PoolHall Privacy Policy

1. Scope and Roles

This Policy applies to Brand representatives, prospective customers, visitors, and other people who interact with PoolHall's Brand services. Creator-facing Payday services may have a separate notice. When a Brand supplies creator or consumer information for its campaign, the Brand remains responsible for its instructions and legal basis; PoolHall processes that information to provide the Services and for the independent purposes described here. Third-party websites, social platforms, and creator tools have their own privacy practices.

2. Information We Collect

• Account and business data: name, work email, business/workspace name, profile, authentication provider, account role, and preferences.
• Campaign and marketplace data: briefs, products, claims, budgets, creator searches and assignments, messages, approvals, content, links, performance, and reporting data.
• Billing data: wallet balances, amounts, invoices, transactions, charge status, and Stripe customer/payment-method identifiers. Stripe receives and processes full card details; PoolHall does not need to store full card numbers.
• Communications: support requests, emails, calls, survey responses, feedback, and messages exchanged through connected services.
• Device, log, and evidence data: IP address, browser/device information, timestamps, requested pages, security events, session data, and versioned legal-acceptance evidence.
• AI inputs and outputs: prompts, campaign materials, uploaded or linked media, generated briefs/scripts, classifications, and quality or safety results.

Please do not submit government identifiers, health information, payment-card numbers, or other highly sensitive information unless PoolHall specifically requests it through an appropriate secured flow.

3. Sources

We collect information directly from you and your organization; automatically from browsers and the Services; from creators and marketplace activity; from connected social, measurement, app-store, and campaign services at your direction; from payment and authentication providers; and from public or commercially available sources used for product and campaign research.

4. How We Use Information

• create and secure accounts, sessions, workspaces, and acceptance records;
• provide campaigns, creator matching, communications, approvals, content workflows, analytics, and support;
• process deposits, subscriptions, creator disbursements, refunds, disputes, and accounting records;
• generate and evaluate AI-assisted materials and improve relevant product features;
• send transactional messages and, where permitted, product or marketing communications;
• measure email delivery, opens, or link activity when tracking is enabled;
• detect abuse, fraud, security incidents, policy violations, and technical problems;
• enforce agreements, investigate complaints, protect people and services, and establish or defend legal claims; and
• comply with legal, tax, audit, sanctions, and lawful-process obligations.

5. Cookies and Local Storage

PoolHall uses authentication/session cookies and browser local or session storage to keep users signed in, protect requests, preserve preferences, and support product workflows. Blocking essential storage may prevent the Services from working. The current self-serve surface is not intended to load nonessential advertising trackers by default. If we add advertising, cross-context behavioral, or nonessential analytics technologies, we will update this notice and provide consent or opt-out controls where required.

6. How We Disclose Information

We may disclose relevant information to:

• Creators and campaign participants to operate Brand campaigns and share briefs, assets, instructions, approvals, and necessary contact/context data.
• Service providers supporting cloud hosting, authentication, databases, storage, payments, communications, customer support, security, AI processing, content analysis, and product operations.
• Connected services such as social networks, attribution/measurement tools, app stores, or campaign systems when the integration or campaign requires it.
• Professional advisers and transaction parties for legal, accounting, insurance, financing, due diligence, merger, acquisition, reorganization, or asset sale purposes.
• Authorities and affected parties when reasonably necessary to comply with law, respond to lawful process, protect rights or safety, investigate misconduct, or address a security incident.

We do not disclose full payment-card details because Stripe processes those details directly.

7. Sale, Sharing, and Targeted Advertising

PoolHall does not sell personal information for money. We do not currently intend the self-serve Brand console to share personal information for cross-context behavioral advertising. Some state laws define “sale,” “sharing,” or targeted advertising broadly. If our practices change or a technology is determined to fall within those definitions, we will provide the required notice and opt-out method and honor legally recognized preference signals where required.

8. AI Processing

PoolHall may send prompts, campaign materials, media, and contextual data to AI and content-analysis providers, including providers made available through Google Cloud/Vertex AI and OpenAI, to generate, refine, classify, or review content. Do not submit material you lack authority to process. Human review may be used for safety, quality, support, or campaign operations. AI output can be inaccurate and should not contain sensitive personal information unless the workflow specifically requires and permits it.

9. International Processing

PoolHall and its providers may process information in the United States and other countries where they operate. Those locations may have different privacy laws. Where a legally required transfer mechanism applies, PoolHall will use an appropriate mechanism; this notice does not claim a particular mechanism for a transfer unless it has been implemented for that relationship.

10. Retention

We retain information for as long as reasonably necessary for the purposes described here, including the account and campaign lifecycle, financial and tax recordkeeping, creator/payment disputes, security, legal-acceptance evidence, enforcement, and legal claims. Retention varies by record type and considers contractual commitments, sensitivity, operational need, limitation periods, and legal requirements. Information is deleted, deidentified, or isolated when no longer reasonably needed, subject to backups and lawful holds. Contact privacy@poolhall.ai for information about a specific category.

11. Security

We use administrative, technical, and organizational safeguards designed for the nature of the Services, including access controls and managed cloud infrastructure. No system, transmission, credential, or storage method is completely secure. You must protect credentials, configure authorized access, and notify us promptly of suspected compromise.

12. Privacy Choices and Rights

Depending on your location and applicable law, you may request access, correction, deletion, or a copy of personal information; ask us to restrict or object to certain processing; withdraw consent where consent is the basis; opt out of certain sale/sharing/targeted advertising or profiling; or appeal a denied request. You may also opt out of marketing email through its unsubscribe link while continuing to receive transactional messages.

Submit requests to privacy@poolhall.ai and identify your state/country and request. We will verify the request proportionately, which may require account access or additional information. Authorized agents must provide proof of authority, and we may verify directly with the individual. We will not unlawfully discriminate for exercising a privacy right. If we deny an appealable request, reply with “Privacy Appeal” for review and information about any regulator complaint option.

13. California and Other U.S. State Notices

The categories described in Section 2 may include identifiers; customer-record information; commercial, internet/network, geolocation inferred from IP, professional/employment, audio-visual, and inference information. Sources, purposes, and recipient categories are described in Sections 3, 4, and 6. We do not knowingly use or disclose sensitive personal information to infer characteristics in a manner that triggers a right to limit. Applicable state residents may exercise the rights described in Section 12.

14. EEA, UK, and Similar Jurisdictions

Where applicable, PoolHall processes information to perform contracts and requested pre-contract steps; comply with legal obligations; pursue legitimate interests such as operating, securing, improving, and enforcing the Services; establish or defend claims; and obtain consent where required. You may have a right to complain to a local data-protection authority. Contact us for questions about the controller, legal basis, or transfer applicable to a specific processing activity.

15. Children

The Brand Services are for business representatives at least 18 years old and are not directed to children. Do not submit children's personal information unless a lawful, approved campaign workflow expressly requires it and all necessary parental/guardian permissions and protections are in place.

16. Changes

We may update this Policy to reflect legal, technical, or business changes. We will post the updated date and provide additional notice where required. Material Terms changes may require renewed contract acceptance; acknowledging this Privacy Policy records receipt of the notice and is not a waiver of rights.

17. Contact

PoolHall LLC
Privacy requests and questions: privacy@poolhall.ai
Legal notices: legal@poolhall.ai