Privacy Policy

Creative Business Technology ("CBT", "we", "us") is a software engineering, AI and cybersecurity company. This policy explains how we collect, use, share and protect personal information when you visit cbtdigi.com, contact us, receive our messages, or use our software and services (the "Services").

2.1 Our own business: for website visitors, prospects, people who contact us and our clients' account users, we decide how information is used. This policy applies directly.

2.2 Our clients' data: when businesses use our platforms (for example a contractor's crews and projects, or a salon's clients and bookings), we process that information on their behalf and under their instructions. The business is responsible for its own privacy notice. If you are a customer or employee of one of our clients, please contact that business about your information; we will help them respond.

3.1 Information you give us: name, business name, job title, email, phone number, messages, what you need, appointment details, payment and billing details (processed by our payment provider), account login details, and anything you share in calls, texts, chats or meetings.

3.2 Information collected automatically: IP address, approximate location derived from it, device and browser type, pages viewed, links clicked, referring site, dates and times, and cookie and similar identifiers.

3.3 Communications data: records of texts, emails and chats with us, and, where we tell you, call recordings and transcripts (including calls answered by our AI front desk).

3.4 Information from others: business contact details from public sources and directories, referrals, partners, and service providers that help us verify or update information.

3.5 Client data in our platforms (Section 2.2): may include contact details, appointments, project and job records, photos, documents, time and payroll records, and messages, as the client chooses to store.

3.6 Sensitive information: we do not seek sensitive personal information on our website. Our platforms may process sensitive information for clients where needed for their business (for example account credentials or payroll records), protected with additional safeguards and used only for that purpose.

• To respond to you, schedule calls and provide quotes.
• To provide, set up, maintain, support and secure the Services.
• To send service messages, appointment reminders and account notices.
• To send marketing emails or texts where you agreed or the law allows, with an easy way to opt out.
• To improve our website and Services, including with aggregated or de-identified data.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To comply with legal obligations, enforce our terms and protect rights and safety.
• For any other purpose we describe when we collect the information, with your consent where required.

5.1 Some Services use artificial intelligence, for example to answer calls and messages, summarize conversations or review documents. These features may process the information in those conversations and documents.

5.2 We use AI providers that do not use our clients' data to train their general models under our agreements with them, and we do not use one client's data to train AI for another client.

5.3 People review important results. We do not use AI to make decisions that produce legal or similarly significant effects about you without human involvement.

5.4 When you interact with our AI front desk, it identifies itself as a virtual assistant, and you can ask for a person.

If you give us your mobile number and agree to receive texts, we use it only to send the messages you agreed to, such as replies, reminders and updates, and offers only if you opted in. Message frequency varies and message and data rates may apply. Reply STOP to opt out or HELP for help. We do not sell, rent or share your mobile number or text messaging consent with third parties or affiliates for their marketing purposes. See our Texting Policy at cbtdigi.com/texting-policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only:

• With service providers that help us run our business, such as hosting and cloud, customer relationship management, communications (phone, text, email), payment processing, scheduling, analytics, security and AI providers. They may use it only to provide services to us and must protect it.
• With a client, when we process information on its behalf (Section 2.2).
• With professional advisers such as lawyers and accountants, under confidentiality.
• When required by law, legal process or government request, or to protect rights, property and safety.
• In connection with a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent or at your direction.

A list of the categories of providers we use is available on request.

8.1 We use cookies and similar technologies that are needed to run the site and forms, remember preferences, and measure how the site is used so we can improve it.

8.2 We do not currently use advertising cookies or sell data through cookies. If that changes, we will update this policy and offer a way to opt out.

8.3 You can block or delete cookies in your browser settings; some features may not work without them.

8.4 Global Privacy Control: we treat a Global Privacy Control signal from your browser as a valid request to opt out of sale, sharing and targeted advertising.

8.5 Some browsers send "Do Not Track" signals. Because there is no common standard for them, we respond to Global Privacy Control instead.

We keep personal information only as long as needed for the purposes in this policy: contact and prospect records while there is an active business relationship and for a reasonable period after; client account records for the life of the account plus the period needed for legal, tax and dispute purposes; communications records for as long as needed to provide service and meet legal duties; and website analytics in aggregated form. Client data in our platforms is kept and deleted according to our agreement with the client. We then delete or de-identify it.

We use administrative, technical and physical safeguards suited to the information, such as encryption in transit, access controls by role, two-step sign-in for our team, security reviews of our software releases, monitoring and vendor review. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you and regulators as the law requires.

11.1 Depending on where you live, and in many cases regardless, you can ask us to:

• confirm whether we process your personal information and give you access to it;
• correct inaccurate information;
• delete your information;
• give you a portable copy of your information;
• opt out of sale, targeted advertising and profiling that produces legal or similarly significant effects (we do not do these, but you may still ask);
• limit the use of sensitive personal information;
• tell you the categories of third parties we disclosed it to (where state law provides this right).

11.2 We honor these rights for all U.S. residents, including residents of states with comprehensive privacy laws such as California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia.

11.3 How to make a request: submit it through cbtdigi.com/contact (choose "Privacy request") or call (469) 904-0343. We will verify your identity using information we already hold and respond within 45 days, or tell you if we need up to 45 more days as the law allows.

11.4 Authorized agents may submit requests for you with proof of your permission, and we may still verify your identity.

11.5 Appeals: if we decline your request, you may appeal by replying to our decision or through the contact page. We will respond within the time the law requires (generally 45 to 60 days). If you are not satisfied, you may contact your state attorney general; Texas residents may contact the Texas Attorney General at texasattorneygeneral.gov.

11.6 We will not discriminate against you for exercising your rights.

11.7 If we process your information on behalf of a client (Section 2.2), we will forward your request to that client and help them respond.

In the past 12 months we have collected these categories of personal information: identifiers (name, email, phone, IP address); customer records (business and billing details); commercial information (services requested or purchased); internet or network activity; approximate geolocation; audio and electronic information (call recordings and messages, with notice); professional information (employer, job title); and, for clients' platform data, sensitive personal information such as account logins and payroll records. We collect them for the purposes in Section 4 and disclose them to the categories of recipients in Section 7. We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information for purposes that require a right to limit. California residents may also request information about disclosures for direct marketing purposes.

We are based in and store information in the United States. If you contact us from another country, your information is transferred to and processed in the U.S., where laws may differ from yours. Where the law of your country requires it (for example the EU or UK GDPR), we rely on legal bases such as performing a contract, our legitimate interests in operating and marketing our business, your consent, and legal obligations, and you may have rights to access, correct, delete, restrict, object to processing, portability and to complain to your data protection authority.

Our website and Services are for businesses and are not directed to children under 13 (or under 16 where a higher age applies). We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it. Clients who store information about minors in our platforms (for example a parent booking for a child) are responsible for obtaining any required parental consent.

Every marketing email includes an unsubscribe link and our business identification. You can unsubscribe at any time; we may still send service and account messages.

Our website may link to other sites and services. Their privacy practices are their own; please read their policies.

We may update this policy. We will post the new version with its effective date and, for material changes, notify clients by email or in the Services.

Questions or requests: cbtdigi.com/contact (choose "Privacy request") · (469) 904-0343.