Privacy Policy

1. Introduction

Build Beyond Hightech LLC ("BBH," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at bbhightech.comuse our client portal, or engage our services.

By using our website or services, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access our website or use our services.

Data Controller: Build Beyond Hightech LLC, operated by Thamer Baccouch. For any privacy-related inquiries, contact us at [email protected].

2. Information We Collect

2.1 Information You Provide Directly

When you register for an account through our client portal or contact us, we may collect the following personal information:

• Full namerequired for account creation and communication
• Email addressrequired for account authentication, communication, and service delivery
• Phone numberoptional, collected only if you provide it for communication purposes
• Business namecollected to identify your project and tailor our services
• Website URLcollected when relevant to the services we provide for you

2.2 Information Collected Automatically

We use Umami, a privacy-focused analytics tool that we host on our own infrastructure, to understand aggregate page usage (page views, referrers, approximate region). Umami does not use cookies, does not store personal identifiers, and anonymizes IP addresses, visits cannot be traced back to you as an individual. We do not use third-party advertising trackers, do not set advertising cookies, and do not build behavioral profiles.

Our web server may automatically log standard access information, including your IP address, browser type, referring URL, and timestamps. These server logs are used solely for security monitoring and infrastructure maintenance, and are not used for tracking or profiling purposes.

2.3 Authentication Data

When you log in to the client portal, a JSON Web Token (JWT) is stored in your browser's localStorage. This token is used solely to authenticate your session and does not contain sensitive personal data beyond what is necessary for identification. The token expires automatically and is removed upon logout.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Service delivery: To design, develop, host, and maintain your website as agreed upon
• Account management: To create and manage your client portal account, process orders, and provide customer support
• Communication: To respond to your inquiries, send service-related updates, and provide technical support via email or WhatsApp
• Billing and payments: To process payments for hosting, premium upgrades, and source code purchases through our payment processor
• Legal compliance: To comply with applicable laws, regulations, and legal obligations
• Security: To detect, prevent, and address technical issues, fraud, or security threats

We do not use your information for automated decision-making or profiling. We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Third-Party Service Providers

We share your personal information only with the following third-party service providers, and only to the extent necessary to deliver our services:

• Whop (payment processing), When you make a payment for hosting, premium upgrades, or source code purchases, your payment information is processed by Whop. We do not store your credit card details or full payment information on our servers. Whop's handling of your data is governed by their own privacy policy, available at whop.com/privacy.
• DigitalOcean (hosting infrastructure), Your account data and our website backend are hosted on Virtual Private Servers (VPS) provided by DigitalOcean in the United States (San Francisco). Website files are delivered through Cloudflare's global network. DigitalOcean acts as a data processor on our behalf. Their privacy policy is available at digitalocean.com/legal/privacy-policy.
• Discord (internal team chat, Discord Inc., USA), Requests from our website forms, including the contact details and description you enter, are posted to our team's private chat so the team can act on them. They are used there for nothing else; see Section 5b.
• Resend (email service, Resend Inc., USA), Our emails from [email protected] are sent through Resend, and emails you send to us are received through it.

We do not share your personal information with any other third parties unless required by law or with your explicit consent.

5. Cookies and Local Storage

Our website does not use tracking cookies, advertising cookies, or third-party cookies.

We use browser localStorage solely for the following purpose:

• Authentication token (JWT): Stored when you log in to the client portal to maintain your authenticated session. This token is removed when you log out or when it expires.

localStorage is not a cookie and is not sent to our server with every request. It is accessible only by our website's client-side code and is used exclusively for session management.

With your consent only, a few first-party cookies support session recordings, see Section 5a.

5a. Session Recordings (only with your consent)

If you press Accept in our session recording bar ("Allow privacy-masked session recording?"), we record how you use some of our pages so we can see where the site is confusing or broken. We record only around the preview form on the homepage, on the checkout page and in the client portal, and we keep a recording only if the visit reaches one of those steps. On the homepage, once you start filling in the preview form, the recording also includes up to the two minutes before that.

• What is recorded: the page layout, clicks, taps, scrolling, mouse movement, and when and how much you type, during your visit.
• What is replaced before it leaves your browser: the contents of every form field (each character becomes an asterisk, so the length and timing of typing remain visible, the text does not), email addresses, phone numbers, and checkout and sign-in links. In the client portal, all of your account content is replaced as well. Our server checks every recording again and removes anything of this kind before storing it.
• Pseudonymous, not anonymous: a recording is not linked to your name or account, and no IP address is stored with it. It does carry a random visit ID, the date and time, your country (from our network provider), the type of device and screen size, the page language, the website that referred you and any campaign tags in the link.
• Self-hosted: recordings are made with the open-source rrweb library, served from our own server, and stored only on our own server (DigitalOcean, USA). Like every request to our site, uploads pass through our network provider Cloudflare. No analytics or recording company receives them.
• Kept for 30 days, then deleted automatically. Only the BBHightech team (our administrators) can watch them.
• Cookies (first-party, only for this feature): bbh_rec_consent remembers your answer for 180 days. If you accept: bbh_rec_s holds the random visit ID so the pages of one visit stay together (expires after 30 minutes of inactivity); bbh_rec_key holds a random erasure key that is sent with your recordings, so that withdrawing can delete all of them at once (31 days, renewed while in use; our server keeps only a one-way hash of it, which also means your recorded visits from this browser can be linked to each other in our database); and only after you withdraw, bbh_rec_rv keeps that key and visit ID until our server has confirmed the deletion, then it is removed (at most 31 days).

Declining is as easy as accepting, and nothing is recorded unless you accept. Browsers that send a Global Privacy Control signal are treated as declined. You can change your choice here at any time. Turning it off stops recording in your other open tabs too, and deletes the recordings made in this browser during the last 30 days straight away:

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the control above. To have a recording deleted sooner, contact us (see Section 12).

5b. Free Website Builder Requests

When you use our free website builder, we receive what you enter in the form: your business name and city, the links to your Google Maps, Instagram or Facebook page, your description, the photos you upload, your email address and/or WhatsApp number, and, if you answer them, the three optional questions (how you heard about us, who you are, what you need), which help us see what brings people to us. Photos are resized in your browser before upload where your browser supports it, and our server re-saves them without their embedded metadata (such as the location a photo was taken).

We use this only to build your preview website and send it to you by email or WhatsApp, as you agreed when you ticked the box on the form (Art. 6(1)(a) GDPR). To get it built, the request (including your contact details and description) is passed to our team through our internal team chat, Discord (Discord Inc., USA, see Section 4), where it is used for nothing else. With the request we also keep how you reached the page (the referring page and campaign tags) to see which pages bring requests, and, for abuse prevention only, your IP address and browser type, which are deleted after 90 days. No newsletter, no other marketing, and we do not pass it on to anyone else. If your request does not become a website you keep, the photos are deleted automatically 30 days after you sent them, and the request itself after 24 months. If it does, the photos are used in your website and are kept and deleted with your website files (Section 7). When you ask us to delete your request, we also remove it from the team chat. You can withdraw your consent or ask us to delete your request sooner at any time (see Section 12).

6. Data Storage and Security

Your data is stored on servers provided by DigitalOcean in the United States. We implement appropriate technical and organizational measures to protect your personal information, including:

• SSL/TLS encryption for all data transmitted between your browser and our servers
• Secure password hashing for account credentials
• Access controls limiting who can view or modify client data
• Regular server security updates and monitoring

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your personal information.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account data (name, email, business name): Retained for the duration of your active account and for up to 12 months after account closure or service termination, to allow for reactivation or follow-up.
• Website files and content: Retained for the duration of your active hosting subscription. Upon cancellation, website files are retained for 30 days before deletion to allow for data retrieval.
• Payment records: Retained as required by applicable tax and accounting laws (typically 7 years).
• Communication records: Retained for up to 24 months for customer support and service quality purposes.
• Server logs: Retained for up to 90 days for security and operational purposes.
• Session recordings (only with your consent, Section 5a): 30 days, then deleted automatically.
• Photos sent with a free website builder request (Section 5b): 30 days, then deleted automatically, unless the request became a website you keep.

You may request earlier deletion of your data at any time by contacting us (see Section 12).

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You have the right to request that we delete your personal data, subject to certain legal exceptions (such as data required for legal compliance).
• Right to restriction of processing: You have the right to request that we limit how we use your data in certain circumstances.
• Right to data portability: You have the right to request your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to our processing of your personal data for specific purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

9. International Data Transfers

Our servers are located in the United States, so your personal data is transferred outside the European Economic Area. For these transfers we rely on the safeguards offered by each provider under GDPR, such as the EU Standard Contractual Clauses in their data processing agreements or certification under the EU-U.S. Data Privacy Framework.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.

For significant changes that materially affect how we handle your personal data, we will make reasonable efforts to notify you via email or through a notice on our website.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your personal information is handled, please contact us:

• Email: [email protected]
• WhatsApp: Message us on WhatsApp

We aim to respond to all privacy-related inquiries within 30 days.