Privacy Policy

1. Introduction and scope

This Privacy Policy (the "Policy") describes how Black Buoy LLC, a New Hampshire limited liability company located in Dover, New Hampshire, USA ("Black Buoy LLC", "we", "us" or "our"), collects, uses, discloses and retains Personal Information in connection with Encontado (the "Service"). It applies to Personal Information we process in two capacities:

1. As a business or controller. For owners of accounts and their teams, people who request access or join our waitlist, and anyone who contacts us or submits a report, we determine the purposes and means of processing.
2. As a service provider or processor. For the customers and visitors of websites built and hosted with the Service ("Hosted Websites"), the business that owns the Hosted Website determines the purposes and means of processing, and we process Personal Information on the business's behalf and in accordance with its instructions. The business's own privacy notice governs that processing. Requests concerning such information should be directed to the business first; we will assist the business in responding, and you may also contact us.

This Policy should be read together with our Terms of Service and Content Guidelines.

2. Definitions

In this Policy, the following terms have the meanings set out below:

• "Personal Information" means information that identifies, relates to, describes or could reasonably be linked with a particular person or household, and includes "personal data" as defined in applicable data protection law.
• "Account Information" means the details associated with an account, such as name, username, email address, phone number, role and plan.
• "Owner Content" means the material an account holder provides or generates through the Service, including interview answers, uploads, imported website content, generated pages and change requests.
• "Customer Data" means Personal Information that a Hosted Website collects from the customers and visitors of the business that owns it.
• "Service Provider" means a company that processes Personal Information on our behalf under a written contract that restricts its use of that information to the services it provides to us.
• "Sell" and "Share" have the meanings given in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the "CCPA").

3. Personal Information we collect

3.1 Information you provide

• Account Information, including your password, which we store only as a salted one-way hash, and anything you write in a request for access or a waitlist entry.
• Owner Content, including photographs, logos, documents and inventory spreadsheets you upload, and the text and images of an existing website you ask us to import.
• Billing information, including your plan, the dates and amounts of payments and refunds, and your payment processor's customer and subscription references. We do not receive payment card numbers.
• Domain registration details, including the registrant name, organization, email address, postal address and telephone number. After registration we retain only the name, organization and email address; the registry holds the remainder.
• Communications, including support requests and reports submitted through our forms.

3.2 Information collected automatically

• Usage and security information, including IP addresses (which, in most stored records, we retain only as a shortened one-way hash), sign-in sessions, server logs and an audit record of significant account and moderation actions.
• Service records, including records of each AI processing request made for your websites, its size and cost, and the website and account concerned.

3.3 Information processed for businesses

Depending on the features a business enables, its Hosted Website may collect Customer Data such as orders and delivery addresses, product subscriptions, bookings and deposits, event tickets, memberships, donations, quotes and invoices, customer accounts (an email address and a password hash, or a Google or Apple account identifier), newsletter subscriptions and unsubscriptions, contact form messages and the contact records the business maintains. We process Customer Data solely to provide the Service to that business and do not use it for our own purposes.

4. Purposes and legal bases for processing

We do not Sell or Share Personal Information, we do not use Personal Information for targeted or cross-context behavioral advertising, we do not use Owner Content or Customer Data to train AI models of our own, and we do not send marketing email to a business's customers on our own behalf.

5. Artificial intelligence processing

The Service uses AI models operated by us and by AI Service Providers to design and write pages, to review them against the facts you supply, to examine page layouts in screenshots, to screen material against the Content Guidelines and to route your change requests. The material these models process may include Personal Information that you include in your brief or on your website.

Automated screening may decline or pause a brief, an upload or a publication. Such a decision does not produce legal effects concerning you or similarly significantly affect you, and you may request human review as described in the Content Guidelines. Removing a published website or closing an account is carried out by a person.

We provide each AI Service Provider only the material required for the task, over encrypted connections, through its business application programming interface (API) service and not a consumer application. Each AI Service Provider is bound by contractual terms that govern its use and retention of that material.

6. Disclosure of Personal Information

We disclose Personal Information to the following categories of Service Providers, solely for the purposes described, and under written contracts that restrict their use of it. Certain providers are used only when a stated condition is met, such as when a business enables a particular feature.

A current list of the Service Providers in each category, and the countries in which they process Personal Information, is available to business customers and to supervisory authorities on request through encontado.com/help/contact or support@encontado.com.

6.1 Content loaded from third parties on Hosted Websites

• YouTube (privacy-enhanced mode) and Vimeo. Videos a business adds to its website play from YouTube or Vimeo, and YouTube preview pictures load from YouTube.
• Links a business adds. Maps, booking pages, payment pages and social profiles that a business links to (for example Google Maps, Calendly, Zoom, Square, PayPal, Venmo, Facebook, LinkedIn or X) are only contacted if a visitor follows the link.

6.2 Other disclosures

We may also disclose Personal Information where required by law or legal process, to protect the rights, property or safety of any person, to enforce our Terms of Service, or in connection with a merger, acquisition, financing or sale of all or part of the Service, in which case this Policy will continue to apply to the Personal Information transferred.

7. Cookies, browser storage and tracking signals

We use only cookies that are necessary for the Service to function. None is used for advertising or to track you across other websites, and we therefore do not display a cookie consent banner.

The studio also stores certain information in your own browser: your light or dark display preference, an unfinished interview (answers and attached files), unsaved editor work and the notices you have dismissed. This information remains on your device, and you may clear it through your browser settings. Visits to our own pages may be measured by a cookieless web analytics service. Hosted Websites load no analytics or advertising scripts from us.

Do Not Track and Global Privacy Control. Because we do not track users across third-party websites, the Service does not respond differently to "Do Not Track" browser signals. We treat a Global Privacy Control signal as a valid request to opt out of the Sale and Sharing of Personal Information, although we do not Sell or Share it.

8. Retention

We retain Personal Information only for as long as reasonably necessary for the purposes described in this Policy, as follows:

• Account Information and Owner Content: for as long as the account and websites exist, and then as described in Section 9.
• Sign-in sessions: 14 days for the studio, or until you sign out; 30 days for customer and member sessions on Hosted Websites.
• Email sent through the Service: the message content is cleared once delivered, and the delivery record is deleted after approximately 30 days.
• Rate-limit counters: contain only a one-way hash and a count, never the address itself, and expire at the end of their time window (typically one hour or one day).
• Support requests, reports, moderation decisions, appeals and audit records: for as long as needed to resolve them and to maintain an accountability record, including after a website is deleted.
• Billing and tax records: for the period required by tax and accounting law, normally up to seven years.
• Backups: point-in-time recovery copies are kept for up to 30 days, after which deleted information is no longer present in them.
• Deletion records: after a deletion we keep a minimal permanent record of the deleted website or username so that a pending background task cannot restore it.

9. Deletion

You may delete a website yourself by opening it in the studio and choosing "Delete this website" on its overview. Deletion stops the website from being served, closes open checkouts, cancels its subscriptions and memberships with the payment processor, disconnects its custom domain, and removes its drafts, versions, shop, bookings, events, members, customer accounts, subscribers, messages and files. Photographs in your photo library remain with your account.

To close your entire account, submit a request through encontado.com/help/contact or support@encontado.com. After verifying that the request came from you, we delete every website you own in the same manner and remove your sessions, uploaded photographs and account.

The following are not deleted: records held by the payment processor in your own payment account; a domain name you purchased, which remains registered to you; and the records described in Section 8. If deletion cannot be completed immediately, for example because a payment is still being settled, the studio informs you and the deletion is completed later rather than left partially done.

A customer of a Hosted Website may ask the business to delete their information, or may ask us, in which case we will forward the request to the business and assist it in responding.

10. Security

We maintain reasonable administrative, technical and physical safeguards appropriate to the nature of the Personal Information we process. All traffic is encrypted with HTTPS. Passwords are stored only as salted hashes. Sign-in cookies are HTTP-only and secure and, on Hosted Websites, restricted to that website's address. Service Provider credentials are kept as encrypted server secrets and are never sent to browsers. Access within the Service is limited by role, and only a small number of our own personnel may access other account holders' websites, for support and safety purposes. Payment card processing is performed entirely by the payment processor. No system is completely secure; if we become aware of a breach affecting your Personal Information, we will notify you and the relevant authorities as the law requires.

11. Children

The Service is intended for adults operating a business. We do not knowingly collect Personal Information from children under 13 years of age (or under 16 where that is the applicable age of consent), and we do not Sell or Share the Personal Information of consumers we know to be under 16. A business whose Hosted Website is directed to children is responsible for complying with applicable children's privacy law, including the Children's Online Privacy Protection Act (COPPA) in the United States. If you believe a child has provided Personal Information to us, please contact us and we will delete it.

12. International transfers

The Service is operated from the United States, and our Service Providers process Personal Information in the United States and in other countries, including in Asia and Europe, where AI models and other services are operated. Where we transfer Personal Information from the European Economic Area, the United Kingdom or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses where applicable. You may request a copy of the relevant safeguards through encontado.com/help/contact or support@encontado.com.

13. Notice to California residents

This Section supplements the rest of this Policy and applies to residents of California. It constitutes our notice at collection and our privacy policy under the CCPA.

13.1 Categories of Personal Information collected in the preceding 12 months

We do not collect precise geolocation, biometric information, or characteristics of protected classifications, and we do not create profiles or inferences about you.

13.2 Sale, sharing and sensitive Personal Information

In the preceding 12 months we have not Sold or Shared Personal Information, and we have no actual knowledge of Selling or Sharing the Personal Information of consumers under 16 years of age. We use and disclose sensitive Personal Information only for the purposes permitted by Cal. Code Regs. tit. 11, section 7027(m), and not to infer characteristics about you. Accordingly, we do not offer a "Do Not Sell or Share My Personal Information" or "Limit the Use of My Sensitive Personal Information" link, because neither applies.

13.3 Your rights under the CCPA

Subject to certain exceptions, you have the right to:

• Know and access: request the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the business or commercial purposes, and the categories of recipients, and receive a copy in a portable format;
• Delete: request deletion of Personal Information we collected from you;
• Correct: request correction of inaccurate Personal Information;
• Opt out: opt out of the Sale or Sharing of Personal Information (we do neither);
• Limit: limit the use of sensitive Personal Information (we use it only as described in Section 13.2); and
• Non-discrimination: exercise these rights without receiving discriminatory treatment, such as different prices or quality of service.

13.4 How to submit a request

You may submit a request through encontado.com/help/contact or support@encontado.com, selecting "Privacy request" as the topic. We will confirm receipt within 10 business days and respond within 45 calendar days, which we may extend by a further 45 days where reasonably necessary, with notice to you. To protect your information, we verify your identity before responding, normally by corresponding with the email address associated with the account. You may designate an authorized agent to make a request on your behalf; we may require the agent to provide your signed permission and may ask you to verify your identity directly. If we deny a request, we will explain why, and you may appeal by replying to our response.

13.5 Other California disclosures

We do not offer financial incentives or price or service differences in exchange for Personal Information. Under California Civil Code section 1798.83 ("Shine the Light"), California residents may request information about disclosures of Personal Information to third parties for their direct marketing purposes; we make no such disclosures. This Policy is available in a format accessible to people with disabilities; to request it in an alternative format, contact us through encontado.com/help/contact or support@encontado.com.

14. Rights under other laws

Depending on where you reside, including in other states of the United States, the European Economic Area, the United Kingdom and Switzerland, you may have some or all of the following rights, subject to applicable exceptions:

• to access Personal Information we hold about you and to receive a copy of it in a portable form;
• to rectify inaccurate Personal Information;
• to erase Personal Information;
• to object to or restrict certain processing, and to withdraw consent where processing is based on consent;
• to appeal our decision on a request; and
• to lodge a complaint with a data protection supervisory authority, such as the authority in your country of residence in the European Economic Area or the UK Information Commissioner's Office.

Requests may be submitted, and will be verified and answered, in the manner described in Section 13.4. If you are a customer of a Hosted Website, please identify the website so that we can forward your request to the business concerned.

15. Changes to this Policy

We may amend this Policy from time to time to reflect changes to the Service or to applicable law. The "Last updated" date at the top of this Policy identifies the current version. If we make a material change, we will notify account holders by email or through the studio before the change takes effect.

16. Contact information

Black Buoy LLC, Dover, New Hampshire, USA. Questions, requests and complaints about this Policy or our processing of Personal Information may be submitted through encontado.com/help/contact or support@encontado.com.