Privacy Policy

In this policy, we lay out: what data we collect and why; how your data is handled; and your rights with respect to your data. We do not sell or share personal information (as defined by the California Consumer Privacy Act, as amended by the CPRA) and have not done so in the past 12 months.

Scope and Roles

This policy applies to all websites, apps, and services built and maintained by Big Spawn LLC (“Big Spawn”, “we”, “us”, or “our”). It covers information about site visitors, prospective customers, customers, and authorized users (collectively, “you”).

Controller vs. processor. When we provide services directly to you (e.g., our websites or apps), we generally act as a controller. If we process personal data on behalf of a customer (for example, where a customer stores its end-user data in our service), the customer is the “controller/business” and we are the “processor/service provider.” In that case, our processing is governed by the applicable services agreement and data processing addendum (DPA), not this policy. If you're an end user of a Big Spawn customer, please contact that organization for details about how your information is handled.

California residents: please see the “California Notice at Collection” section below.

What We Collect and Why

What We Don't Do

• We don't sell your personal information or use it for cross-context behavioral advertising.
• We don't use customer content to train generalized AI or machine-learning models. If we ever change these practices or introduce optional AI features, we'll update this policy and provide any required controls or opt-out mechanisms.

California Notice at Collection (CCPA/CPRA)

This section applies to California residents. It explains the categories of personal information we collect at or before collection, why we use it, and who we disclose it to. We do not “sell” or “share” personal information for cross-context behavioral advertising as those terms are defined by California law, and we have not done so in the past 12 months. If that changes, we will update this notice and provide a Do Not Sell or Share My Personal Information mechanism. Our Google Ads conversion measurement on bigspawn.com does not change this: it runs in Google's restricted data processing mode, under which Google acts as our service provider, and with personalized advertising and remarketing switched off.

Subprocessors

We use a small number of vetted third-party service providers (“subprocessors”) to operate, secure, and deliver the Services. Each subprocessor is contractually bound to process personal information only on our instructions and with appropriate safeguards. The current subprocessor list is below; a current, public version is also available at our /subprocessors page.

• Polar Software, Inc. Payment processing and merchant-of-record services. Receives: name, email, billing address, payment card last4. Legal-entity location: United States.
• Supabase Inc. Database, authentication, and storage. Receives: all user-submitted content. Legal-entity location: United States.
• Vercel Inc. Hosting, edge runtime, DNS resolution, and first-party web analytics. Receives: request logs, IP addresses, performance and analytics telemetry, DNS query metadata. Legal-entity location: United States.
• Resend Inc. Transactional email. Receives: email addresses, email content. Legal-entity location: United States.
• Google LLC. Google Workspace email hosting for our @bigspawn.com role mailboxes, and web-font delivery for published business-site templates. Receives: email sender and recipient addresses, message metadata, and message content sent to or from those mailboxes; site-visitor IP address and User-Agent when a published site renders a Google-hosted font. Legal-entity location: United States.

A provider's legal-entity location is not a guarantee that every processing operation or data copy remains in that country. International transfers are governed by our Data Processing Addendum.

We notify customers of material changes to the subprocessor list before they take effect, except where a change is required by law, security, or a Payment Processor obligation.

When We Access or Disclose Your Information

• Service providers: We use third-party service providers (see the Subprocessors section above for the current list) to help us operate, secure, and improve our websites and services. These providers are contractually bound to process personal information only on our instructions and with appropriate safeguards.
• At your direction: If you choose to connect third-party services or integrations, we disclose information as needed to enable those integrations.
• Legal requirements: We may disclose information if we receive a valid legal request (e.g., warrant, subpoena, court order). Where legally allowed, we’ll notify affected users before disclosure.
• Security, abuse, and rights protection: We may access, preserve, or disclose information when we reasonably believe it's necessary to prevent fraud, investigate abuse, or protect our users or the public.
• Aggregated/de-identified data: We may create aggregated or de-identified data for analytics and product improvement. We implement safeguards to prevent re-identification, do not attempt to re-identify individuals, and require recipients to do the same.
• Business transfers: If Big Spawn is involved in a merger, acquisition, or sale of assets, we’ll provide advance notice before personal information becomes subject to a different policy.

Your Rights

Subject to applicable law and verification, you may have rights to know/access, correct, erase, restrict or object to certain processing, opt-out of certain sharing, port your data, and not be discriminated against for exercising your rights. You may also have the right to appeal a denial and to lodge a complaint with a supervisory authority.

Many updates can be made in-product. For other requests, contact us at privacy@bigspawn.com. If you use an authorized agent, we may require proof of authority and verification of your identity.

How We Secure Your Data

We maintain reasonable administrative, technical, and organizational safeguards to protect personal information. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain personal data only as long as we have a documented purpose to do so. The table below lists the retention period applied to each category of data we hold. Where multiple categories overlap (for example, a billing record that also contains an email address), the longer applicable period applies for that record.

• Billing and payment records: 7 years from the transaction date, to satisfy U.S. federal and state tax-recordkeeping requirements (IRC § 6001 and parallel state statutes).
• Application logs: 13 months from the date the log line is written, then deleted or aggregated. This covers HTTP request logs, application error traces, and authentication-event logs.
• Cancellation survey responses: 24 months from the date of submission, used to identify churn drivers and improve the product, then deleted or de-identified.
• Marketing consents (email): kept until you unsubscribe; we then stop immediately and keep only a minimal, indefinite suppression record so we never contact you again.
• Account data (profile, business listings, generated content): until account deletion, then purged within 90 days as described in the Deletion section below.
• Account deletion logs: 24 months from the deletion event, the minimum retention required for consumer-request records under the CCPA/CPRA (11 CCR § 7101), after which the audit entry is purged.
• Advertising-measurement cookies (bigspawn.com): the Google Ads _gcl_ cookies expire 90 days after they are set, or sooner when you switch ad measurement off; we keep only aggregated campaign reports.

Where a legal hold, regulatory obligation, or unresolved dispute requires longer retention of a specific record, we keep that record only for the duration of the obligation and only for the purposes that justify the longer period.

Deletion of Content and Accounts

In many of our applications, we give you the option to trash content. Anything you trash while your account is active will be kept in an accessible trash can for about 25 days. After that time, the trashed content cannot be accessed via the application. The trashed content may remain on our active servers for another 30 days, and copies of the content may be held in backups for up to another 30 days after that. Altogether, any content trashed in your account should be purged from our systems (including backups) within 90 days.

If you choose to delete your account, your content will become immediately inaccessible and should be purged from our systems in full within 90 days. Cancelling a subscription, by itself, does not delete your content. It is preserved so you can resubscribe. Certain records (e.g., invoices, tax records, or security logs) may be retained where we have legal or legitimate business reasons.

Location of Site and Data

Our products and other web properties are primarily housed in the United States. If you are located in the European Union, UK, or elsewhere outside of the United States, please be aware that any information you provide to us will be transferred to and stored in the United States. By using our websites or services and/or providing us with your personal information, you consent to this transfer.

EU/UK Data Transfers

Where we transfer personal data from the EU/EEA or UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards with our service providers. If Big Spawn acts as a processor, our DPA (including SCCs, where applicable) is available to customers upon request.

Changes and Contact

We may update this policy to reflect changes in law or our practices. If we make material changes, we'll update the date at the top and, where appropriate, provide additional notice.

Questions, comments, or requests? Email privacy@bigspawn.com.