Privacy Policy

1.Definitions and Scope

For this Privacy Policy:

Services: The CoolBiz® AI Chatbot, accessible via coolbiz.ai, and all related features and functionalities provided by CoolBiz Inc.

User: Any individual or entity accessing or using the Services, including during a free trial or under a paid subscription.

Content: All data, text, graphics, and other materials submitted, posted, or displayed through the Services.

Personal Data: Information relating to an identified or identifiable natural person, as defined by applicable privacy laws (e.g., GDPR, HIPAA).

Subscriber: An individual or entity with an active paid subscription to the Services.

Vertical Pro Tier: A subscription add-on tier enabling specialized functionality for Subscribers operating in regulated industries, as defined in the Terms of Service (Healthcare-Pro, Legal-Pro, Finance-Pro, and any future tier).

2.Data Collection and Processing

We collect various types of data to provide and improve our services:

Personal Information: When you subscribe to or use our Services, we collect names, email addresses, phone numbers, contact details, authentication credentials, billing information, payment details (processed securely through CoolBiz Inc's designated payment processor(s), which currently include Stripe and may from time to time include other processors, invoicing platforms, Automated Clearing House (ACH) providers, direct bank-transfer arrangements, or other lawful payment methods), and relevant business information, including for Agencies and their clients.

Vertical Pro Tier Information: Where a Subscriber activates a Vertical Pro Tier, the Subscriber may be required to provide additional compliance-related identifiers and attestations (for example, an attestation that the Subscriber has executed a Business Associate Agreement with each connected service provider, or professional license information). We collect, store, and process such information only as necessary to operate the activated Vertical Pro Tier and comply with applicable regulatory frameworks.

Technical Data: IP addresses, device information, browser agent strings, browser type and settings, operating system details, timestamps and access logs, performance analytics, and diagnostic data. We also collect technical data through website forms for security and spam detection.

Usage Data: Chat session logs, interaction history, feature utilization statistics, system performance metrics, error reports, debugging information, and communication logs, including chatbot responses and user input.

Collection Methods: Data is collected through direct user input during account registration, automated system logging, integration with third-party services, and similar tracking technologies, as well as user feedback or support interactions.

Cookies and Tracking Technologies: This platform does not use cookies or third-party tracking pixels.

3.Use of Data

We use the data collected for a variety of essential purposes to support the delivery and enhancement of our services:

Primary Purposes: Support, billing, and account updates; delivering, maintaining, and optimizing chatbot services; ensuring security and preventing fraud; improving the platform through performance analysis; providing customer support and resolving technical issues; routing AI requests to CoolBiz Inc's designated AI Sub-Processors via the Adaptive Rotation Layer (as described in Section 8); and communicating service updates and notifications.

Marketing and Communications: We may process personal data to send marketing communications, including promotional content, but only with user consent. Consent is obtained through explicit opt-in mechanisms such as registration, calendar bookings, and interactive prompts within the chatbot widget. Users can manage their marketing communication preferences at any time through their account settings or by contacting us directly. Data collected for marketing purposes is used to personalize content, measure campaign effectiveness, and provide relevant offers.

Processing Limitations: Data is processed solely for documented purposes; chatbot interactions are not used for external AI training without subscriber consent; no behavioral profiling or automated decision-making is performed; personal information is never sold. All data usage practices are aligned with applicable privacy regulations.

4.Data Security and Protection

Infrastructure Security: Our chatbot widget operates on enterprise-grade cloud infrastructure. We utilize a multi-layered security architecture with encryption applied both at rest and in transit. Our systems undergo regular security assessments and penetration testing, with continuous monitoring for potential threats. Access controls are strictly role-based, ensuring users only access data necessary for their roles. All activities are tracked through comprehensive audit logging to facilitate oversight and accountability.

Breach Response Protocol: In the event of a potential data breach, we initiate an immediate investigation to assess the scope and impact. Affected parties are notified without undue delay, and reports are submitted to regulatory authorities as required by law. All incidents are thoroughly documented for internal records and compliance purposes, followed by a post-incident analysis to enhance our security protocols.

5.Regulatory Compliance

CoolBiz Inc is built from the ground up for true global compliance. Our platform automatically applies the most stringent applicable data protection standards based on the user's location, covering numerous named regulatory frameworks across 195 countries.

International Standards

• •ISO 27001:2022 — Information Security Management (Annex A 8.11 data masking controls active; third-party certification in progress).
• •ISO 9001:2015 — Quality Management Systems (internal operational standard).
• •ISO 31000:2018 — Risk Management Framework (internal operational standard).
• •PCI DSS v4.0 — Payment Card Industry Data Security Standard (all payment card data masked in real time; no card data stored).
• •SOC 2 — Service Organization Control 2 (platform-level security controls).

United States — Federal

• •HIPAA — Health Insurance Portability and Accountability Act (requires signed BAA).
• •GLBA — Gramm-Leach-Bliley Act.
• •SOX — Sarbanes-Oxley Act.
• •FTC Guidelines — Affiliate marketing transparency and fair practices.

United States — State Privacy Laws

CoolBiz Inc supports compliance with the consumer-privacy frameworks of all U.S. states that have enacted comprehensive privacy legislation, including (without limitation): CCPA/CPRA (California), CalOPPA (California), VCDPA (Virginia), TDPSA (Texas), UCPA (Utah), FDBR (Florida), CPA (Colorado), CTDPA (Connecticut), OCPA (Oregon), MCDPA (Montana), ICDPA (Iowa), DPDPA (Delaware), NDPA (Nebraska), NJDPA (New Jersey), TIPA (Tennessee), MNDPA (Minnesota), NHPA (New Hampshire), KCDPA (Kentucky), RIDTPPA (Rhode Island), INCDPA (Indiana), and MODPA (Maryland). The applicable state framework is determined automatically based on the user's residency where detectable.

Europe and United Kingdom

• •GDPR — General Data Protection Regulation, covering all 27 EU member states (requires signed DPA).
• •Country-specific supplements covered under the DPA: Germany BDSG; France CNIL; Italy Personal Data Code; Netherlands UAVG; Spain LOPDGDD; Poland Personal Data Protection Act.
• •UK GDPR — UK General Data Protection Regulation (requires signed DPA).
• •DPA 2018 — Data Protection Act 2018 (covered under UK GDPR DPA).
• •Switzerland FADP — Federal Act on Data Protection (covered under DPA).
• •Norway — Norwegian Personal Data Act + GDPR (EEA member).

Other Jurisdictions

• •Canada — PIPEDA, Quebec Law 25, BC PIPA, AB PIPA.
• •Asia-Pacific — Japan APPI; South Korea PIPA; Singapore PDPA; Australia APP / Privacy Act 1988; New Zealand Privacy Act 2020.
• •Africa — South Africa POPIA.

All Remaining Countries — Default ISO-Aligned Coverage

For all countries not explicitly named above, CoolBiz Inc applies default ISO 27001:2022-aligned strictest-policy enforcement. When any user from any of the 195 UN-recognized countries interacts with a CoolBiz Inc-powered service, universal PII masking, sensitive data redaction, encryption in transit and at rest, and role-based access controls are applied automatically.

Compliance Agreements

Three categories of agreement govern CoolBiz Inc data processing relationships:

• •BAA (Business Associate Agreement) — required for HIPAA; digitally signed at account creation or at activation of the Healthcare-Pro Tier; one signature covers all Services on the account.
• •DPA (Data Processing Agreement) — required for GDPR, UK GDPR, and FADP; digitally signed at account creation or at activation of a Vertical Pro Tier requiring DPA coverage; includes EU Standard Contractual Clauses for cross-border transfers.
• •Terms of Service — all other frameworks worldwide are covered under CoolBiz Inc Terms of Service, accepted at account creation.

CoolBiz Inc does not support FERPA or COPPA compliance. Subscribers are prohibited from collecting or processing data from individuals under 18. Cross-border data transfers comply with applicable international transfer mechanisms, including Standard Contractual Clauses and data transfer impact assessments.

6.Data Retention and Deletion

We retain data for specified periods to meet operational and legal requirements:

• •Chat Data: Standard 30-day retention for chatbot conversation logs.
• •Compliance Data: Minimum 7-year retention for regulatory compliance.
• •Custom Retention Periods: Applied based on applicable legal and operational requirements.
• •Automated Archiving: Systems in place to manage data storage efficiently.
• •Audit Results (SOX Compliance): Retained for at least 7 years to meet regulatory standards.
• •Payment Data: Retained as required for financial reconciliation and regulatory compliance.

Deletion procedures include user-initiated requests, automated deletion after retention period expiry, secure wiping protocols, verification of deletion, and documentation of deletion for transparency.

7.User Rights, Controls, and Opt-Out Policies

Users have the right to:

• •Access their personal data.
• •Request corrections or modifications.
• •Delete their data, subject to legal and operational requirements.
• •Request data portability and restrict processing.

Explicit Consent: We require explicit consent for email and SMS communications. Users can opt out via provided links in communications or by contacting support. To exercise these rights, contact support@coolbiz.ai or CoolBiz Inc Headquarters, 1534 Purple Way, Redding, CA 96003.

8.Third-Party Integrations and AI Sub-Processors

CoolBiz® AI Chatbot integrates with third-party services to support platform functionality, ensure secure transactions, and enhance the functionality of our subscription-based chatbot platform.

Service Providers

Categories of service provider currently engaged include: cloud infrastructure providers; database providers; payment processing providers (currently including Stripe and any other processors or invoicing platforms CoolBiz Inc may engage from time to time); email communications providers; authentication services; tax calculation and compliance providers; calendar and scheduling integrations; digital signature services; CRM integrations (when configured by Subscribers); and artificial-intelligence service providers ("AI Sub-Processors"). The current list of AI Sub-Processors is maintained at coolbiz.ai/subprocessors and is incorporated by reference into the BAA and the DPA as applicable.

Adaptive Rotation Layer

CoolBiz Inc operates an Adaptive Rotation Layer that may route any given AI request to any AI Sub-Processor on the Sub-Processor List based on availability, response time, regional data-residency requirements, and other operational considerations. Subscribers operating under a Vertical Pro Tier may, at their option, pin AI request routing to a specific AI Sub-Processor where supported by their plan. The Adaptive Rotation Layer is designed to prevent service interruption by instantly switching to an alternative AI Sub-Processor in the event of timeout or unavailability, rather than retrying on the same provider.

Vector Storage

When a Subscriber connects a database or uploads unstructured content (such as documents, images, or PDFs), that content may be temporarily converted into vector representations and stored on CoolBiz Inc servers solely to enable AI-powered search and retrieval. Vector indexes are purged on a rolling 30-day basis or upon subscription termination, whichever comes first. The Subscriber's raw source data does not permanently reside on CoolBiz Inc servers.

LAN Bridge Agent

CoolBiz Inc offers an optional on-premise downloadable application that creates an outbound-only encrypted tunnel between a Subscriber's local legacy systems and the platform. Delta sync only — no full database dumps. Zero server storage beyond the active session. Read-only by default. AES-256 encryption at rest and TLS 1.2+ in transit.

Data Sharing Limitations

Data shared with third-party partners is limited to what is necessary for operational purposes. All such data is aggregated, anonymized, or shared only with user consent. We never sell personal information. We review our third-party partnerships regularly to maintain high data security, privacy, and compliance standards.

9.Currency and Exchange Rates

All charges to subscribers, all Agency revenue-share payouts, all Affiliate commission payouts, all refunds where issued, and all other monetary transactions involving CoolBiz Inc are denominated, billed, and paid in United States Dollars (USD), regardless of any default display currency selected by an Agency or a Subscriber. Approximate conversions to other currencies may be displayed using automated exchange-rate data obtained from third-party API providers; such conversions are estimates and are not guarantees of the amount any party will be charged or paid by any third-party financial institution.

10.Communications

Service Communications: Account notifications, security alerts, maintenance updates, compliance notifications, and service announcements. Certain notifications (such as security alerts and compliance-related updates) cannot be disabled.

Marketing Communications: Limited promotional content is sent with clear opt-out mechanisms, frequency controls to prevent spam, and content relevance requirements.

11.Audit Logs and Records

We maintain detailed audit logs of login attempts, user activity, data access, system modifications, failed breach attempts, system tests, load tests, and stress tests. Daily Audit Logs are retained for up to 1 year for operational and security purposes. Audit Results from formal audits are retained for at least 7 years to comply with the strictest regulatory requirements, including SOX compliance. Subscribers can request audit logs limited to their own account activity and data.

12.Age Restrictions

CoolBiz® AI Chatbot is intended for individuals aged 18 and older. Subscribers are responsible for ensuring their use of the Services complies with applicable laws governing minors, such as COPPA, and must not collect data from individuals under 18.

13.Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in our practices, new regulatory requirements, service improvements, legal obligations, and security enhancements. Significant changes will be communicated to users through in-app notifications (notification bell) and email. Each notification will include a summary of key changes, explaining what was updated and why.

14.Complete Agreement

This Privacy Policy, together with our Terms of Service and Refund Policy, each as in effect from time to time, constitutes the entire agreement between you and CoolBiz Inc regarding the use of our chatbot services at coolbiz.ai. This agreement supersedes all prior communications or understandings, whether written or oral. Failure to enforce any provision does not waive it or any other provision. This agreement binds the parties, their successors, and permitted assigns. Users must provide accurate information, comply with all policies, and use designated communication channels.

15.Contact Information

For questions or concerns about this Privacy Policy, contact our Privacy Officer at:

Email: support@coolbiz.ai

Address: CoolBiz Inc Headquarters, 1534 Purple Way, Redding, CA 96003

By using our services, you agree to this Privacy Policy.