Privacy policy

Information you share

We collect the contact and business details you submit, your website goals, selected package, preferred domain, design preferences, content links, pages, features, integrations and other project notes. Please do not submit passwords, card details or private customer records in a project brief.

How we use it

We use your details to respond to your inquiry, prepare a scope and quote, communicate about the project and provide agreed services. Limited project details may be processed by an AI service to suggest follow-up questions. Contact details are excluded from that smart-question request; an ordinary confirmation is used if it is unavailable.

AI Studio accounts and websites

Your BAM customer account uses a password or email verification code and a secure session cookie. We store the name, business name and phone number you enter at signup or in account settings. Your projects remain in your BAM account. BAM stores your account identifier, email, briefs, brand images, website versions, hosting status and billing references. Your AI Studio brief and revision requests, including the business contact details you choose to publish, and a bounded selection of your uploaded logo and photos are processed by OpenAI to plan, write and review website content. Images provide visual context; they do not verify product prices or other business claims. Up to five optional private inspiration images may also be processed by OpenAI with a website generation request to guide visual mood, colors, typography and layout. These references are stored separately from website images and are not included in the public website, shared preview or source download. Uploading a reference does not start an AI request. You can remove a saved reference from the project; previously submitted AI requests and their saved results may still reflect it. Stored AI responses, draft copies and review results help recover interrupted generations and compare the result with your brief. Private project views and source downloads require your account. Shared feedback links expose their selected website version to people holding the link until it expires or is revoked. Publishing makes the selected website and its brand images public. We record your automatic-launch approval, the approved brief or saved website version, and launch status when you authorize that option at checkout. Temporary unsaved form details may be kept in your browser during sign-in.

Creative Studio and saved AI changes

Website, flyer and email campaign designs can include saved instructions for several pages or sections. We store your draft notes, selected targets, design versions, run approvals, request identifiers and usage records in your private BAM account. Saving or editing notes does not submit an AI request. When you explicitly confirm a generation or revision batch, we send the relevant business details, current design and collected instructions to OpenAI to create the requested result. Supplied branding or image references may be included where the tool supports them. Do not include private customer records, credentials or payment details in creative prompts.

Campaign recipient lists, unsubscribe records and delivery histories are not included in design-generation requests. Creating or revising an email design does not send a campaign. Saved designs remain associated with their source business, creation allowance and original access period so usage limits and duplicate-request protection can be enforced. Manual edits and downloads do not trigger AI processing.

Inquiries on hosted customer websites

When you submit a form on a BAM-hosted Essential or Plus website, BAM stores your name, email, optional phone number, message and any optional business-specific inquiry details you enter for that website’s owner. We send an email notification to the owner’s BAM account email and keep delivery status for retry and support. These inquiry messages are not sent to OpenAI. The owner can view messages in a private inbox and reply by email. Short-lived counters and hashed identifiers prevent abuse. Contact the business that operates the website about its use of your inquiry, or hello@bam.build for BAM privacy requests. Please do not send passwords, payment details or sensitive records.

Website sharing, feedback and results

Published websites include a public link-preview image made from approved business details and colors. Account Launch & Brand Kit exports for eligible website projects can include the business details, public website address, brand colors, uploaded logo and photos you select. We store your saved flyer designs, edits, source-project association and credit usage, including the original access-window dates, revision counters and request identifiers so you can return to saved downloads and use only the creation and revisions available in that flyer’s original launch or paid period. Sharing or downloading artwork does not automatically buy advertisements or publish it on a social network. Anyone you share the artwork with can see the business details included in that export. Anyone with an unexpired private review link can view its saved website version and other comments on that link, and submit their name and feedback. Owners can revoke these links; keep them private. Feedback is sent to OpenAI only when the owner reviews it and submits an AI revision request. Public website activity counts page views and email or phone-link clicks for the owner using a random browser-session identifier that rotates daily for each website. Activity records exclude names, contact details, IP addresses, full URLs and query strings and are retained for up to 90 days. Browser Do Not Track and Global Privacy Control preferences are respected. These approximate counts may include repeat visits and exclude blocked requests.

Saved drafts and project support

When you are signed in, unfinished custom briefs can be saved as you work so you can resume them from My projects. Saved AI briefs and custom drafts are available to authorized BAM administrators to help you complete your website. If you explicitly opt in, we may send up to two reminders about an unfinished project. We recheck the project and your account preferences before sending; reminders already queued are canceled when their saved version is no longer current, you resume, complete the relevant step or opt out. You can change reminder preferences in the project and switch optional email alerts off in Account settings. BAM staff actions, project progress and revision-round choices are logged for administration. Private team notes are not shown to customers.

Visitor accounts on Plus websites

Basic visitor accounts on a published Plus website are separate from BAM customer accounts. We store the visitor's email, display name, authentication session and inquiries associated with that account for the website's owner. Sign-in codes are short-lived and sessions use secure cookies. Website owners can view their member list and disable accounts in the private Business Hub in their BAM account. These basic accounts do not include payment, order or booking histories.

Domain registration

If you purchase a domain through BAM, we collect the registrant name, business name if supplied, email, phone and postal address required by the registrar. Registrant details are sent to Cloudflare and the relevant domain registry. Contact details are encrypted during provisioning; BAM retains order, consent and billing references. The domain is managed in BAM’s Cloudflare account with the customer named as registrant. Registry privacy and verification rules vary. Buying directly in your own Cloudflare account is also an option.

Connecting a domain you already own

You can add the DNS records we provide, or authorize BAM through Cloudflare if Cloudflare manages your DNS and the automatic connection option is available. Cloudflare displays the account permissions for your approval; its authorization may cover DNS access within the selected account. BAM uses that access only to verify the domain selected in My projects and install its website connection and certificate validation records. We do not change your email or root-domain records. Access tokens stay encrypted on the server while setup is in progress. BAM stops using each authorization after at most 20 minutes, removes its stored token when setup finishes or background processing detects expiration, and submits it for revocation. You can also revoke BAM access in your Cloudflare profile. We retain the domain connection, approval and setup status for service and support. If you approve replacement of an existing website at your www address, visitors will be directed to your approved BAM website.

Custom-project accounts and private links

New custom briefs save to your verified BAM account. Account-bound briefs require the matching account or an authorized BAM administrator to view. Earlier custom-project invitation links may allow access to the brief, agreed scope and payment progress to anyone holding the link; keep those links private. Signing in with the email used for an earlier inquiry lets you find that project in My projects. Contact hello@bam.build if you need help with access.

Private messages and AI help

Account messages are stored by BAM and are available to the customer and authorized BAM administrators. They are not sent to OpenAI. We record the sender, message, time and read status. Unread messages can trigger an email alert with a link to My projects; the message text is not included in the alert. Website readiness and hosting or domain reminders also use email. You can switch account alerts off in your account. Sign-in codes and essential payment emails are separate. Separately, the labeled AI help chat may send your question and up to six recent chat messages to OpenAI to answer general package and setup questions. Our help request disables stored AI response history and does not include your private project, invoice or account-message records. Help chat history stays in memory in the current page. Avoid sharing credentials, card details or sensitive information with either chat. Use billing@bam.build for invoice questions.

Payments and service providers

Stripe processes payments and invoices. Card and bank payment details are entered with Stripe, not in our intake form. BAM stores project amounts, invoice references and payment status for project administration. For account Hosting & Care we also record the websites you select, your agreed recurring price, subscription status and verified paid-period dates. These records determine hosting coverage and the shared paid-period flyer, custom email design and sending allowances; selecting a preference does not enroll you. Hosting, database, email and AI providers process the information needed for their service. We do not sell your personal information.

BAM business email campaigns

Authorized BAM administrators may import business names, owner names and email addresses to prepare business outreach. The campaign importer sends only those three selected fields to BAM; other CSV columns and the original CSV remain in the browser. We store the selected contacts, campaign content, send and delivery records, and unsubscribe or suppression status. Our email provider processes the recipient address and message for delivery. When BAM reply capture is activated, campaign-specific reply addresses route incoming replies into the private BAM admin inbox. We store the sender address, subject, plain-text message, campaign association and read status. Email content is untrusted; it is never executed or used to issue instructions. Attachments are not imported into this inbox. These campaign contacts and messages are not sent to OpenAI. Campaigns include an unsubscribe option. Unsubscribe requests, recorded bounces, complaints and administrative opt-outs are used to suppress further campaign sends, and importing the address again does not clear its suppression. You may also contact hello@bam.build about campaign messages. Campaign opt-out is separate from sign-in codes, project updates and essential billing emails.

Campaign information and abuse prevention

Inquiry records may include campaign tags, the referring website and the landing page so we can understand where requests originate. Short-lived counters and hashed identifiers help prevent spam and repeated requests. Raw IP addresses are not saved in the intake quota records. We also count views, selected actions and visible-tab activity on selected BAM pages using rotating daily identifiers, without advertising cookies or full browsing histories. Signed-in activity has a separate rotating identifier so the admin can see approximate active customer counts. Raw page query strings, form contents and passwords are not collected in activity events. Raw addresses are not saved in these activity records, which are kept for up to 90 days. Browser Do Not Track and Global Privacy Control preferences are respected. Shared networks and blocked requests can affect totals.

Optional flyer campaign results

Website owners can enable campaign links on individual flyers for their BAM-hosted AI website. These links contain an opaque flyer ID. When privacy preferences allow, a tab-scoped identifier connects subsequent visits and inquiries to that flyer. Page activity is retained for up to 90 days; the campaign attached to a saved inquiry follows that inquiry’s retention. Do Not Track and Global Privacy Control disable this attribution. This does not measure physical QR scans, confirm sales, collect arbitrary query strings or track activity across unrelated websites.

Customer business email workspaces

Eligible business owners can authorize BAM to configure an outgoing sender for their domain and manage campaigns in their BAM account. We store the sender name, domain, reply-to inbox, confirmed mailing footer, setup consent, ownership proof, DNS verification status and encrypted domain-scoped sending credentials. Our email provider processes the sending domain, recipient and message for delivery. Outgoing sender setup does not create an incoming mailbox or give BAM access to your existing inbox.

Each business has a separate contact list, campaign snapshots, delivery results and unsubscribe records. CSV imports send only the selected business name, owner name and email address; other columns and the original file stay in the browser. Campaign contact lists and delivery records are not sent to OpenAI. Business copy and design instructions are processed by OpenAI only when you explicitly run an AI design request in Creative Studio. A reviewed campaign preserves the message, branding, sender, mailing footer and selected recipients used for delivery. Its approved logo can be served through an unguessable campaign-image link so email apps can display it. Paid-period usage is recorded at account level to enforce the shared allowance. Authorized BAM administrators can review setup and delivery issues and pause a connection for support or abuse prevention; support preview does not authorize sending as the customer.

Unsubscribing suppresses future marketing from that business, not essential BAM sign-in or billing emails. A contact unsubscribed from one customer business is not automatically removed from another independent business’s consented list. Contact the business that sent the campaign, or hello@bam.build for BAM platform and privacy questions.

Retention and your choices

We retain project information as needed to respond to requests, provide services and maintain billing records. You can request access, correction or deletion by emailing hello@bam.build. Some financial records may need to be retained for accounting or legal obligations.

Contact

Project and privacy questions: hello@bam.build.
Invoices and billing: billing@bam.build.