Privacy Policy

This Privacy Policy ("Policy") applies to https://bellows.app, and Bellows LLC ("Company") and governs data collection and usage. For the purposes of this Policy, unless otherwise noted, all references to the Company include https://bellows.app. The Company website is a business-to-business (B2B) software-as-a-service (SaaS) platform providing subscription-based lead generation services to small businesses. By using the Company website, you consent to the data practices described in this statement.

This Policy has two parts. Sections I–XIV describe how we handle data about you, our subscribers. The Lead-Data Supplement (Sections A–H) describes how we handle the third-party data that makes up our lead product.

I. Collection of Your Personal Information

In order to better provide you with products and services offered, the Company may collect personally identifiable information, such as your:

• First and last name
• Mailing address
• Email address
• Phone number
• Employer
• Job title
• IP address, device and browser information (cookies/analytics), service usage data (lead delivery history, search queries, login activity), business location and service area, license numbers and professional credentials (where applicable)

If you purchase the Company's products and services, we collect billing and credit card information. This information is used to complete the purchase transaction.

We do not collect any personal information about you unless you voluntarily provide it to us. However, you may be required to provide certain personal information to us when you elect to use certain products or services. These may include: (a) registering for an account; (b) signing up for special offers from selected third parties; (c) sending us an email message; (d) submitting your credit card or other payment information when ordering and purchasing products and services. To wit, we will use your information for, but not limited to, communicating with you in relation to services and/or products you have requested from us. We may also gather additional personal or non-personal information in the future.

II. Use of Your Personal Information

The Company collects and uses your personal information to provide and operate the Bellows software-as-a-service platform; to authenticate user accounts and manage subscriptions; to deliver lead data and personalized service recommendations to customers; to process payments through our payment processor; to communicate with users regarding service updates, account information, and customer support; to send marketing communications about Bellows products and features (with the user's consent and ability to opt out); to analyze usage patterns to improve service quality, accuracy of lead matching, and product features; to comply with legal obligations, prevent fraud and abuse, enforce our terms of service, and protect the rights and safety of Bellows, our customers, and third parties; in any other way we may describe when you provide the information; and for any other purpose with your consent. The Company may also use your personally identifiable information to inform you of other products or services available from the Company and its affiliates.

III. Sharing Information with Third Parties

The Company does not sell, rent, or lease its customer lists to third parties. The Company does not sell biometric data to third parties. (For how we treat the third-party data that makes up our lead product, see the Lead-Data Supplement, Sections A–H.)

The Company may share data with trusted partners to help perform statistical analysis, send you email or postal mail, provide customer support, or arrange for deliveries. All such third parties are prohibited from using your personal information except to provide these services to the Company, and they are required to maintain the confidentiality of your information.

The Company may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Company or the site; (b) protect and defend the rights or property of the Company; and/or (c) act under exigent circumstances to protect the personal safety of users of the Company, or the public.

IV. Opt-Out of Personal Information to Third Parties

You have the right under the California Consumer Privacy Act of 2018 (CCPA) and certain other privacy and data protection laws, as applicable, to opt out of the sale or sharing of your personal information. If you exercise your right to opt out of the sale or disclosure of your personal information, we will refrain from selling or disclosing your personal information, unless you subsequently provide express authorization for the sale or disclosure of your personal information. To opt out of the sale or disclosure of your personal information, email privacy@bellows.app. (If you appear in our lead data rather than being a subscriber, see Lead-Data Supplement Section D for your rights and how to exercise them.)

V. Tracking User Behavior

The Company may keep track of the websites and pages our users visit within the Company, in order to determine which of the Company's services are the most popular. This data is used to deliver customized content within the Company to customers whose behavior indicates that they are interested in a particular subject area.

VI. Automatically Collected Information

The Company may automatically collect information about your computer hardware and software. This information can include your IP address, browser type, domain names, access times, and referring website addresses. This information is used for the operation of the service, to maintain the quality of the service, and to provide general statistics regarding the use of the Company website.

VII. Security of Your Personal Information

The Company secures your personal information from unauthorized access, use, or disclosure. The Company uses the following methods for this purpose:

• SSL/TLS Protocol
• Bellows uses Cloudflare's DDoS mitigation, web application firewall, and bot protection services. Access to personal information is limited to authorized personnel on a need-to-know basis, secured by multi-factor authentication. We use industry-standard third-party providers (Cloudflare, Stripe, and email delivery services) that maintain their own security certifications. All data transmitted between users and our website is encrypted using TLS.

When personal information (such as a credit card number) is transmitted to other websites, it is protected through the use of encryption, such as the Transport Layer Security (TLS) protocol.

We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100 percent secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet that are beyond our control; and (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through this site cannot be guaranteed.

VIII. Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:

• Delete your personal information from our records; and
• Direct any service providers to delete your personal information from their records.

Please note that we may not be able to comply with requests to delete your personal information if it is necessary to:

• Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, and provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity;
• Debug to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act;
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
• Comply with an existing legal obligation; or
• Otherwise use your personal information internally in a lawful manner that is compatible with the context in which you provided the information.

IX. Data Security and Breach Notification

The Company maintains reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, acquisition, disclosure, or use. In the event of a security incident involving personal information, the Company will promptly investigate the incident and provide notice to affected individuals and, where required, to applicable regulatory authorities in accordance with applicable law. The Company will provide any required notice in the manner and within the timeframes prescribed by applicable law.

X. Children Under 13

The Company does not knowingly collect personally identifiable information from children under the age of thirteen. If you are under the age of 13, you must ask your parent or guardian for permission to use this platform.

XI. Email Communications

From time to time, the Company may contact you via email for the purpose of providing announcements, promotional offers, alerts, confirmations, surveys, and/or other general communication. In order to improve our services, we may receive a notification when you open an email from the Company or click on a link therein.

If you would like to stop receiving marketing or promotional communications via email from the Company, you may opt out of such communications by clicking the unsubscribe link located at the bottom of any marketing email, or by emailing privacy@bellows.app with the subject line "Unsubscribe".

XII. External Data Storage Sites

We may store your data on servers provided by third-party hosting vendors with whom we have contracted.

XIII. Changes to This Statement

The Company reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you. You may receive a notice by sending an email to the primary email address specified in your account, by placing a prominent notice on our website, and/or by updating any privacy information. Your continued use of the website and/or services available after such modifications will constitute your: (a) acknowledgment of the modification of this Policy; and (b) agreement to abide and be bound by this modified Policy.

XIV. Contact Information

The Company welcomes your questions or comments regarding this Statement of Privacy. If you believe that the Company has not adhered to this Statement, please contact the Company at:

Bellows LLC 522 W Riverside Ave Ste N Spokane, Washington 99201

Privacy rights-requests: privacy@bellows.app Support and billing: support@bellows.app General inquiries: hello@bellows.app

LEAD-DATA SUPPLEMENT (Sections A–H)

The sections above describe data about our subscribers. This Supplement describes the third-party data — the leads (individuals and businesses whose public-records data we compile and offer). Because much of that data comes from public government records, data-broker obligations are a fact-specific question deferred to counsel once revenue justifies it (see Section C).

A. Two kinds of data, two roles

Bellows processes personal information in two capacities: (1) as a service provider to you (the subscriber) — your account, billing, and usage data, per Sections I–XIV; and (2) as a compiler of business-development data (the "Lead Data") — information about third parties (permit holders, licensees, business filers, property owners, and similar), drawn from public records and third-party sources, which we organize and make available to subscribers. This Supplement describes that second role.

B. Sources of Lead Data

Lead Data is compiled from publicly available sources: primarily government and regulatory records (e.g., building permits, professional and business licenses, corporate filings, property/assessor records) and open-data sources (e.g., government open-data portals such as Socrata/ArcGIS, and OpenStreetMap). Contact fields (such as a business phone or email) come from these same public/open sources where present; Bellows does not purchase or append consumer contact data from proprietary data brokers or skip-tracing vendors. Bellows does not originate or independently verify these records. Some source records carry their own legal use restrictions, which subscribers must honor (see the Terms of Service, Part II). Bellows does not knowingly include data from state motor-vehicle/driver records (DPPA-covered) in the Lead Data.

C. Data-broker status (deferred to counsel)

Some state laws (e.g., the California Delete Act / CCPA and the Vermont / Texas / Oregon data-broker statutes) regulate businesses that sell third-party personal information. Bellows' Lead Data is drawn from publicly available sources — primarily government/regulatory records (to which the CCPA/CPRA "publicly available information" exemption most directly applies) and other open-data sources — and Bellows does not purchase or append consumer contact data from proprietary brokers or skip-tracing vendors. Whether any part of the product nonetheless triggers formal data-broker registration in a given state is a fact-specific question Bellows will resolve with legal counsel once revenue justifies it; registration (where it applies) is inexpensive and can be completed at that time. This is a deliberate, disclosed risk decision for an early-stage business built on publicly-available data. The exemption applies most cleanly to government-record fields; where a contact field derives from an open-data source that is public but not a government record, Bellows does not represent that the exemption necessarily applies — counsel will confirm the scope.

D. Rights of individuals who appear in the Lead Data

If you are a person or business who appears in the Lead Data (not a subscriber), you may have the right to access, correct, delete, or opt out of the "sale" or "sharing" of your personal information under the CCPA/CPRA and comparable laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and others). To exercise these rights, email privacy@bellows.app with enough detail to identify your record (an opt-out web form may be added later). We verify and respond within the time the applicable law requires, subject to lawful exceptions, and we honor an opt-out preference signal such as Global Privacy Control (GPC) where required. We maintain an internal suppression list so that an individual who opts out or requests deletion stays excluded from future compilations — not merely removed once — and we exclude opted-out individuals on an ongoing basis.

E. "Sale" / "Sharing" of personal information — precise statement

The statement in Section III that Bellows does not sell or rent its customer lists remains true for subscriber data. However, Bellows' Lead Data product may constitute a "sale" or "sharing" of third-party personal information under the CCPA/CPRA's broad definitions. Bellows discloses this and provides the opt-out in Section D. Bellows does not sell the personal information of anyone who has opted out, nor (knowingly) of minors.

F. Retention

Bellows retains subscriber data while the account is active and as needed for legal, tax, and security obligations. Bellows retains Lead Data while it remains available in the underlying public sources and useful to the service, and removes or suppresses records upon a valid deletion/opt-out request or when a source indicates removal.

G. Automated processing, AI, and sensitive-data exclusions

Bellows uses automated systems and AI/ML models to discover, match, and organize Lead Data. This processing organizes records by attributes (e.g., industry, location). It does not make legal, credit, employment, or other eligibility decisions about any individual, and subscribers are barred from such uses (FCRA prohibited uses; see the Terms of Service, Part II). Bellows does not compile consumer health data and does not intend the Lead Data to include "consumer health data" as defined by Washington's My Health My Data Act; the "Healthcare Providers" category consists of business/ professional records about providers (e.g., licenses, practice addresses), not health information about patients or consumers.

H. Privacy contact

Privacy rights-requests go to privacy@bellows.app; support and billing to support@bellows.app; general inquiries to hello@bellows.app.