PoolHall Privacy Policy

1. Scope and Roles

This Policy applies to Brand representatives, prospective customers, visitors, and other people who interact with PoolHall's Brand services. Creator-facing Payday services may have a separate notice. When a Brand supplies creator or consumer information for its campaign, the Brand remains responsible for its instructions and legal basis; PoolHall processes that information to provide the Services and for the independent purposes described here. Third-party websites, social platforms, and creator tools have their own privacy practices.

2. Information We Collect

• Account and business data: name, work email, business/workspace name, profile, authentication provider, account role, and preferences.
• Phone verification data: the mobile number you verify, the time it was verified, and a record of the text-message consent you gave. Section 4A describes this category in detail.
• Campaign and marketplace data: briefs, products, claims, budgets, creator searches and assignments, messages, approvals, content, links, performance, and reporting data.
• Billing data: wallet balances, amounts, invoices, transactions, charge status, and Stripe customer/payment-method identifiers. Stripe receives and processes full card details; PoolHall does not need to store full card numbers.
• Communications: support requests, emails, calls, survey responses, feedback, and messages exchanged through connected services.
• Device, log, and evidence data: IP address, browser/device information, timestamps, requested pages, security events, session data, and versioned legal-acceptance evidence.
• AI inputs and outputs: prompts, campaign materials, uploaded or linked media, generated briefs/scripts, classifications, and quality or safety results.

Please do not submit government identifiers, health information, payment-card numbers, or other highly sensitive information unless PoolHall specifically requests it through an appropriate secured flow.

3. Sources

We collect information directly from you and your organization; automatically from browsers and the Services; from creators and marketplace activity; from connected social, measurement, app-store, and campaign services at your direction; from payment and authentication providers; and from public or commercially available sources used for product and campaign research.

4. How We Use Information

• create and secure accounts, sessions, workspaces, and acceptance records;
• provide campaigns, creator matching, communications, approvals, content workflows, analytics, and support;
• process deposits, subscriptions, creator disbursements, refunds, disputes, and accounting records;
• generate and evaluate AI-assisted materials and improve relevant product features;
• send transactional messages and, where permitted, product or marketing communications;
• measure email delivery, opens, or link activity when tracking is enabled;
• detect abuse, fraud, security incidents, policy violations, and technical problems;
• enforce agreements, investigate complaints, protect people and services, and establish or defend legal claims; and
• comply with legal, tax, audit, sanctions, and lawful-process obligations.

4A. Phone Number and Text Messages

What we collect and verify. Creating a Brand account requires a mobile phone number. We collect the number in E.164 international format, the date and time it was verified, and, where a number replaces an earlier one, the number it replaced. We confirm that you control the number by sending a one-time code by text message (SMS).

Record of your consent. When you verify a number we store a consent record as evidence of what you agreed to. It includes the exact disclosure text shown to you on screen, a version identifier for that disclosure, whether you separately opted in to marketing texts, the account email, the date and time, your IP address, and your browser or device user agent.

Who processes it. Verification is performed by Google Firebase Authentication, which acts as our service provider and sends the verification message on our behalf under our instructions. The verified number is stored in your Firebase Authentication record and in PoolHall's application database. Your mobile carrier also processes the message in order to deliver it to your device.

Why we use it. We use a verified number to confirm the account can be contacted, to secure the account and detect fraud and duplicate signups, to reach you about your account, billing, campaigns, and support, and — only if you give a separate opt-in — to send marketing texts. The permission to send account and support messages is never treated as consent to send marketing messages.

How long we keep it. We keep a verified number while the account is active. We retain consent records as evidence of the consent given, which may be after the number is removed or the account is closed. Section 10 (Retention) otherwise applies.

We do not sell it. We do not sell your phone number or provide it to data brokers, and the self-serve Brand console does not use it for advertising, advertising measurement, or cross-context behavioral advertising. Section 7 applies if that changes.

Your choices. You may reply STOP to any text message from PoolHall to opt out. You may also email privacy@poolhall.ai to opt out of marketing texts or to ask us to remove your number. Opting out of marketing does not stop account and support messages needed to operate the account, and because a verified number is required for a Brand account, removing it may prevent continued access. Removal does not delete consent records we retain as legal evidence. See Section 12 (Privacy Choices and Rights) and the Brand Terms.

5. Cookies and Local Storage

PoolHall uses authentication/session cookies and browser local or session storage to keep users signed in, protect requests, preserve preferences, and support product workflows. Blocking essential storage may prevent the Services from working. The current self-serve surface is not intended to load nonessential advertising trackers by default. If we add advertising, cross-context behavioral, or nonessential analytics technologies, we will update this notice and provide consent or opt-out controls where required.

6. How We Disclose Information

We may disclose relevant information to:

• Creators and campaign participants to operate Brand campaigns and share briefs, assets, instructions, approvals, and necessary contact/context data.
• Service providers supporting cloud hosting, authentication, databases, storage, payments, communications, customer support, security, AI processing, content analysis, and product operations.
• Connected services such as social networks, attribution/measurement tools, app stores, or campaign systems when the integration or campaign requires it.
• Professional advisers and transaction parties for legal, accounting, insurance, financing, due diligence, merger, acquisition, reorganization, or asset sale purposes.
• Authorities and affected parties when reasonably necessary to comply with law, respond to lawful process, protect rights or safety, investigate misconduct, or address a security incident.

We do not disclose full payment-card details because Stripe processes those details directly.

7. Sale, Sharing, and Targeted Advertising

PoolHall does not sell personal information for money. We do not currently intend the self-serve Brand console to share personal information for cross-context behavioral advertising. Some state laws define “sale,” “sharing,” or targeted advertising broadly. If our practices change or a technology is determined to fall within those definitions, we will provide the required notice and opt-out method and honor legally recognized preference signals where required.

8. AI Processing

PoolHall may send prompts, campaign materials, media, and contextual data to AI and content-analysis providers, including providers made available through Google Cloud/Vertex AI and OpenAI, to generate, refine, classify, or review content. Do not submit material you lack authority to process. Human review may be used for safety, quality, support, or campaign operations. AI output can be inaccurate and should not contain sensitive personal information unless the workflow specifically requires and permits it.

9. International Processing

PoolHall and its providers may process information in the United States and other countries where they operate. Those locations may have different privacy laws. Where a legally required transfer mechanism applies, PoolHall will use an appropriate mechanism; this notice does not claim a particular mechanism for a transfer unless it has been implemented for that relationship.

10. Retention

We retain information for as long as reasonably necessary for the purposes described here, including the account and campaign lifecycle, financial and tax recordkeeping, creator/payment disputes, security, legal-acceptance evidence, enforcement, and legal claims. Retention varies by record type and considers contractual commitments, sensitivity, operational need, limitation periods, and legal requirements. Information is deleted, deidentified, or isolated when no longer reasonably needed, subject to backups and lawful holds. Contact privacy@poolhall.ai for information about a specific category.

11. Security

We use administrative, technical, and organizational safeguards designed for the nature of the Services, including access controls and managed cloud infrastructure. No system, transmission, credential, or storage method is completely secure. You must protect credentials, configure authorized access, and notify us promptly of suspected compromise.

12. Privacy Choices and Rights

Depending on your location and applicable law, you may request access, correction, deletion, or a copy of personal information; ask us to restrict or object to certain processing; withdraw consent where consent is the basis; opt out of certain sale/sharing/targeted advertising or profiling; or appeal a denied request. You may also opt out of marketing email through its unsubscribe link while continuing to receive transactional messages.

Submit requests to privacy@poolhall.ai and identify your state/country and request. We will verify the request proportionately, which may require account access or additional information. Authorized agents must provide proof of authority, and we may verify directly with the individual. We will not unlawfully discriminate for exercising a privacy right. If we deny an appealable request, reply with “Privacy Appeal” for review and information about any regulator complaint option.

13. California and Other U.S. State Notices

The categories described in Section 2 may include identifiers; customer-record information; commercial, internet/network, geolocation inferred from IP, professional/employment, audio-visual, and inference information. Sources, purposes, and recipient categories are described in Sections 3, 4, and 6. We do not knowingly use or disclose sensitive personal information to infer characteristics in a manner that triggers a right to limit. Applicable state residents may exercise the rights described in Section 12.

14. EEA, UK, and Similar Jurisdictions

Where applicable, PoolHall processes information to perform contracts and requested pre-contract steps; comply with legal obligations; pursue legitimate interests such as operating, securing, improving, and enforcing the Services; establish or defend claims; and obtain consent where required. You may have a right to complain to a local data-protection authority. Contact us for questions about the controller, legal basis, or transfer applicable to a specific processing activity.

15. Children

The Brand Services are for business representatives at least 18 years old and are not directed to children. Do not submit children's personal information unless a lawful, approved campaign workflow expressly requires it and all necessary parental/guardian permissions and protections are in place.

16. Changes

We may update this Policy to reflect legal, technical, or business changes. We will post the updated date and provide additional notice where required. Material Terms changes may require renewed contract acceptance; acknowledging this Privacy Policy records receipt of the notice and is not a waiver of rights.

17. Contact

PoolHall LLC
Privacy requests and questions: privacy@poolhall.ai
Legal notices: legal@poolhall.ai