Brico, Inc. (“Brico,” "we," "us," or "our") helps companies apply for, maintain, and renew licenses. Your privacy is paramount to us, and this Privacy Policy (“Policy”) explains how and why we may collect, use, disclose, and safeguard your information. This Policy applies to information we collect when you use our website, services, and other online products and services (collectively, the "Services") or when you otherwise interact with us.

1. Information We Collect

We collect information about you in various ways when you use our Services. If you are using our Services on behalf of a company, we may collect personal information about you and other individuals as shared by your company. Information is collected in accordance with license application and management, but largely depends on the context of your or your company’s interactions with us and the Services.

Personal information we collect may include the following:

• names
• phone numbers
• email addresses
• mailing addresses
• job titles
• usernames
• passwords
• contact preferences
• contact or authentication data
• billing addresses
• employment information
• financial information

When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• financial data
• information revealing race or ethnic origin
• student data
• social security numbers or other government identifiers

We may provide you with the option to register with us using your existing social media account details, like your Google or Microsoft account. Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name and email address. We will use the information we receive only for the purposes that are described in this Policy or that are otherwise made clear to you on the relevant Services.

Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and Usage Data: Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports, and hardware settings).

In order to enhance our ability to provide the Services to you and update our records, we may obtain information about you from other sources, such as government agencies, data providers, social media platforms, and from other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, Internet Protocol (IP) addresses, social media profiles, social media URLs, and custom profiles, for purposes of providing the Services. Any personal information that we collect from your social media account depends on your social media account's privacy settings.

2. How We Process Your Information

Your information is used to provide, maintain and improve our Services, including to:

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• Facilitating account creation and authentication for user account management.
• File for new applications, maintain existing licenses and prepare you for future audits.
• Processing feedback to improve the quality of the Services.
• Send technical notices, updates, security alerts, and support and administrative messages.
• Respond to your comments, questions, and requests, and provide customer service.
• Communicate about products, services, offers, promotions, and events offered by Brico and others, and provide news and information we think will be of interest to you.
• Identify, monitor and analyze trends, usage, and activities in connection with our Services.
• To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

3. Sharing of Information

We may share information in specific situations described in this section and/or with the following categories of third parties:

• Vendors, Consultants, and Other Third-Party Service Providers: We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We may share personal information with vendors such as surety bond providers, registered agent services, and other professional services connected to the Services with your consent or at your discretion.
• Government Agencies: We may share your data with various government agencies while submitting licensing compliance materials on your behalf. We may also respond to requests for information if we believe disclosure is in accordance with, or required by, any applicable law, regulation, or legal process.
• Analytics Tracking Providers: We may share your information with Plausible Analytics to track and analyze the use of the Services. For more information on the privacy practices of Plausible, please visit the Plausible Analytics Privacy & Terms page. Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions. We may use cookies or similar tracking technologies to access or store information.

4. Storage of Information

We will only keep your personal information for as long as it is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

5. Data Security

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. By accessing the Services, you agree that you shall only access the Services within a secure environment.

6. Minors

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@brico.ai.

7. Your Privacy Rights

Brico is based in California and the information we collect is governed by U.S. law. If you are accessing our Services from outside the U.S., please be aware that your information may be transferred to, stored, and processed in the U.S.

Depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the last section of this Policy. Please note that your withdrawal of consent may affect your ability to use the Service as intended.

Exercising your right to withdraw your consent does not affect the lawfulness of the processing before withdrawal nor will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

If you would at any time like to review or change the information in your account or terminate your account, you can contact us with the contact information provided to create your account at support@brico.ai. If you wish to terminate your account, we will deactivate or delete your account and information from our active databases if able to do so in accordance with applicable law. Please note that account termination may interfere with your company’s ability to properly use the Services. We reserve the right to retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

8. California Residents

This section applies only to California residents. Under the California Consumer Privacy Act (CCPA) as amended, you have the rights listed below. Under the CCPA, "residents" are defined as:

1. Every individual who is in the State of California for other than a temporary or transitory purpose; and
2. Every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose.

All other individuals are defined as "non-residents." If this definition of "resident" (herein “California residents”) applies to you, this section is applicable to you.

Your rights with respect to your personal data

California residents have the following rights:

1. The right to know: Depending on the circumstances, you have a right to know whether we collect and use your personal information; the categories of personal information that we collect; the purposes for which the collected personal information is used; whether we sell or share personal information to third parties; the categories of personal information that we sold, shared, or disclosed for a business purpose; the categories of third parties to whom the personal information was sold, shared, or disclosed for a business purpose; the business or commercial purpose for collecting, selling, or sharing personal information; and the specific pieces of personal information we collected about you. You can make a request to know up to twice a year, free of charge.

   In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to reidentify individual data to verify a consumer request.

   1. The right to request deletion of the data: You can ask for the deletion of your personal information. If you ask us to delete your personal information, we will respect your request and delete your personal information, subject to certain exceptions provided by law, including without limitation the exercise by another consumer of his or her right to free speech, our compliance requirements resulting from a legal obligation, or any processing that may be required to protect against illegal activities.
      
   2. The right to opt-out of the sale or sharing of their personal information: You may request that we stop selling or sharing your personal information (“opt-out”). Note that sharing refers specifically to sharing for cross-context behavioral advertising, which is the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s online activity across numerous websites. With some exceptions, businesses cannot sell or share your personal information after they receive your opt-out request unless you later provide authorization allowing them to do so again. Businesses must wait at least 12 months before asking you to opt back into the sale or sharing of your personal information.
      
   3. The right to limit use and disclosure of sensitive personal information: You have the right to direct us to limit our use of your sensitive personal information to the use that is necessary to perform the Services. Sensitive personal information includes any of the following:
      1. social security information, drivers' licenses, state ID cards, passport numbers
      2. account login information
      3. financial account information
      4. precise geolocation
      5. racial or ethnic origin, religious or philosophical beliefs, union membership
      6. the contents of email and text, unless the business is the intended recipient of the communication

         Please note that the Services may require that you provide sensitive personal information, as required by applicable law.
         

         1. Right to non-discrimination: If you exercise your privacy rights under applicable California law, we will not discriminate against you.
            1. Right to correct: You may request a correction of your personal data if it is incorrect or no longer relevant

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

Category	Examples	Collected?
Identifiers	Contact details, legal name, alias, mailing address, mobile phone number, IP address, email address	YES
Personal information as defined under California law	Name, contact information, education, employment history, financial information	YES
Protected classification characteristics under federal or state law	Gender, race, date of birth	YES
Commercial information	Transaction information, purchase history	NO
Biometric information	Voiceprints, retina scans	NO
Internet or other similar network activity	Interactions with our website and applications	YES
Geolocation data	Device location	YES
Audio, electronic, visual, olfactory, thermal or similar information	Video or call recordings in connection with our business activities	YES
Professional or employment-related information	Work history	YES
Education information	Student records	YES
Inferences drawn from collected personal information	Inferences drawn from any personal information listed above to create a profile about an individual’s personal characteristics or preferences	NO
Sensitive personal information	Citizenship or immigration status, passport numbers, social security numbers	YES

We will use and retain the collected personal information as needed to provide the services or for 7 years after the company associated with the individual has terminated their contract with Brico. Please note that sensitive personal information may be used, or disclosed to a service provider or contractor, for additional, specified purposes. You have the right to limit the use or disclosure of your sensitive personal information.

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

How do we use and share your personal information?

Learn about how we use your personal information in the section

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section

Please note that the use of your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration, is not considered to be "selling" of your personal information.

Under the CCPA’s definitions of selling or sharing, we have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Identifiers
• Characteristics of protected classifications under state or federal law
• Geolocation data
• Professional or employment-related information
• Education information
• Sensitive personal information

Shine the Light Law

California Civil Code Section 1798.83 permits California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with the Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).

Processing of data privacy rights requests for California residents

Upon receiving your request to exercise a data privacy right, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it

with information you may have previously provided us. We may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g., phone or email) that

you have previously provided to us. We may also use other verification methods as necessary depending on the circumstances.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.

You may designate an authorized agent to make a request under the CCPA on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with the CCPA.

To exercise these rights, you can contact us by email at support@brico.ai, or by referring to the contact details at the bottom of this Policy.

9. Changes to this Policy

We may change this Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Policy and, in some cases, we may provide you with additional notice (such as adding a statement to our homepage or sending you a notification).

10. Contact Us

If you have questions or comments about this Policy, you may email us at support@brico.ai.