Privacy Policy

1. At a Glance

2. What We Collect

We collect data in three categories: data you give us, data we collect automatically, and data from third parties.

2.1 Data You Provide

• Account data: email, name, password hash, role.
• Lead intake forms: your email, name, company, role, niche, and free-text answers to matchmaker or founder questions.
• Tool submissions: domain, tool name, category, pricing, founder email, description, screenshots, and any other fields you fill in.
• Payment metadata: Stripe customer ID, last-4 digits of the card, billing address (handled primarily by Stripe; we do not store full card numbers).
• Support emails: anything you send to admin@bookaistudio.com or dmca@bookaistudio.com.

2.2 Data We Collect Automatically

• Event data: page views, tool clicks, search queries, button clicks. Used for analytics and to measure listing performance.
• Device & browser data: IP address, user agent, referrer, country (derived from IP), screen size.
• Cookies and similar technologies (see §6).

2.3 Data From Third Parties

• Public directory data (e.g., when a tool lists itself on Product Hunt, GitHub, or its own site).
• Payment confirmation from Stripe.
• Social profile data when you log in with OAuth (only if/when we offer that option).

3. How We Use Data

We use personal data for the following purposes:

• Provide the Service: display directory entries, generate recommendations, store submissions.
• Process transactions: charge for paid listings, issue refunds, send receipts.
• Communicate: send transactional emails (account, billing, support) and, where you opted in, marketing emails about new tools, niches, and events.
• Editorial review: verify founder submissions, check for spam and fraud, score listings.
• Improve the Service: analyze aggregated usage data to fix bugs, design new features, and prevent abuse.
• Legal compliance: respond to lawful requests, enforce our Terms, and protect our rights.

We do not sell personal data. We do not use your content to train third-party AI models.

4. Legal Bases (EEA / UK Users)

If you are in the European Economic Area, UK, or Switzerland, our legal bases under GDPR are:

• Contract: to provide the Service you signed up for.
• Legitimate interest: to operate, secure, and improve the Service, prevent fraud, and analyze aggregated usage.
• Consent: for marketing emails and non-essential cookies.
• Legal obligation: to comply with applicable laws.

5. Sharing & Sub-Processors

We do not sell your data. We share data only with carefully selected sub-processors that help us run the Service, and only the minimum needed:

We may also disclose data to:

• Law enforcement, courts, or regulators when legally required.
• A buyer or successor in a merger, acquisition, or asset sale (with notice to you).
• Any party with your consent.

6. Cookies & Similar Technologies

We use cookies and local storage for the following purposes:

• Strictly necessary: authentication, fraud prevention, load balancing.
• Functional: remembering your filter preferences and theme.
• Analytics: measuring traffic and page performance.
• Marketing: only where you have opted in (e.g., a retargeting pixel after explicit consent).

You can manage cookie preferences via your browser settings or our cookie banner. Disabling some cookies may affect functionality.

We honor Global Privacy Control (GPC) and similar opt-out signals as valid opt-outs for sale/sharing where applicable.

7. Data Retention

We keep personal data only as long as needed for the purposes described in this policy, unless a longer retention period is required by law. Typical retention windows:

• Account data: while the account is active + 30 days after deletion request.
• Lead form submissions: 24 months for analytics; longer if you become a customer.
• Payment records: 7 years (tax/accounting obligations).
• Server logs: 90 days.
• Backups: up to 12 months (encrypted at rest).

8. International Data Transfers

We are based in the United States and use sub-processors in the US and EEA. When we transfer personal data from the EEA/UK/Switzerland to a country with different data-protection laws, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms. You can request a copy of the relevant safeguards by emailing admin@bookaistudio.com.

9. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (right to be forgotten), subject to legal retention obligations.
• Export your data in a machine-readable format (data portability).
• Restrict or object to certain processing, including marketing.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email admin@bookaistudio.com from the address on file. We respond within 30 days (45 days for complex requests, with notice).

For California residents: the CCPA/CPRA grants additional rights, including the right to know, delete, correct, and limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising.

10. Security

We use administrative, technical, and physical safeguards designed to protect your data, including TLS encryption in transit, encryption at rest for secrets and backups, role-based access control, audit logging, and incident-response procedures.

No system is 100% secure. If we become aware of a personal-data breach affecting you, we will notify you and the relevant authorities in accordance with applicable law.

11. Children's Privacy

The Service is not directed to children under 16 (or such higher age as required by your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact admin@bookaistudio.com and we will delete it promptly.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by email or in-app notice at least 30 days in advance. The "Effective date" at the top reflects the most recent update.

13. Contact Us

Book AI Studio (DBA of BrightSpan Holdings LLC)
Email: admin@bookaistudio.com
Privacy / data requests: admin@bookaistudio.com
Phone: