Basin Automated, LLC Privacy Policy

1. Information We Collect

The information we collect depends on how you interact with Basin Automated.

A. Information You Provide Directly

You may provide information when you request services, contact us, create or use a client account, submit an update request, upload files, communicate with us, or otherwise interact with Basin Automated.

Depending on the service or interaction, this may include:

• name;
• business or organization name;
• email address;
• telephone number;
• business contact information;
• information about your business;
• information about the services or project you are requesting;
• information included in messages, inquiries, project descriptions, or support requests;
• website content and requested website changes;
• photographs, documents, logos, graphics, and other uploaded files;
• information relating to a project, website, portal, or account;
• account and authentication information necessary to provide access to the client portal;
• billing and transaction information;
• information you provide when referring another business to Basin Automated;
• communications and correspondence with Basin Automated; and
• other information you voluntarily provide to us.

Do not submit Social Security numbers, passwords, payment-card numbers, medical information, or other highly sensitive personal information through a general inquiry, update request, email, or file upload unless Basin Automated specifically requests it through an appropriate process.

B. Client Portal Information

Basin Automated's client portal may allow clients to:

• request online checkups;
• request website updates;
• upload files and photographs;
• submit project-related information;
• view project information and status;
• communicate with Basin Automated;
• access documents;
• view billing information or invoices;
• make or manage payments through available payment services;
• submit referrals;
• receive notifications; and
• manage account information.

Information submitted through these features may be associated with the client's account, project, organization, or service relationship.

C. Information Collected Automatically

When you access our website, portal, or online services, certain information may be collected automatically by our systems or by service providers operating technology on our behalf.

Depending on the technology enabled on a particular page or service, this may include:

• IP address;
• browser type and version;
• operating system;
• device information;
• approximate location derived from technical information;
• pages or features accessed;
• dates and times of access;
• referring and exit pages;
• security and authentication events;
• error and diagnostic information;
• interaction and usage information; and
• similar technical or log information.

We use this information for purposes such as operating the website and portal, maintaining security, troubleshooting, preventing abuse, understanding usage, and improving our services.

2. How We Use Personal Information

Basin Automated may use personal information for the following business purposes:

Providing Services

We use information to:

• respond to inquiries;
• evaluate project requests;
• prepare proposals, estimates, or scopes of work;
• communicate with clients;
• build, maintain, or update websites and digital systems;
• provide local SEO and digital presence services;
• provide automation and portal services;
• process website update requests;
• deliver requested files, documents, reports, or other work;
• provide customer support; and
• administer client accounts and projects.

Client and Account Administration

We may use information to:

• create and maintain client accounts;
• authenticate authorized users;
• maintain project records;
• manage permissions;
• track requests and project status;
• maintain business records;
• communicate about invoices and payments; and
• administer the client relationship.

Billing and Accounting

We may process information necessary to prepare invoices, receive payments, reconcile transactions, maintain accounting records, and satisfy tax and financial-recordkeeping obligations.

Payment-card information may be collected and processed directly by third-party payment providers rather than stored by Basin Automated. Basin Automated does not intentionally store complete payment-card numbers or security codes in its ordinary business systems.

Communications

We may use contact information to communicate about:

• project inquiries;
• proposals and estimates;
• active services;
• website or portal requests;
• account activity;
• invoices and payments;
• service-related notices;
• security matters;
• administrative matters; and
• other communications reasonably related to the business relationship.

If Basin Automated sends optional marketing communications, you may opt out using the instructions provided in those communications.

Security and Fraud Prevention

We may use information to:

• authenticate accounts;
• detect unauthorized access;
• investigate suspicious activity;
• prevent fraud, abuse, or misuse;
• protect our systems and users;
• maintain system integrity; and
• enforce our agreements and policies.

Legal and Compliance Purposes

We may use or disclose information when reasonably necessary to:

• comply with applicable law;
• respond to valid legal process;
• cooperate with governmental authorities;
• enforce contractual rights;
• establish, exercise, or defend legal claims; or
• protect the rights, property, safety, or security of Basin Automated, our clients, users, or others.

3. Client Data and Information We Process on a Client's Behalf

Basin Automated sometimes provides services that involve handling information supplied by a business client.

For example, a client may provide customer contact information, project information, order information, uploaded files, lead information, website content, or other business data for use in a website, automation, portal, database, or workflow.

When Basin Automated processes personal information on behalf of a client, Basin Automated generally acts according to the client's instructions and the applicable service agreement, statement of work, or data-processing agreement.

The client remains responsible for determining:

• what information it collects;
• whether it has a lawful basis to collect and use that information;
• what notices it provides to its customers;
• what consents it obtains when required;
• whether its customer-facing practices comply with applicable law;
• whether information provided to Basin Automated may lawfully be processed for the requested service; and
• the accuracy and legality of instructions and materials supplied to Basin Automated.

Basin Automated does not treat this client-controlled information as its own independent marketing database merely because Basin Automated has access to it to perform contracted services.

Where required by applicable law or contract, Basin Automated may enter into a separate Data Processing Addendum or similar agreement addressing client-controlled personal information.

4. Information We Share

Basin Automated does not sell personal information as a business practice.

We may disclose personal information to categories of recipients that are reasonably necessary to operate our business and provide requested services.

These may include:

Service Providers and Technology Providers

Basin Automated uses third-party technology and business service providers to operate its business, including technologies used for:

• website and application development;
• hosting and databases;
• authentication;
• source-code and software management;
• business email and cloud productivity;
• artificial intelligence-assisted work;
• graphic and content production;
• invoicing and payment processing;
• accounting;
• customer and project administration;
• communications;
• security; and
• related business operations.

Our current operational technology stack includes services such as Lovable, GitHub, Supabase, ChatGPT, Google Gemini, Canva, Adobe Express, Google Workspace, Square, and QuickBooks.

Not every service receives every category of information. Information is shared with a particular provider only when reasonably necessary for the applicable business or service function.

Third-party providers may process information according to their own privacy notices, contracts, terms, and security practices.

Payment Providers

When you make a payment through a payment provider such as Square, the payment provider may collect and process payment information directly.

Basin Automated may receive transaction information necessary for accounting, reconciliation, customer-service, invoicing, and recordkeeping purposes.

Accounting Providers

Basin Automated uses accounting systems such as QuickBooks to maintain financial and business records. Information processed through those systems may include invoices, transaction records, business contact information, payment status, and other accounting information.

Professional Advisors

We may disclose information to attorneys, accountants, insurance providers, auditors, consultants, or other professional advisors when reasonably necessary to obtain professional services or protect Basin Automated's legal or business interests.

Legal and Safety Disclosures

We may disclose information when required or reasonably believed necessary to comply with law, legal process, governmental requests, court orders, or to investigate fraud, security incidents, abuse, or other unlawful activity.

Business Transfers

If Basin Automated is involved in a merger, acquisition, reorganization, financing, sale of assets, bankruptcy, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

5. Artificial Intelligence and Automated Technologies

Basin Automated uses artificial intelligence and automated technologies as part of its business operations and service delivery.

Depending on the project and the particular task, Basin Automated may use tools including ChatGPT, Google Gemini, Lovable, and other AI-enabled software.

These tools may be used for activities such as:

• drafting and editing;
• research;
• coding and software development;
• website development;
• content generation;
• design assistance;
• troubleshooting;
• workflow development;
• analysis;
• automation development; and
• internal business operations.

Information provided to an AI-enabled service may be processed by that service according to the applicable provider's terms, privacy policy, account configuration, and data-processing terms.

Basin Automated does not represent that every AI service is subject to identical data-handling practices. The specific provider, product, account type, configuration, and information involved can affect how submitted information is processed.

Basin Automated will not intentionally submit sensitive personal information to an AI service for unrelated purposes merely because the information is available to us. Where a project requires processing personal information through an AI-enabled system, the applicable client agreement, data-processing terms, and provider requirements should be reviewed before implementation.

6. Cookies and Similar Technologies

Our website and online services may use cookies, local storage, server logs, pixels, or similar technologies.

These technologies may be used to:

• keep websites and portals functioning;
• maintain account sessions;
• remember preferences;
• provide security;
• understand website and portal usage;
• diagnose technical problems; and
• measure or improve performance.

Third-party services incorporated into our website or applications may also use their own technologies according to their respective policies.

You can generally control cookies through your browser settings. Disabling certain cookies may affect website or portal functionality.

If Basin Automated later introduces advertising, analytics, tracking, or similar technologies that materially change how personal information is collected or used, this Privacy Policy will be updated as appropriate.

7. Data Retention

Basin Automated retains personal information for only as long as reasonably necessary for the purposes described in this Privacy Policy, the applicable client relationship, contractual obligations, legal requirements, accounting requirements, dispute resolution, security purposes, or other legitimate business needs.

Retention periods vary depending on the type of information.

For example:

• account information may be retained while an account remains active and for a reasonable period afterward;
• project records may be retained for the duration of the business relationship and afterward as reasonably necessary for business, contractual, legal, or accounting purposes;
• financial and transaction records may be retained as required by applicable accounting, tax, or legal requirements;
• security and system logs may be retained for periods appropriate to security, troubleshooting, and operational needs; and
• client-controlled information may be returned, deleted, or retained according to the applicable service agreement, project requirements, data-processing agreement, or legal obligations.

Deletion from Basin Automated's active systems may not immediately remove information from backups, archives, or third-party systems that have their own retention requirements.

8. Data Security

Basin Automated uses reasonable administrative, technical, and organizational measures intended to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.

Depending on the system involved, these measures may include:

• account authentication;
• access controls;
• role-based permissions;
• password and credential protections;
• secure third-party service configurations;
• encryption provided by applicable technology providers;
• security monitoring;
• software updates;
• access limitation based on business need; and
• procedures for responding to suspected security incidents.

No method of transmitting or storing information over the internet is completely secure. Basin Automated therefore does not promise that information can never be accessed, disclosed, altered, or destroyed as a result of circumstances outside our reasonable control.

If Basin Automated determines that a security incident triggers a legal notification obligation, we will provide notices as required by applicable law.

For Wyoming residents, Wyoming law requires covered businesses that own or license computerized data containing specified personal identifying information to investigate certain security breaches and provide notice when misuse has occurred or is reasonably likely to occur.

Basin Automated will follow applicable statutory requirements rather than relying solely on this Privacy Policy.

9. Client Websites, Applications, and Third-Party Accounts

Basin Automated builds and manages digital properties for business clients.

A client website, application, portal, Google Business Profile, social media account, advertising account, payment account, or other third-party service may have privacy practices that are separate from Basin Automated's own practices.

When Basin Automated operates a client's system:

• the client generally determines the purposes for which its customer information is collected and used;
• the client remains responsible for legally required customer notices and disclosures;
• Basin Automated may process information to perform contracted services;
• third-party platforms may independently process information under their own terms and privacy policies; and
• additional contractual or data-processing terms may apply.

Basin Automated does not represent that this Privacy Policy satisfies the privacy-notice requirements applicable to every website or application it builds for a client.

Clients should maintain a privacy policy appropriate to their own business, industry, customer base, geography, and data practices.

10. Third-Party Services and Links

Our website, portal, applications, or communications may contain links to third-party websites or services.

Third-party services may include payment providers, social platforms, search services, cloud services, software providers, and other technology platforms.

Basin Automated does not control the privacy practices of third parties.

Your use of a third-party service is governed by that provider's applicable terms and privacy policy.

11. Your Privacy Rights

Depending on where you live and which privacy laws apply to Basin Automated's processing of your information, you may have rights concerning your personal information.

Depending on applicable law, those rights may include:

• requesting access to personal information;
• requesting correction of inaccurate information;
• requesting deletion of personal information;
• requesting information about categories of personal information collected, used, or disclosed;
• requesting a copy of certain information in a portable format;
• objecting to or restricting certain processing;
• withdrawing consent where processing is based on consent;
• opting out of certain forms of sale, sharing, targeted advertising, or profiling where applicable; and
• exercising other rights provided by applicable law.

Not every right applies in every jurisdiction or to every category of information.

For example, the California Consumer Privacy Act, as amended, provides qualifying California consumers with specific rights, subject to statutory exceptions and applicability thresholds.

If you submit a privacy request, Basin Automated may need to verify your identity before completing the request. We will use information provided for verification only as reasonably necessary to process the request and protect personal information.

To submit a privacy request, contact us using the privacy contact information identified at the end of this Policy.

12. California Privacy Rights

This section applies only to the extent the California Consumer Privacy Act applies to Basin Automated's processing of a California resident's personal information.

Basin Automated does not sell personal information as that term is ordinarily understood in commercial data transactions.

If Basin Automated engages in processing that constitutes a sale, sharing, or targeted advertising activity under applicable California law, Basin Automated will provide any notices and opt-out mechanisms required by that law.

California residents may have rights to:

• know or access personal information;
• delete personal information, subject to exceptions;
• correct inaccurate personal information;
• limit certain uses and disclosures of sensitive personal information;
• opt out of sale or sharing where applicable; and
• receive equal treatment for exercising applicable privacy rights.

Nothing in this Privacy Policy limits rights that cannot lawfully be waived.

13. Children's Privacy

Basin Automated's website, client portal, and services are intended primarily for businesses and their authorized representatives and are not directed to children under 13.

Basin Automated does not knowingly request or intentionally collect personal information directly from children under 13 through its general business website or client portal.

If we learn that we have collected personal information from a child under 13 in circumstances where applicable law requires parental consent, we will take reasonable steps to address the information appropriately.

If you believe a child has provided personal information to Basin Automated, please contact us using the information below.

14. Sensitive Personal Information

Basin Automated does not require users to submit highly sensitive personal information through ordinary website inquiries or client-portal requests unless specifically necessary for a contracted service.

Do not submit information such as:

• Social Security numbers;
• government identification numbers;
• financial account credentials;
• complete payment-card information;
• passwords;
• medical records;
• health information;
• biometric information; or
• other sensitive personal information through general contact forms, email, or ordinary file-upload functions unless Basin Automated has specifically instructed you to use an appropriate secure process.

If a client engagement requires Basin Automated to process regulated or sensitive information, additional contractual, security, or data-processing requirements may apply.

15. International Data Processing

Basin Automated is based in the United States.

Some technology and service providers used by Basin Automated may process information in the United States or other countries where those providers operate.

Where applicable law imposes requirements concerning international transfers or cross-border processing, Basin Automated will address those requirements through the applicable service provider terms, contractual arrangements, or other legally appropriate mechanisms.

16. Business-to-Business Information

Much of Basin Automated's business involves communication with business owners, employees, contractors, and authorized representatives.

Information relating to a business or professional relationship may still constitute personal information under applicable law when it identifies or can reasonably be linked to an individual.

This Privacy Policy applies to such information to the extent applicable.

17. Communications and Marketing Choices

You may receive service-related communications when necessary to administer your account, project, invoices, requests, or other business relationship.

You may opt out of optional marketing communications by following the unsubscribe instructions included in the communication or by contacting Basin Automated.

Opting out of marketing communications does not necessarily stop transactional, security, account, billing, or other communications required to provide services or administer an existing business relationship.

18. Privacy Requests and Contact

To submit a privacy question, request access, correction, deletion, or another applicable privacy request, contact:

Basin Automated, LLC Gillette, Wyoming, United States Privacy Contact: scuster@basinautomated.com Website: basinautomated.com When submitting a request, please provide enough information for Basin Automated to understand the request and verify that you are the person associated with the information at issue.

If you are making a request concerning information that Basin Automated processes on behalf of one of its business clients, Basin Automated may direct the request to the applicable client or assist the client in responding, depending on the applicable law, contractual relationship, and roles of the parties.

19. Changes to This Privacy Policy

Basin Automated may update this Privacy Policy from time to time to reflect changes in:

• our services;
• our technology;
• our data practices;
• third-party providers;
• applicable law;
• regulatory requirements; or
• business operations.

When we make material changes, we may provide additional notice when required by applicable law.

The “Last Updated” date at the beginning of this Policy identifies the date of the most recent revision.

20. No Limitation of Legal Rights

Nothing in this Privacy Policy is intended to limit or waive any privacy, consumer-protection, security, or other legal right that cannot lawfully be limited or waived.

Where applicable law provides greater rights or protections than those described in this Policy, the applicable law controls.

21. Relationship to Other Agreements

This Privacy Policy should be read together with Basin Automated's applicable Terms & Conditions, Master Services Agreement, Statement of Work, Data Processing Addendum, and other service-specific agreements.

If Basin Automated processes personal information for a business client, the applicable agreement may impose additional requirements concerning confidentiality, security, data processing, incident response, retention, deletion, or data-subject requests.

Where a contractual data-processing agreement governs a specific client relationship, that agreement controls to the extent of any conflict concerning the processing of client-controlled personal information.