Privacy Policy

Information you provide directly

• Contact form submissions: name, email address, phone number, and business name submitted through our website contact form.
• Client portal account: email address and password used to log in to your client dashboard.
• Business information: business name, industry, location, key services, target audience, and brand details provided during onboarding — used to produce your content calendar.
• Payment information: billing details entered during checkout. Payments are processed by Stripe; we do not store card numbers on our servers.
• Files and images: images or documents uploaded during content production, stored on Amazon Web Services S3.

Information collected automatically

• Usage data: pages visited, time spent, and navigation actions on our website, collected through standard server logs.
• Session data: authentication tokens used to keep you logged in to the client portal.
• Device information: browser type, operating system, and IP address, collected for security and debugging purposes.

Information collected on behalf of clients

When we provide SMS or email marketing services for a business client, we may handle personal information belonging to that client's own customers — including phone numbers and email addresses. In those cases, we act as a service provider for our client, who is responsible for ensuring they have appropriate consent from their customers.

• To provide our services: generating content calendars, managing client portals, and delivering monthly marketing packages.
• To communicate with you: responding to inquiries, sending project updates, and notifying you when content is ready for approval.
• To process payments: collecting and verifying billing information through our payment processor.
• To improve our platform: diagnosing technical issues, monitoring performance, and refining our tools.
• To comply with legal obligations: retaining records as required by applicable law.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

As part of our services, we send text messages and emails on behalf of our business clients to their opted-in customers. The following applies to SMS communications:

• Phone numbers are collected only from individuals who have provided explicit consent to receive text messages from the specific business sending them.
• Phone numbers are never sold, shared, or used for purposes other than delivering communications on behalf of the specific client who collected them.
• All SMS campaigns are sent through Twilio. Message delivery is subject to carrier approval and Twilio's Acceptable Use Policy.
• Email campaigns are delivered through Mailchimp. Each email includes an unsubscribe link.
• Opt-out requests (STOP, UNSUBSCRIBE, or equivalent) are honored immediately and permanently.

If you are a consumer who received a text or email from a business that uses Built by Billy's services and you wish to opt out or have your data removed, contact the originating business directly or email us at billy@bbbilly.com with the business name and your contact information.

We publish social media content on behalf of clients to platforms including LinkedIn, Facebook, Instagram, X (Twitter), TikTok, YouTube, and Reddit. To do this, clients authorize our platform to act on behalf of their business accounts via each platform's official OAuth authentication flow.

• We access only the permissions necessary to publish content — we do not access private messages, follower data, or advertising account financial information.
• Authorization can be revoked at any time through each platform's connected-apps settings.
• We use Postiz, a third-party scheduling platform, to manage post queuing and delivery. Content published through Postiz is subject to Postiz's own terms and privacy policy.
• We do not scrape, harvest, or resell any data obtained through social media platform APIs.

We share information with the following service providers only to the extent necessary to deliver our services:

• Stripe — payment processing.
• Amazon Web Services (S3 / CloudFront) — file storage and content delivery.
• Twilio — SMS messaging.
• Mailchimp (Intuit) — email marketing delivery.
• Postiz — social media scheduling and publishing.
• Anthropic — AI content generation (post captions, email copy). Prompts include business context but never personally identifiable subscriber information.
• Vercel — website and portal hosting.

All providers are contractually required to protect your information and use it only for the services they provide to us.

• Client account data is retained for the duration of the client relationship and for up to 3 years after account closure, or as required by law.
• Contact form submissions are retained for up to 2 years for follow-up and business record purposes.
• Generated content (posts, emails, SMS drafts) is retained indefinitely as part of your content history, unless you request deletion.
• Payment records are retained as required by applicable tax and accounting laws (typically 7 years).
• Subscriber phone numbers and email addresses managed on behalf of clients are deleted within 30 days of a client's account closure or upon request.

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information, subject to retention requirements described above.
• Opt out of SMS and email marketing at any time (reply STOP or use the unsubscribe link).
• Revoke social media authorization at any time through your platform account settings.
• Data portability — receive a copy of your data in a commonly used format.

To exercise any of these rights, contact us at billy@bbbilly.com. We will respond within 30 days.

We implement industry-standard measures to protect your information: HTTPS encryption in transit, encrypted password storage, access controls, and regular security reviews. No method of transmission or storage is 100% secure. If we become aware of a breach that affects your data, we will notify you in accordance with applicable law.

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated to active clients by email. Continued use of our services after a change is posted constitutes acceptance of the updated policy.

For questions, data requests, or concerns about this policy: