Privacy Policy

This Privacy Policy applies to businessmold.com, the client portal, the partner portal, referral pages we host, and the marketing, development, and AI-assisted services we provide (together, the “Services”). It is incorporated into our Terms of Use.

When we provide services to a business client, that client may send us personal information about their own customers or contacts. In that situation the client is the controller of that data and we act as a service provider or processor on their behalf, handling it according to their instructions and our agreement with them. If you are one of that client’s customers and want your data accessed or deleted, please contact that business directly; we will support their request.

Information you give us directly:

• Account information — name, email address, phone number, password (stored only as a salted hash, never in readable form), and role (client, partner, or team member).
• Business and billing information — company name, business address, city, state, and postal code.
• Quote and inquiry information — the services you are interested in, estimated budget, project notes, and anything you write in a contact or quote form.
• Messages and support content — messages you send through the portal, emails, change requests, and notes about your account.
• Partner information — your referral slug, bio, photo, company, website, and the PayPal email address you use to receive commission payments.
• Client materials — logos, copy, images, product information, brand guidelines, and any account credentials or access you choose to share so we can perform the work.

Information collected automatically:

• Usage and device data — IP address, browser type, operating system, device type, pages viewed, referring URL, and timestamps.
• Referral tracking — when you arrive through a partner’s referral link, we record the visit and store a referral cookie so the referring partner can be credited if you later become a client.
• Cookies and similar technologies — see Section 5.

Information from third parties:

• Payment processors — Stripe (and Square, for some accounts) send us confirmation of a payment, the card brand, the last four digits, and an expiration date. See Section 7.
• Partners — a partner may submit your name and contact details when referring you to us.
• Advertising and analytics platforms — aggregated campaign performance data for accounts we manage on your behalf.

What we do not knowingly collect. We do not want and do not ask for Social Security numbers, government identification numbers, protected health information, biometric data, precise geolocation, or financial account credentials. Please do not send these to us or paste them into any AI-enabled feature.

• Create, authenticate, and maintain your account, including password resets.
• Deliver the services you ordered and manage your projects, deliverables, and renewals.
• Prepare quotes and proposals and communicate about your engagement.
• Process payments, issue invoices, run recurring or renewal charges you have authorized, and maintain financial records.
• Calculate, verify, and pay partner commissions, and determine partner rank and eligibility.
• Send service and transactional messages — receipts, invoices, renewal reminders, delivery notifications, security notices, and replies to your messages.
• Send marketing emails about our services, where permitted, with an unsubscribe link in every one.
• Provide customer support and troubleshoot problems.
• Produce, review, and improve deliverables, including with AI assistance as described in Section 4.
• Monitor, secure, and improve the Services, prevent fraud and abuse, and enforce our Terms.
• Comply with legal obligations, including tax and accounting requirements, and respond to lawful requests.

Where required by law, we rely on one or more of these legal bases: performance of a contract with you; our legitimate interests in operating and securing our business; your consent (which you may withdraw); and compliance with legal obligations.

We use AI tools to help produce and improve the work we deliver, and to power features such as AI receptionist, chat, content generation, and automation. Because this affects how your information is handled, we want to be specific about it.

• What may be sent to AI providers. To generate or edit content, analyze campaign data, produce recommendations, or run an AI-enabled feature, we may transmit relevant inputs to third-party AI providers. This can include your business information, brand and marketing materials, website content, campaign and analytics data, project briefs, and the text of prompts or requests related to the work.
• What we do not send. We do not send payment card numbers, passwords, or password hashes to AI providers. We instruct our team not to submit sensitive personal information, government identifiers, or protected health information to AI-enabled features, and we ask that you do not either.
• AI providers are service providers. Third-party AI providers act as our service providers and are permitted to process the data only to return a result to us, subject to their own terms and security commitments.
• Training. We do not sell your information to AI providers and we do not authorize the use of your business information or client materials to train third-party AI models. Where our AI providers offer a setting or contractual commitment that excludes our data from model training, we use it. We cannot, however, guarantee the internal practices of every third-party platform you separately connect or use.
• Automated content on this site. Some content on our website, including blog articles and images, is generated by AI on an automated schedule. Publishing that content does not involve your personal information.
• No solely automated decisions with legal effect. We do not use AI to make decisions about you that produce legal or similarly significant effects without human involvement. Pricing, service, partner, and account decisions involve a human.
• Accuracy. AI output can be wrong. We describe the limits of AI-generated content, and your responsibility to review it, in Section 8 of our Terms of Use.

We use a small number of cookies and similar technologies:

• Strictly necessary cookies — keep you signed in, maintain your session, and protect against cross-site request forgery. The Services do not work without these.
• Referral cookies — record which partner referred you so commissions are credited correctly.
• Analytics — help us understand which pages are visited and how the site performs, so we can improve it.

You can block or delete cookies in your browser settings, but strictly necessary cookies are required to sign in and use the portal. We honor Global Privacy Control (GPC) and similar browser-based opt-out signals where required by law. We do not use cookies to build advertising profiles about you across unrelated websites.

We do not sell your personal information. We share it only in these situations:

• Service providers. Companies that operate parts of our business under contract — payment processing (Stripe, Square), hosting and infrastructure, database services, transactional and marketing email delivery, AI providers, analytics, and error monitoring. They may use the data only to provide services to us.
• Partners. If you were referred by a partner, that partner can see limited information about you in their portal — your name, the fact that you are an assigned or referred client, and commission amounts generated by your payments. Partners do not see your payment method, card details, passwords, message contents, or account credentials.
• Team members. BusinessMold team members assigned to your account can see the account information and materials needed to do the work.
• Advertising and marketing platforms. Where we manage campaigns on your behalf, we interact with platforms such as search engines, social networks, and ad networks using the access you authorize.
• Professional advisors. Accountants, auditors, insurers, and lawyers, under duties of confidentiality.
• Legal and safety. When we believe disclosure is reasonably necessary to comply with law, a subpoena, or other legal process; to enforce our Terms; or to protect the rights, property, or safety of BusinessMold, our clients, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred, subject to this policy or a successor policy with comparable protections.
• With your direction. Any other sharing you ask us to do.

We never receive or store your full card number, CVC, or PIN. When you save a card or make a payment, the card details are captured directly by our payment processor’s secure fields in your browser and exchanged for a token. We store only that token plus the card brand, last four digits, and expiration — enough to display “Visa ending 4242” and to charge an amount you have authorized.

Our payment processors are PCI-DSS compliant and maintain their own privacy policies governing their handling of your payment data. Partner commission payments are sent to the PayPal address you provide; PayPal’s own policies apply to that transaction.

We keep personal information only as long as needed for the purposes described in this policy, and then delete or anonymize it. In practice:

• Account records are kept while your account is active and for a reasonable period afterward in case you return or a dispute arises.
• Invoices, payments, commissions, and other financial records are kept as long as required by tax and accounting law — generally at least seven years.
• Password reset tokens expire one hour after issue and are single-use.
• Messages, notes, and support history are kept for the life of the account unless you ask us to delete them.
• Administrative access logs are kept for security and audit purposes.
• Backups are retained on a rolling schedule and are overwritten in the ordinary course.

We use administrative, technical, and physical safeguards designed to protect your information. These include encryption in transit (HTTPS), one-way salted hashing of passwords, role-based access controls, restricted and logged administrative access, expiring single-use password reset links, tokenized payment handling so card numbers never reach our systems, and regular dependency and security updates.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your account by using a strong, unique password, changing any temporary password immediately, and not sharing your credentials. Tell us right away at support@businessmold.com if you suspect unauthorized access. If a breach affecting your personal information occurs, we will notify you and the appropriate authorities as required by law.

Depending on where you live, you may have some or all of the following rights:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix inaccurate or incomplete information. You can update most of it yourself in Account Settings.
• Deletion — ask us to delete your personal information, subject to records we must keep by law (such as financial records) or need to resolve a dispute.
• Portability — receive your information in a portable, machine-readable format.
• Restriction and objection — ask us to limit or stop certain processing, including processing based on legitimate interests.
• Withdraw consent — where we rely on consent, withdraw it at any time, without affecting processing already carried out.
• Opt out of marketing — unsubscribe from marketing emails at any time using the link in the email or by contacting us. You will still receive transactional messages about your account, invoices, and services.
• Non-discrimination — we will not deny service, charge a different price, or provide a lower quality of service because you exercised a privacy right.

To make a request, email privacy@businessmold.com from the address on your account, or use our Contact page. We will verify your identity before acting and will respond within the time required by applicable law — generally 30 to 45 days. You may use an authorized agent where the law permits; we may ask for proof of authorization.

California residents (CCPA/CPRA). In the past 12 months we collected the categories of information described in Section 2 for the business purposes described in Section 3, and disclosed information to the categories of recipients described in Section 6. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not knowingly collect or sell the personal information of anyone under 16. You have the rights listed above, including the right to know, delete, correct, and limit the use of sensitive personal information, and the right to appeal a denied request.

EEA, UK, and Swiss residents (GDPR). You have the rights listed above and the right to lodge a complaint with your local supervisory authority. Our legal bases are described in Section 3.

BusinessMold operates in the United States, and our service providers, including our payment processors, hosting providers, and AI providers, may process and store data in the United States and other countries. If you access the Services from outside the United States, you understand your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards for such transfers, including standard contractual clauses.

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact privacy@businessmold.com and we will delete it promptly.

By creating an account or engaging our services, you agree to receive transactional messages about your account, invoices, renewals, deliveries, and support. These are not marketing and cannot be unsubscribed from while your account is active, though you may close your account.

Marketing emails always include an unsubscribe link. If your engagement includes SMS or AI voice features, message and data rates may apply and consent requirements under the TCPA and similar laws apply — see Section 8 of our Terms of Use for who is responsible for obtaining that consent.

The Services link to and integrate with third-party websites and platforms we do not control, including payment processors, social networks, advertising platforms, search engines, and AI providers. Their collection and use of your information is governed by their own privacy policies, not this one. We encourage you to read them.

We may update this Privacy Policy as our services, technology, or legal obligations change. We will revise the “Last updated” date above and, for material changes, provide additional notice by email or through the portal before the change takes effect. Your continued use of the Services after a change takes effect means you accept the updated policy.

For privacy questions, requests, or complaints, email privacy@businessmold.com or reach us through our Contact page. We take privacy concerns seriously and will work with you in good faith to resolve them.