PrebuiltAds Privacy Policy

Attorney Scaler LLC d/b/a PrebuiltAds 271 NE 211th Street, Miami, FL 33179 [email protected]

Effective Date: September 21, 2026 Last Updated: September 22, 2026

1. Who We Are and What This Covers

Attorney Scaler LLC, a Florida limited liability company doing business as PrebuiltAds ("PrebuiltAds," "we," "us," "our"), provides advertising campaign software, a customer relationship system, and automated follow-up tools to businesses.

This Privacy Policy explains how we handle personal information in two different roles, and the distinction matters:

As a business (we decide). When you visit our website, book a demo, contact us, or subscribe as a customer, we collect and use information about you and your business for our own purposes. For that information we are the "controller" or "business," and this Policy describes what we do.

As a vendor (you decide). When you use our software to run your advertising and manage your own leads and customers, the personal information in your account belongs to your business, not ours. We process it only on your instructions and only to provide the service. For that information we are a "service provider," "processor," or "contractor," and Section 9 governs it. Our customers, not us, decide what is collected, why, and for how long.

This Policy does not apply to the privacy practices of our customers, or of any advertising platform, website, or service we integrate with.

2. Information We Collect About You

Information you give us:

Identifiers: name, business name, email address, telephone number, mailing and billing address

Account credentials

Commercial information: subscription plan, purchase and billing history, support requests, industry, service area, advertising budget

Payment information, which is collected and stored by our payment processor; we receive only limited details such as card brand, expiration, and last four digits

Communications you send us, including emails, chat messages, support tickets, call recordings where you are notified, and onboarding call content

Content you upload, which is governed by Section 9

Information collected automatically:

Device and connection data: IP address, browser type, operating system, device identifiers, language

Usage data: pages viewed, features used, searches performed on our site including the industry you searched, clicks, timestamps, referring URL, session duration

Cookies, pixels, tags, SDKs, and similar technologies, as described in Section 7

Information from third parties:

Advertising platforms and analytics providers, including campaign, click, and conversion data

Our payment processor, regarding transaction status

Service providers that help us prevent fraud and verify business information

3. Information We Do Not Want and Do Not Ask For

We do not ask you for, and you must not submit through our Services: protected health information, government identification numbers such as Social Security or driver's licence numbers, financial account or full payment card numbers, precise geolocation, biometric identifiers, genetic data, criminal history, information about children under eighteen, or information revealing racial or ethnic origin, religious belief, political opinion, union membership, sexual orientation, or sex life.

If you submit such information anyway, you do so in breach of our Terms of Service and at your own risk, and we may delete it.

4. Why We Use Information

We use personal information to:

provide, operate, secure, maintain, and support the Services

create and administer your account, and authenticate you

process payments, invoice you, and collect amounts owed

communicate with you about your account, onboarding, updates, outages, and support

send marketing communications about our own products, subject to Section 6

personalize and improve the Services, and develop new features

measure and improve our own advertising, including attribution and conversion measurement

produce aggregated or de-identified analytics and benchmarks that do not identify you

detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms

comply with law, respond to lawful requests, and establish, exercise, or defend legal claims

Legal bases (where the GDPR or UK GDPR applies): performance of a contract, our legitimate interests in operating and securing our business, your consent where we ask for it, and compliance with legal obligations.

5. How We Share Information

We share personal information with:

Service providers and subprocessors who perform functions on our behalf under contract, including hosting and cloud infrastructure, the underlying CRM and automation platform, the advertising template platform, telephony and messaging carriers and aggregators, email delivery providers, payment processing, analytics, customer support tooling, and accounting. They may use the information only to perform services for us.

Advertising and analytics platforms, including Meta and Google, for measurement, attribution, audience building, and advertising, as described in Sections 7 and 8.

Professional advisers, including lawyers, accountants, insurers, and auditors, as reasonably necessary.

Authorities and other parties where we believe in good faith that disclosure is required by law, subpoena, court order, or governmental request, or is necessary to protect the rights, property, or safety of any person, to enforce our Terms, or to investigate fraud, abuse, or a security incident.

Carriers and messaging aggregators, where necessary to register your messaging, investigate complaints, or respond to a carrier or regulator inquiry regarding traffic sent from your account.

An acquirer or successor, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to this Policy or a successor policy providing comparable protection.

We do not sell personal information for money.

5.1 Mobile Information

No mobile information will be sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service or messaging delivery, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the text message services.

6. Text Messages and Email

6.1 Messages from us. If you give us your mobile number, we may send you transactional messages about your account and, with your consent, marketing messages. Message and data rates may apply. Message frequency varies. Reply STOP to any message to opt out of further marketing texts, or HELP for assistance. Opting out of marketing does not stop essential transactional messages about your account, billing, or security.

6.2 Email. You may unsubscribe from marketing email using the link in any such email. Transactional email continues.

6.3 Messages our customers send. Our customers use the Services to send their own calls, texts, and emails to their own contacts. Our customers, not us, are the sender of those messages and are solely responsible for obtaining valid consent and honoring opt-outs. If you received a message from a business using our software and wish to stop receiving them, reply STOP to that message or contact that business directly. If you cannot identify the sender, email [email protected] and we will make reasonable efforts to route your request to the responsible customer.

7. Cookies and Tracking Technologies

We and our partners use cookies, pixels, web beacons, tags, local storage, and similar technologies to operate our site, remember preferences, measure performance, and advertise.

We use:

Strictly necessary technologies, required for the site and your account to function

Analytics technologies, to understand how the site is used

Advertising technologies, including the Meta pixel and Google tags, which allow us and those platforms to measure our advertising and show you ads for our products on other sites and apps

Your choices. You may control cookies through your browser settings, and where we present a cookie banner or preference tool you may set your choices there. You may opt out of interest-based advertising through industry tools at optout.aboutads.info, optout.networkadvertising.org, and youradchoices.ca, and through the settings offered by Meta and Google directly. Blocking some technologies may break parts of the site.

Global Privacy Control. We honor the Global Privacy Control (GPC) signal as a valid opt-out of sharing for cross-context behavioral advertising where applicable law requires.

8. Targeted Advertising and Cross-Context Behavioral Advertising

We use advertising platforms to market our own Services. This means information about your visit to our website, including that you searched a particular industry or viewed a cost-per-lead result, may be shared with those platforms so they can measure our campaigns and show you our ads elsewhere. Under some U.S. state privacy laws this activity is defined as "sharing" or "targeted advertising" even though no money changes hands.

You may opt out using the tools in Section 7, by sending a GPC signal, or by emailing [email protected] with the subject line "Opt Out of Sharing."

We do not use or disclose sensitive personal information for purposes of inferring characteristics about you, and we do not knowingly sell or share the personal information of anyone under eighteen.

8A. Health Information and Consumer Health Data

8A.1 We are not a HIPAA business associate. The Services are general-purpose business software. They are not a HIPAA-compliant environment, we do not act as a business associate, and we do not sign Business Associate Agreements unless we have executed one with a customer in a separate signed writing. Customers must not submit protected health information as defined at 45 C.F.R. § 160.103 through the Services, and Section 9A of our Terms of Service governs what is and is not permitted.

8A.2 Consumer health data under state law. Washington's My Health My Data Act, Nevada Senate Bill 370, and similar laws define "consumer health data" much more broadly than HIPAA does. It can include an inference that a person is seeking or receiving a health, dental, mental health, aesthetic, weight, hormone, fertility, recovery, or wellness service, drawn from something as ordinary as the advertisement they responded to.

8A.3 Our own collection. In operating our own website and marketing, we do not knowingly collect, use, sell, or share consumer health data about visitors, and we do not collect it for the purpose of inferring any health characteristic. The industry you type into our cost-per-lead search is used to return a result and to measure our own advertising. It describes the business you run, not a health condition you have. We do not use it to infer anything about your health.

8A.4 Consumer health data our customers collect. Where a customer uses the Services to advertise a health-related service and collects information that qualifies as consumer health data, that customer is the regulator's point of accountability for it. They decide what is collected, why, and on what legal basis. We process it only on their documented instructions, only to provide the Services, and never for our own purposes. That customer is responsible for obtaining any separate consent, providing any separate notice, and honoring any rights that those laws require.

8A.5 No sale of consumer health data. We do not sell consumer health data, and we do not sell any personal information, as "sell" is defined under the My Health My Data Act, the CCPA, or any other state privacy law. We have never done so. We do not require, and will not seek, a valid authorization to sell consumer health data, because we do not sell it.

8A.6 Your consumer health data rights. If you are a Washington or Nevada resident and you believe we hold consumer health data about you, you may request to know what we hold, request deletion, and withdraw any consent, by emailing [email protected] with the subject line "Consumer Health Data Request." We will respond within the period the applicable law requires and will pass deletion requests to our service providers and processors. If your data was collected by one of our customers through their own advertising, we will tell you so and direct your request to them, because they control it.

8B. Biometric Information

We do not collect biometric identifiers or biometric information, and we do not permit our customers to collect them through the Services. That includes facial geometry or faceprints, fingerprints, voiceprints, retina or iris scans, and scans of hand or face geometry, as those terms are used in the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and comparable laws.

We do not use facial recognition, voice identification, or any other biometric matching technology anywhere in the Services. We do not create, store, or derive biometric templates from any photograph, video, or call recording, and we do not permit any customer or third party to do so using the Services. Photographs and call recordings a customer chooses to store are treated as ordinary Customer Data under Section 9 and are never processed to identify a person.

We do not sell, lease, trade, or profit from biometric information, because we do not hold any. If you believe biometric information about you has been submitted to the Services, email [email protected] and we will investigate and delete it.

9. Customer Data: Our Role as a Service Provider

This Section governs personal information that our customers upload to, generate in, or process through the Services, including their leads, contacts, conversations, and pipeline records ("Customer Data"). It is incorporated into our Terms of Service and forms part of the agreement between us and each customer.

9.1 Roles. With respect to Customer Data, the customer is the "business," "controller," or "data exporter," and PrebuiltAds is the "service provider," "processor," or "contractor."

9.2 Our commitments. We will:

(a) process Customer Data only to provide, secure, support, and improve the Services as instructed by the customer and permitted by the agreement, and for no other purpose;

(b) not sell or share Customer Data, and not retain, use, or disclose it for any commercial purpose other than performing the Services, including not for cross-context behavioral advertising, whether for our benefit or anyone else's;

(c) not combine Customer Data with personal information received from any other source, except as permitted by applicable law for a service provider;

(d) maintain reasonable and appropriate technical, administrative, physical, and organizational safeguards designed to protect Customer Data;

(e) restrict access to personnel who need it to perform the Services, and bind them to confidentiality;

(f) engage subprocessors only under a written contract imposing obligations no less protective than these, and remain responsible for their performance;

(g) notify the customer without undue delay after becoming aware of a breach of security affecting Customer Data, and reasonably cooperate in the customer's response;

(h) provide reasonable assistance in responding to verified requests from individuals exercising their privacy rights, and in any required data protection assessment;

(i) make available information reasonably necessary to demonstrate compliance with this Section, and allow reasonable audit rights no more than once per year on thirty (30) days' notice, at the customer's expense; and

(j) delete or return Customer Data on termination in accordance with Section 6 of the Terms of Service, which provides a thirty (30) day export window followed by deletion or irreversible de-identification within sixty (60) days, except where retention is legally required or the data sits in routine backups that expire on their own schedule.

9.3 Customer obligations. Each customer is solely responsible for: having a lawful basis and any required consent for the personal information it processes; providing any notice required to the individuals concerned; the accuracy and legality of Customer Data; responding to privacy rights requests from its own contacts; and not submitting any category of information listed in Section 3.

9.4 International transfers. Where Customer Data originates in the European Economic Area, the United Kingdom, or Switzerland, the parties agree that the European Commission's Standard Contractual Clauses (Module Two, controller to processor) and, for the UK, the International Data Transfer Addendum, are incorporated by reference, with the customer as data exporter and PrebuiltAds as data importer, Florida law and Miami-Dade County venue selected where optional, and the details of processing taken from this Policy and the Terms of Service.

9.5 Conflict. If this Section conflicts with any other part of this Policy regarding Customer Data, this Section controls.

10. Retention

We keep personal information only as long as needed for the purposes described here, then delete or de-identify it. In general:

Account and billing records: for the life of the account plus seven (7) years, for tax, accounting, and legal defense purposes

Customer Data: as described in Section 9.2(j)

Consent and opt-out records: at least five (5) years, because messaging law requires it

Website and analytics logs: generally up to twenty-four (24) months

Marketing contact records: until you opt out, plus a suppression record kept indefinitely so we can honor your opt-out

We may retain information longer where required by law, or where reasonably necessary to resolve a dispute, enforce our agreements, or defend a legal claim.

11. Security

We use reasonable safeguards including encryption in transit, access controls, least-privilege permissions, logging, and vendor diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential, for enabling any available multi-factor authentication, and for the security of your own devices and email account.

12. Your Privacy Rights

12.1 United States

Depending on your state of residence, you may have the right to:

know and access the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients

correct inaccurate personal information

delete personal information we hold about you

obtain a portable copy of personal information you provided to us

opt out of sale, sharing, or targeted advertising, and of profiling in furtherance of decisions producing legal or similarly significant effects

limit use of sensitive personal information, though as stated we do not collect it for that purpose

not be discriminated or retaliated against for exercising any of these rights

How to exercise. Email [email protected] with the subject line "Privacy Request" and tell us which right you are exercising. We will verify your identity by matching the information you provide against our records, and may ask for additional information where necessary. We do not charge a fee for a reasonable request.

Authorized agents. You may use an authorized agent, who must provide written proof of authorization, and we may separately verify your identity.

Timing. We respond within forty-five (45) days, and may extend once by a further forty-five (45) days with notice.

Appeals. If we decline your request, you may appeal by replying to our response or emailing [email protected] with the subject line "Privacy Appeal." We will respond to an appeal within forty-five (45) days with our decision and reasons. If your appeal is denied you may contact your state Attorney General.

Requests about a customer's data. If your request concerns personal information held by one of our customers, we will refer you to that customer, who is responsible for responding. We will assist them as required by Section 9.2(h).

12.2 European Economic Area, United Kingdom, and Switzerland

Where those laws apply you may also have the right to object to processing based on legitimate interests, to request restriction of processing, to withdraw consent at any time without affecting prior processing, and to lodge a complaint with your supervisory authority, including the UK Information Commissioner's Office. We transfer personal information to the United States using appropriate safeguards, including Standard Contractual Clauses where required.

12.3 Nevada and other state-specific notices

Nevada residents may submit a request regarding the sale of covered information to [email protected]. We do not sell covered information for money.

12A. Security Incidents

If we determine that a security incident has compromised personal information we hold, we will notify affected individuals and, where we act as a service provider, the affected customer, without unreasonable delay and within the time required by applicable law. Our notice will describe what happened, what information was involved, what we are doing, and what you can do. Nothing in this Policy or in our Terms of Service requires you to waive any right to notice that applicable law gives you.

13. Children

The Services are intended for businesses and for individuals aged eighteen (18) and over. We do not knowingly collect personal information from anyone under eighteen. If you believe a minor has provided us information, email [email protected] and we will delete it. Our customers must not use the Services to target or collect information from minors.

14. Third-Party Websites and Platforms

The Services link to and integrate with third-party websites and platforms, including advertising platforms. We are not responsible for their privacy practices. Review their policies directly.

15. Do Not Track

Browsers may offer a "Do Not Track" setting. There is no common industry standard for responding to it, so we do not respond to DNT signals. We do honor the Global Privacy Control signal as described in Section 7.

16. Changes to This Policy

We may update this Policy. We will post the revised version with a new Last Updated date and, for material changes, provide notice by email or in-product notice at least thirty (30) days in advance where required. Your continued use after the effective date constitutes acceptance. We will keep prior versions available on request.

17. Contact Us

Privacy requests and questions: [email protected] General support: [email protected] Legal: [email protected]

Attorney Scaler LLC d/b/a PrebuiltAds 271 NE 211th Street, Miami, FL 33179

If you are in the EEA or UK and wish to raise a concern about our processing, contact us first at [email protected] so we can try to resolve it.ds.com so we can try to resolve it.