Privacy Notice

What we collect depends on your role in the Services, whether you are a permit applicant, design professional, contractor, or an official, employee, or contractor of an AHJ. The table below lists the categories; the subsection that follows describes data specific to plan review and inspection workflows.

Publicly available information. For Ollie, we may collect publicly available information about commercial properties and projects, such as news articles, reviews, property records, and other content published on public websites, to provide context for plan review and inspection analysis. This information may include the names of owners, operators, or contractors associated with a property. We do not purchase personal information from data brokers, and we do not collect personal information about you from social media platforms.

• Submitted Materials: plans, drawings, specifications, calculations, narratives, permit applications, inspection reports, photographs, correspondence, and related documents that you upload or connect for analysis or review. These may contain the names, contact details, license numbers, and seals of design professionals, owners, and contractors, and the addresses of the properties involved.
• Project and property information: project names, addresses, occupancy and construction details, permit numbers, and the AHJ involved.
• Inspection photographs and field data: photographs and notes you capture or upload. Photographs may carry embedded metadata such as the date, time, and GPS location where they were taken. We retain this metadata as part of the record.
• Workflow information: which Applicant Users and AHJ Users are associated with a project, comments exchanged between them, and the history of edits to AI output.

If you are an AHJ User, information you enter about applicants, property owners, and contractors is personal information about those people, and your AHJ is responsible for collecting it lawfully.

We use personal information to:

• Provide the Services: create and manage your account, verify your professional status or AHJ authorization, deliver the features you use, and enable communication between an applicant and the AHJ reviewers and inspectors on a shared project.
• Generate AI output: process the Content and Submitted Materials you provide through artificial intelligence, including large language models, computer vision, and document analysis systems operated by us and by third-party providers, to produce the analyses, summaries, suggested comments, and other output you request. AI output is provided for your consideration and does not constitute an approval, permit, inspection result, engineering opinion, or official code determination; see the Ollie Terms of Service.
• Improve and develop the Services: analyze how the Services are used, fix problems, develop new features, and evaluate and improve the accuracy of our AI systems. For model training and improvement outside your own Organization's account, we use data that has been de-identified or aggregated so that it does not identify any individual, Organization, project, or property. If your Organization has signed an agreement with us that limits this use, that agreement controls.
• Process payments: collect fees, send receipts, and investigate billing disputes.
• Communicate with you: send service announcements, security notices, administrative messages, and, where you have not opted out, information about features and offerings that may interest you.
• Keep the Services secure: detect, investigate, and prevent fraud, abuse, unauthorized access, and violations of our Terms of Service.
• Comply with law: respond to lawful requests from public authorities, courts, and regulators, including public records requests that apply to our government customers, and meet our legal, accounting, and tax obligations.
• Produce analytics: generate statistical, benchmarking, and trend information in de-identified and aggregated form, such as the volume of reviews by project type or common categories of plan deficiencies, for our business and for reporting to customers.

We do not use personal information to make automated decisions that produce legal or similarly significant effects about you. AI output in Ollie is reviewed and acted on by human reviewers and applicants, and only an AHJ can approve, reject, permit, or inspect.

We share personal information only as described here.

• With other users, as the Services are designed to work. Submitted Materials, comments, and AI output on a project are shared between the Applicant Users and AHJ Users associated with that project. Your name, role, and Organization are visible to the other users on your projects. Anything you share with another user may be retained and used by them, and anything shared with an AHJ may become a public record (see Section 6).
• With your Organization. If your account is provisioned or paid for by an Organization, that Organization and its administrators may access your account information, Content, and usage data.
• With service providers (subprocessors). We use third-party providers who process personal information on our behalf and under contracts that restrict their use of it. Current categories are: cloud hosting and storage; AI model and inference providers; payment processing (Stripe); email and notification delivery; customer support tools; analytics and error monitoring; and identity verification. A current list of subprocessors is available on request at legal@highnoteai.com. Our AI providers are contractually prohibited from using your Content or Submitted Materials to train their own models.
• To comply with law and protect rights. We may disclose information when we believe in good faith that disclosure is required by law, subpoena, court order, or governmental request, including public records requests directed to us concerning a government customer's data, or is necessary to investigate or prevent fraud, security incidents, or violations of our Terms of Service, or to protect the rights, property, or safety of Highnote, our users, or others.
• In a business transaction. We may share or transfer information in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to this Notice or a successor notice that provides comparable protection.
• With affiliates. We may share information with entities under common control with Highnote, which will honor this Notice.
• With your consent or at your direction, such as when you ask us to export data to another system.

We may share de-identified or aggregated information, which does not identify you, your Organization, or a specific project or property, for any purpose.

When you pay for the Services, including per-review or per-project fees in Ollie, the fee is displayed in the Services and you authorize payment within the app. Payments are processed by Stripe, Inc. Stripe collects your payment card or bank details directly; Highnote receives and stores only a payment token, the card brand and last four digits, your billing name and address, and transaction records. Stripe's handling of your payment information is governed by its own privacy policy, available at stripe.com/privacy. We retain transaction records for as long as needed for accounting, tax, and dispute purposes.

We and our service providers use cookies, local storage, software development kits, and similar technologies to keep you signed in, remember your preferences, secure the Services, understand how the Services are used, and diagnose errors. We use these technologies for:

• Strictly necessary purposes: authentication, session management, security, and load balancing. These cannot be disabled without breaking the Services.
• Analytics and performance: understanding which features are used and how the Services perform. This data is used by us and our analytics providers only to improve the Services.

We do not display third-party advertisements in the Services and do not use advertising cookies or share your data with advertising networks for targeted advertising. If this changes, we will update this Notice and provide an opt-out before doing so.

You can control cookies through your browser settings. Rejecting cookies may affect your ability to use some features. The Services recognize Global Privacy Control signals sent by your browser and treat them as a request to opt out of any sale or sharing of personal information and any targeted advertising, to the extent applicable.

We do not respond to other "Do Not Track" signals because there is no common industry standard for them.

We keep personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. In general:

We may retain information longer where required by law, litigation hold, or a government customer's records retention schedule. Backups are overwritten on a rolling basis and may hold deleted data for a limited period before they cycle out.

We use technical and organizational measures designed to protect personal information, including encryption in transit using TLS, encryption at rest using AES-256, role-based access controls, logging and monitoring, and contractual security obligations for our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for using the Services from a secure environment.

If we discover a breach of security affecting your personal information, we will notify you and any affected Organization without unreasonable delay and in the manner required by applicable law and by our agreements with customers. Report suspected security issues to legal@highnoteai.com.

Depending on where you live, you may have some or all of the following rights under state privacy laws such as the Texas Data Privacy and Security Act and the California Consumer Privacy Act. We extend these rights to all users of the Services regardless of location, subject to verification and the limits described below.

• Access: confirm whether we process your personal information and obtain a copy of it.
• Correction: correct inaccurate personal information. You can update most account and profile information directly in the Services.
• Deletion: request deletion of personal information we hold about you.
• Portability: receive a copy of the personal information you provided to us in a portable, readily usable format.
• Opt out: opt out of the sale of personal information, sharing for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not currently do any of these.
• Non-discrimination: we will not deny you the Services, charge you a different price, or provide a different level of service because you exercised a privacy right, except where a difference is reasonably related to the value of your data or required to provide a feature you requested.

How to exercise your rights. Email legal@highnoteai.com, or write to the address in Section 10, with the subject line "Privacy Request" and a description of the request. You may also use any request form available in your account settings. We will verify your identity by matching the request to the email address on your account and, where needed, asking for additional confirmation. An authorized agent may submit a request on your behalf if they provide written authorization from you and we are able to verify your identity. We will respond within 45 days, and may extend that period by a further 45 days where reasonably necessary, in which case we will tell you. We do not charge a fee for up to two requests in a 12-month period; we may charge a reasonable fee or decline requests that are manifestly unfounded, excessive, or repetitive.

Limits. We may decline a request where the information is needed to provide a Service you have requested, to comply with a legal obligation, to maintain records required by law, to defend legal claims, or where we hold the information only as a processor for your Organization. In that last case we will refer your request to your Organization, which is responsible for responding to it.

Appeals. If we decline your request in whole or in part, you may appeal by replying to our response or emailing legal@highnoteai.com with the subject line "Privacy Appeal" within 60 days. We will respond to your appeal in writing within 60 days with the reasons for our decision. If you are not satisfied with the result, you may contact your state attorney general. Texas residents may contact the Texas Attorney General's Consumer Protection Division at texasattorneygeneral.gov.

Marketing choices. You can unsubscribe from marketing emails using the link in any such email. You will continue to receive service and administrative messages.

Account deletion. You can request deletion of your account at any time at legal@highnoteai.com. Deleting an individual account does not delete Content you shared with an Organization or AHJ, which that Organization controls.

Minors. The Services are intended for adults. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will deactivate the account and delete the information. If you believe we have collected information from a person under 18, contact us at legal@highnoteai.com.

International users. The Services are intended for users in the United States, and we store and process information in the United States. If you access the Services from outside the United States, you consent to the transfer of your information to the United States, where privacy laws may differ from those in your country.

Third-party websites and services. The Services may link to or integrate with third-party websites, permitting systems, document platforms, and other services that we do not control. Their privacy practices are governed by their own notices, and we are not responsible for them.

Changes to this Notice. We may update this Notice from time to time. The "Last Revised" date at the top shows when it last changed. If we make material changes, we will notify you by posting a notice in the Services, by email, or by requiring you to review the updated Notice at your next sign-in, before the changes take effect where required by law. Your continued use of the Services after the effective date means you accept the updated Notice.

Contact us. For questions, requests, or complaints about this Notice or our privacy practices:

Highnote, Inc. Attention: Privacy Coordinator PO Box 5088 Austin, TX 78763 legal@highnoteai.com