data	90 days rolling	Deleted immediately upon termination	None
Implementation Data
Structured data configurations	Duration of API access	Deleted upon API revocation	None unless perpetual PC access
Knowledge Graph data	Duration of relationship	30 days, then deleted	None unless perpetual PC access
Strategic & Consulting Data
Strategic documentation	Duration of relationship	30 days, then deleted	None
Performance reports	Duration of relationship	30 days, then deleted	None
Competitive analysis	Duration of relationship	30 days, then deleted	None
Assessment results	Duration of relationship	30 days, then deleted	None
Communication Data
Email correspondence	36 months from last message	36 months from last message	7 years if related to dispute
Support tickets	36 months from ticket closure	36 months from ticket closure	7 years if related to dispute
Chat logs	24 months from conversation	24 months from conversation	None
Phone call recordings (if any)	12 months from call date	12 months from call date	None
Performance Commitment Data
Success criteria documentation	Duration of PC engagement	30 days, then deleted	7 years (dispute prevention)
Quarterly review notes	Duration of PC engagement	30 days, then deleted	7 years (dispute prevention)
Expert determination records	Duration of PC engagement	7 years from PC completion	7 years (legal defense)
PC progress metrics	Duration of PC engagement	30 days, then deleted	None unless perpetual access granted
Marketing Data
Marketing preferences	Until unsubscribe	Deleted immediately upon unsubscribe	None
Email campaign engagement	Until unsubscribe	Deleted immediately upon unsubscribe	None
Lead magnet downloads	Until unsubscribe or 2years	Deleted per retention period	None
Security & Compliance Data
Security incident logs	3 years from incident	3 years from incident	3 years minimum
Fraud investigation records	3 years from resolution	3 years from resolution	3 years minimum
Legal dispute records	Until resolution + 1 year	Until resolution + 1year	Until resolution + 1 year
Regulatory compliance records	Duration of relationship	7 years from last transaction	7 years (various regulations)
Cookies & Tracking
Essential cookies	Session or per Cookie Policy	Auto-expire per Cookie Policy	None
Analytics cookies	Per Cookie Policy(typically 2 years)	Auto-expire per Cookie Policy	None
Marketing cookies	Per Cookie Policy(typically 13 months)	Auto-expire per Cookie Policy	None
Special Categories
Aggregated/anonymized data	Indefinitely	Indefinitely	Indefinitely (no personal information)
Backup copies (encrypted)	90 days rolling	Deleted after 90 days	None (automatically purged)
Perpetual API access(successful PC)	Indefinitely	Indefinitely (frozen snapshot)	Indefinitely (contractual right)

B. Legal and Regulatory Compliance Requirements

We are REQUIRED BY LAW to retain certain data even after account deletion:

Financial Records (7 years):

• Iowa Code § 422.25 (state tax records)
• Internal Revenue Code § 6001 (federal tax records)
• Generally Accepted Accounting Principles (GAAP)

Data retained: Transaction records, invoices, receipts, refund records

Dispute Prevention (7 years):

• Iowa statute of limitations for contract disputes
• Expert determination records (Performance Commitment)

Data retained: PC success criteria documentation, expert reports, quarterly reviews

Fraud Prevention (3 years):

• Federal Trade Commission Act requirements
• Payment Card Industry Data Security Standard (PCI DSS)

Data retained: Security incident logs, fraud investigation records

C. Data Retention After Termination – Timeline

Day 0 (Termination Date):

• API key revoked immediately
• Active Services cease
• 30-day retention period begins

Days 1-30 (Retention Period):

• All data remains accessible for export requests
• Client may request data export (fee: $500-$2,500)
• No new data collected
• Client may request early deletion

Day 31 (Deletion Begins):

• Automatic deletion process initiates
• Most personal data permanently deleted within 24 hours
• Deletion irreversible (no recovery possible)

Days 31-90 (Backup Purge):

• Data may persist in encrypted backups
• Backups automatically cycle out and are destroyed
• No active data remains after Day 90

Year 1-7 (Compliance Retention Only):

• Only legally required records retained
• Financial records (7 years)
• Dispute-related records (7 years)
• Expert determination records (7 years for PC clients)

Year 7+ (Complete Purge):

• All remaining compliance records deleted
• Only aggregated/anonymized data remains (no personal information)

EXCEPTION – Perpetual API Access:
Successful Performance Commitment clients retain perpetual API access with frozen implementation snapshot. This data retained indefinitely as contractual benefit.

D. Right to Request Deletion

You may request deletion of your data at any time by emailing: [email protected]

Subject line: “Data Deletion Request”

We will delete your data within 30 days except:

• Data required for legal/regulatory compliance (retained per schedule above)
• Data necessary to enforce our Terms of Service or defend legal claims
• Data subject to active legal hold or investigation
• Aggregated/anonymized data (contains no personal information)

Deletion includes:

• Your account and profile information
• All personal and business data you provided
• Implementation and performance data
• Communication history
• Usage logs and analytics

Deletion confirmation:
We will send written confirmation of deletion to your email address within 30 days of completion.

IMPORTANT: Deletion is permanent and irreversible. We cannot restore deleted data.

---

6. YOUR PRIVACY RIGHTS

A. Rights for All Users

Access: Request copies of your personal information
Correction: Request correction of inaccurate information
Deletion: Request deletion of your personal information (subject to legal retention requirements)
Restriction: Request restriction of processing in certain circumstances
Portability: Request transfer of your data to another service
Objection: Object to processing based on legitimate interests

To exercise these rights, contact: [email protected]

B. GDPR Rights (EU/EEA Residents)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

Right to Access: Obtain confirmation of whether we process your data and access to your data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure (“Right to be Forgotten”): Request deletion of your data
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in structured, machine-readable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent for processing (where consent is legal basis)
Right to Lodge Complaint: File complaint with supervisory authority

Our EU/EEA Representative: [email protected]

EU Supervisory Authority: You may lodge complaints with your local data protection authority

To exercise GDPR rights, contact:
Email: [email protected]
Subject: “GDPR Rights Request”

Response Time: We respond within 30 days

C. CCPA Rights (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

Right to Know: Request disclosure of:

• Categories of personal information collected
• Categories of sources
• Business purpose for collection
• Categories of third parties with whom we share information
• Specific pieces of personal information collected

Right to Delete: Request deletion of personal information (subject to exceptions)

Right to Opt-Out of Sale: We do not sell personal information, so this right does not apply

Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise CCPA rights, contact:
Email: [email protected]
Subject: “CCPA Request”

Verification: We may request additional information to verify your identity before processing requests

Authorized Agents: You may designate an authorized agent to make requests on your behalf

Response Time: We respond within 45 days (may extend by 45 days if needed)

D. Marketing Opt-Out

Email Marketing:

• Click “Unsubscribe” link in any marketing email
• Email: [email protected]
• Account settings (if you have an account)

You will continue to receive transactional emails (receipts, account notifications, service updates) even after opting out of marketing.

---

7. DATA SECURITY

A. Security Measures

We implement reasonable technical and organizational measures to protect your information:

Technical Safeguards:

• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest
• Secure API authentication (API keys)
• Regular security audits and penetration testing
• Access controls and authentication
• Intrusion detection and prevention systems
• Regular security updates and patches

Organizational Safeguards:

• Employee background checks
• Confidentiality agreements with employees and contractors
• Security awareness training
• Limited access to personal information (need-to-know basis)
• Incident response procedures
• Regular security policy reviews

Infrastructure Security:

• Secure cloud hosting (AWS, Google Cloud)
• Regular backups (encrypted)
• Disaster recovery planning
• Network segmentation
• Firewall protection

B. No Absolute Security

IMPORTANT: No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information using commercially reasonable means, we cannot guarantee absolute security.

You acknowledge and accept that:

• Internet transmission carries inherent security risks
• Unauthorized access may occur despite our safeguards
• You transmit information at your own risk

C. Data Breach Notification

If we experience a data breach that compromises your personal information:

We will notify you within 72 hours via email to your registered address

Notification will include:

• Nature of the breach
• Types of information affected
• Steps we are taking to address the breach
• Steps you can take to protect yourself
• Contact information for questions

We will also notify:

• Relevant regulatory authorities (as required by law)
• Payment processors (if payment information affected)
• Law enforcement (if criminal activity suspected)

D. Your Security Responsibilities

You are responsible for:

• Maintaining confidentiality of your login credentials
• Using strong, unique passwords
• Enabling two-factor authentication (if available)
• Not sharing your account with others
• Logging out when using shared devices
• Notifying us immediately of unauthorized access
• Keeping your contact information current

Report security concerns to: [email protected]

---

8. INTERNATIONAL DATA TRANSFERS

A. Data Location

Your information may be transferred to, stored, and processed in:

• United States (our primary operations)
• Cloud service provider locations worldwide
• Service provider locations in various countries

By using our Services, you consent to the transfer of your information to countries outside your country of residence, including the United States, which may have different data protection laws.

B. Transfer Safeguards

For transfers from the EU/EEA to the United States and other countries, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Other lawful transfer mechanisms under GDPR

C. EU-U.S. and Swiss-U.S. Privacy Shield

Note: The Privacy Shield framework has been invalidated by the Court of Justice of the European Union. We do not rely on Privacy Shield for data transfers and instead use Standard Contractual Clauses.

---

9. CHILDREN’S PRIVACY

A. Age Restriction

Our Services are NOT intended for individuals under 18 years of age.

We do not knowingly:

• Collect personal information from anyone under 18
• Market to individuals under 18
• Allow individuals under 18 to create accounts
• Process payment information from individuals under 18
• Provide Services to individuals under 18

B. Prohibition on Use by Minors

IF YOU ARE UNDER 18 YEARS OF AGE:

You are PROHIBITED from:

• Using our Services in any capacity
• Creating an account or profile
• Providing any personal information to us
• Downloading our materials or content
• Participating in our assessments or evaluations
• Purchasing subscriptions or services
• Interacting with our Website beyond passive browsing

Violation of this prohibition may result in:

• Immediate account termination without notice
• Permanent deletion of all associated data
• Prohibition from future use of Services
• Notification to parent/guardian (if contact information available)

C. For Parents and Legal Guardians

If you are a parent or legal guardian and believe your child under 18 has provided personal information to us or created an account:

Contact us IMMEDIATELY at:

• Email: [email protected]
• Subject line: “Minor Account – Immediate Attention Required”
• Include: Child’s name, email address used, approximate date of account creation

We will respond within 24 hours and will:

1. Verify the claim and relationship
2. Immediately suspend account access
3. Permanently delete all personal information within 30 days
4. Provide written confirmation of deletion
5. Block email address from future account creation

D. If We Discover a Minor Has Used Services

Immediate Actions (within 24 hours):

• Suspend all account access immediately
• Revoke API keys and disable implementations
• Cease all communications with the account
• Flag account for deletion

Within 30 Days:

• Permanently delete all personal information
• Permanently delete all account data
• Remove from all marketing lists
• Purge from all backup systems

Refunds:

• Any fees paid will be refunded in full (regardless of refund policy)
• Refunds processed to original payment method within 30 days
• No questions asked, no exceptions

E. Age Verification

While we do not implement age verification systems for all users, we reserve the right to:

• Request proof of age at any time
• Verify identity and age before providing certain services
• Refuse service if unable to verify age

Acceptable proof of age:

• Government-issued photo ID (driver’s license, passport, state ID)
• Birth certificate (with additional photo ID)
• Other government documentation showing date of birth

We will delete copies of age verification documents within 30 days of verification.

F. Business Context

Our Services are designed for and marketed to:

• Business executives and professionals
• Corporate entities and organizations
• Marketing and digital strategy professionals
• Agency partners and consultants

Given the business nature of our Services, pricing structure (typically $5,000-$300,000), and required business context (company websites, professional email addresses), we do not expect minors to attempt to use our Services.

G. Reporting Concerns

If you encounter any content or behavior on our platform that suggests minors are being targeted or are using our Services, please report immediately to: [email protected]

We investigate all reports within 24 hours.

H. Legal Compliance

This policy complies with:

• Children’s Online Privacy Protection Act (COPPA) – United States
• General Data Protection Regulation (GDPR) Article 8 – European Union
• California Consumer Privacy Act (CCPA) – California
• Other applicable child protection laws

---

10. COOKIES AND TRACKING TECHNOLOGIES

A. What Are Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently and provide information to website owners.

B. Types of Cookies We Use

Essential Cookies:

• Required for website functionality
• Enable core features (login, security, payment processing)
• Cannot be disabled without affecting site functionality

Analytical/Performance Cookies:

• Collect information about how visitors use our website
• Help us improve website performance
• Examples: Google Analytics

Functionality Cookies:

• Remember your preferences and choices
• Provide enhanced features
• Examples: Language preferences, display settings

Marketing/Targeting Cookies:

• Track your browsing habits
• Enable targeted advertising
• Used only with your consent

C. Cookie Policy

For detailed information about cookies we use, including:

• Specific cookie names and purposes
• Cookie duration and expiry
• How to control cookies
• Third-party cookies

Please visit our Cookie Policy at: https://www.bighouseenterprise.com/cookie-policy

D. Managing Cookies

You can control cookies through:

Browser Settings:

• Most browsers allow you to refuse cookies
• You can delete cookies already stored on your device
• Consult your browser’s help section for instructions

Opt-Out Tools:

• Network Advertising Initiative: http://www.networkadvertising.org/choices/
• Digital Advertising Alliance: http://www.aboutads.info/choices/
• Google Analytics Opt-Out: https://tools.google.com/dlpage/gaoptout

Note: Disabling cookies may affect website functionality and your user experience.

E. Do Not Track

Some browsers have “Do Not Track” features. Currently, there is no industry standard for responding to Do Not Track signals. We do not currently respond to Do Not Track signals.

---

11. THIRD-PARTY SERVICES

A. Third-Party Links

Our Website may contain links to third-party websites, services, or resources that are not operated or controlled by Big House Enterprise.

We are not responsible for:

• Privacy practices of third-party websites
• Content on third-party sites
• Security of third-party services
• Accuracy or reliability of third-party information

We recommend: Review the privacy policy of every website you visit.

B. Third-Party Platforms

Our Services involve optimizing your presence on third-party platforms including:

• Google (search, Knowledge Graph)
• OpenAI (ChatGPT)
• Anthropic (Claude)
• Perplexity
• Other AI and search platforms

Important:

• These platforms have their own privacy policies
• We do not control how these platforms collect, use, or share your information
• We are not responsible for these platforms’ privacy practices
• Your interactions with these platforms are subject to their terms and policies

Platform Data Usage: When we optimize your presence on third-party platforms:

• The platforms may collect information about your brand, content, and website
• The platforms control how they use this information
• We cannot guarantee privacy or security on third-party platforms
• Review each platform’s privacy policy to understand their practices

C. Service Provider Data Sharing

As described in Section 4 (How We Share Your Information), we share data with service providers who perform functions on our behalf.

These service providers:

• Are contractually obligated to protect your information
• May only use information to provide services to us
• Must comply with this Privacy Policy and applicable laws
• Are subject to regular audits and security assessments

---

12. CHANGES TO THIS PRIVACY POLICY

A. Right to Modify

We reserve the right to modify this Privacy Policy at any time. Changes may be necessary due to:

• Legal or regulatory requirements
• Changes in our business practices
• New features or services
• Security improvements
• User feedback

B. Notice of Changes

Material Changes:

• We will notify you via email at least 30 days before effective date
• Notice will be posted prominently on our Website
• May require acceptance for continued use of Services

Non-Material Changes:

• Updated Privacy Policy posted on Website
• “Last Updated” date revised
• No separate notification required

C. Review Responsibility

You are advised to review this Privacy Policy periodically for any changes. Changes become effective when posted unless otherwise specified.

D. Continued Use = Acceptance

Continued use of our Services after changes become effective constitutes acceptance of the revised Privacy Policy.

If you do not agree with changes:

• You must discontinue use of Services
• Contact us to request account deletion
• Exercise your privacy rights before effective date

---

13. CONTACT US

A. Privacy Questions and Requests

General Privacy Inquiries:
Email: [email protected]

Data Protection Officer (GDPR):
Email: [email protected]

California Privacy Rights (CCPA):
Email: [email protected]
Subject: “CCPA Request”

Data Deletion Requests:
Email: [email protected]
Subject: “Data Deletion Request”

Security Concerns:
Email: [email protected]

Child Privacy Concerns:
Email: [email protected]
Subject: “Minor Account – Immediate Attention Required”

B. Mailing Address

Big House Enterprise, LLC
Privacy Department
6701 Corporate Drive #4153
Johnston, Iowa 50131
United States

C. Response Time

We respond to privacy inquiries and requests within:

• GDPR requests: 30 days (may extend 60 days if complex)
• CCPA requests: 45 days (may extend 45 days if complex)
• General inquiries: 5-10 business days
• Security incidents: 24 hours
• Child privacy concerns: 24 hours

D. Complaints

If you have concerns about how we handle your personal information:

EU/EEA Residents:

• Contact our Data Protection Officer: [email protected]
• Lodge complaint with your local supervisory authority

California Residents:

• Contact California Attorney General’s Office
• California Department of Justice Privacy Enforcement
• Email: [email protected] with “CCPA Complaint”

All Other Users:

• Contact us directly: [email protected]
• Federal Trade Commission: ftc.gov/complaint

---

ADDITIONAL DISCLOSURES

California Shine the Light Law

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

Nevada Privacy Rights

Nevada residents may opt out of the sale of personal information. We do not sell personal information as defined under Nevada law. To exercise Nevada privacy rights, contact: [email protected]

Canadian Privacy Rights (PIPEDA)

Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA). Contact [email protected] to exercise rights.

---

BY USING OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND AGREE TO ITS TERMS.