Privacy Notice

1. Who We Are

Visionary Solution LLC is a Colorado limited liability company that operates three AI-powered business tools:

• BizDiag — AI business diagnostics for small businesses
• Flowcast — AI-powered cash flow forecasting
• EstimateAI — AI contractor estimation and job-site photo analysis

This Privacy Notice applies to all three products and our website at visionaryconsultant.net.

2. What Data We Collect

2.1 Data You Provide

2.2 Data Collected Automatically

2.3 CCPA Category Mapping

For California residents, the following maps our data to CCPA personal information categories (§1798.140(v)):

Sources: We collect data directly from you, automatically through your use of the Services, and from our authorized service providers.

3. How We Use Your Data

We do NOT: sell your personal information, use your data for advertising third-party products, build consumer profiles for credit/insurance/employment, or share individual data between tenants.

4. Lawful Basis for Processing

4.1 GDPR (EU/EEA Residents)

Under the GDPR, we process your personal data on the following lawful bases:

Where processing is based on consent, you may withdraw consent at any time by contacting privacy@visionarysolution.net. Withdrawal does not affect the lawfulness of processing before withdrawal.

4.2 CCPA/CPRA (California Residents)

Under the CCPA, we collect and use your personal information for the following business purposes:

• Providing our services as requested by you
• Auditing related to counting ad impressions or security
• Debugging to identify and repair errors
• Short-term, transient use (e.g., page customization)
• Service improvement and feature development
• Detecting and preventing fraud and security incidents

5. Data Sharing & Vendors

We share data with the following categories of third parties:

5.1 Other Disclosures

We may also disclose your information:

• To protect rights: As necessary to enforce our terms, protect our rights, or defend against legal claims
• Law enforcement: When required by law, subpoena, court order, or government request
• Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified via email)

5.2 Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with all vendors who process personal data on our behalf, in accordance with GDPR Article 28. These agreements ensure that processors handle your data only as instructed, implement appropriate security measures, and assist with data subject rights requests.

6. International Data Transfers

Our services are accessible globally. If you access our services from outside the United States, your data may be transferred to and processed in the United States and the European Union.

For transfers of personal data from the EU/EEA to the United States, we rely on the following safeguards:

• EU-U.S. Data Privacy Framework: We comply with the EU-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. This framework provides an adequate level of protection for personal data transferred from the EU to certified U.S. organizations.
• Standard Contractual Clauses (SCCs): Where the Data Privacy Framework does not apply, we implement the European Commission's Standard Contractual Clauses (2021 version) with our data processors to ensure appropriate safeguards for international transfers.
• Transfer Impact Assessments: We conduct transfer impact assessments to evaluate the adequacy of protection for personal data transferred to the United States, considering the legal framework and surveillance landscape.

Supabase hosts data in both the US and EU (Ireland). Cloudflare and Resend process data primarily in the US. Google Cloud API processing occurs in US data centers.

7. Your Rights

7.1 GDPR Rights (EU/EEA Residents)

If you are a resident of the EU/EEA, you have the following rights under the GDPR:

7.2 CCPA/CPRA Rights (California Residents)

If you are a California resident, you have the following rights under the CCPA/CPRA:

7.3 Exercising Your Rights

To exercise any of the rights above:

• Email us at privacy@visionarysolution.net
• Use the in-app account settings to export or delete your data
• Click the "Do Not Sell or Share My Personal Information" link
• Enable the Global Privacy Control signal in your browser

Response times: GDPR requests: within 30 days (extendable by 60 days for complex requests). CCPA requests: within 45 days (extendable by 45 days). Colorado CPA requests: within 45 days. We will acknowledge receipt within 5 business days.

Verification: We will verify your identity before processing your request, typically by matching your email address or account credentials. For sensitive requests (deletion, access), we may require additional verification.

Authorized agents: You may designate an authorized agent to submit requests on your behalf. We require proof of authorization and verification of your identity.

8. Colorado Privacy Rights

As a Colorado-domiciled company, we are subject to the Colorado Privacy Act (CPA), C.R.S. § 6-1-1301 et seq. Colorado consumers have the following rights:

8.1 Colorado Appeal Process

If we decline to take action on your privacy rights request, you have the right to appeal our decision within 45 days of receiving our response. To file an appeal:

• Email privacy@visionarysolution.net with the subject line "Privacy Appeal — [Your Name]"
• Include the date of your original request and our response
• Explain why you believe our decision should be reconsidered

We will respond to your appeal within 45 days. If your appeal is denied, you may file a complaint with the Colorado Attorney General's Office (see Section 15).

8.2 Universal Opt-Out & Colorado CPA

Colorado recognizes universal opt-out mechanisms. We honor the Global Privacy Control (GPC) signal as a valid opt-out request for the sale of personal data, targeted advertising, and profiling, as required by the CPA.

9. Do Not Sell or Share My Personal Information

California law requires us to provide a clear and conspicuous link titled "Do Not Sell or Share My Personal Information." Even though we do not sell or share your data, we provide this mechanism so you can formally register your opt-out preference:

Because we do not sell or share your personal information, exercising this right will not change how we treat your data — we already maintain the highest standard of not selling or sharing your information.

10. Global Privacy Control (GPC)

To enable GPC in your browser, install the Global Privacy Control extension or use a browser that supports it natively.

11. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this notice, comply with legal obligations, or resolve disputes.

Upon account deletion, we will delete your primary data within 14 days and purge it from backup systems within 30 days, except where retention is required by law. You may request an earlier deletion by contacting privacy@visionarysolution.net.

12. Data Security

We implement industry-standard technical and organizational measures to protect your personal data:

• Encryption in transit: TLS 1.2+ for all data in transit; TLS 1.3 where supported
• Encryption at rest: AES-256 encryption for stored data via Supabase/AWS infrastructure
• Row-Level Security (RLS): Every database table has RLS policies ensuring complete tenant isolation — your data is never visible to other users
• Authentication: Supabase Auth with secure password hashing; we never see your password
• Access controls: Least-privilege access; only authorized personnel and systems can access production data
• Audit logging: All data modifications are logged in an append-only audit log
• Incident response: Documented breach response plan with 72-hour supervisory authority notification (GDPR)
• Multi-tenant isolation: API endpoints validate tenant ownership before returning any records; cross-tenant data leakage is treated as a critical security incident

13. Children's Privacy

Our Services are business tools not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we discover that we have collected personal information from a child under 18, we will delete it promptly. If you believe we have inadvertently collected data from a minor, please contact us at privacy@visionarysolution.net.

14. Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Material changes: We will notify you via email at least 30 days before they take effect
• Non-material changes: Updated notice will be posted on this page with a revised effective date
• Version history: Prior versions are available upon request

We encourage you to review this page periodically to stay informed about how we protect your data.

15. Contact & Complaint Channels

If you are unsatisfied with our response to a privacy request, you have the right to lodge a complaint with the following authorities:

CCPA / California

Colorado

EU/EEA (GDPR)

Filing a complaint with a supervisory authority does not preclude you from seeking other remedies available under applicable law.