Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how AM Now Developers ("AM Now Developers," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information obtained from visitors to our website at amnowdevelopers.com (the "Site"), users of our client portal at amnowdevelopers.com/client/ (the "Portal"), and clients who engage us for managed hosting, web development, AI and analytics, government IT solutions, custom software development, and related professional services (collectively, the "Services").

By accessing or using our Site or Services, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree with any part of this Policy, you should discontinue use of our Site and Services and contact us to resolve any concerns before proceeding.

This Policy applies to information collected:

• Directly from you when you submit a contact form, request a quote, register for our Portal, or communicate with us by phone or email;
• Automatically through your use of our Site, Portal, or hosted services via cookies, server logs, and analytics tools;
• From third-party service providers who assist us in delivering our Services, including our payment processor and cloud infrastructure partners;
• In the course of performing contracted services on behalf of our clients, including website data, server log data, and application data hosted on our infrastructure.

This Policy does not apply to third-party websites, services, or applications that may be linked to or integrated with our Site, even if those third parties share our branding or are referenced in our marketing materials. We encourage you to review the privacy policies of any third parties you interact with.

2. Who We Are

AM Now Developers is a technology consulting and managed services company incorporated and operating under the laws of the State of Texas, United States. We provide enterprise-grade managed hosting, web development, artificial intelligence and analytics solutions, government IT consulting, and custom software development to commercial businesses, nonprofit organizations, and government agencies.

We are the data controller with respect to personal information collected from visitors to our Site and from our clients' personnel who interact with our Portal and Services. With respect to data stored on our hosting infrastructure on behalf of clients, we act as a data processor, and our clients are the data controllers responsible for their own end-user data.

Our principal place of business is in Texas. All data governance, legal compliance, and privacy-related decisions are made from our Texas operations. Our primary privacy contact is:

3. Information We Collect

We collect several categories of information depending on how you interact with us.

Personal Information

Personal information is information that directly identifies you or that could reasonably be linked to your identity. We may collect the following personal information:

• Contact details: Full name, job title, company name, business email address, phone number, and mailing address submitted through our contact forms, quote requests, or service inquiries;
• Account credentials: Username and hashed password created when you register for the client Portal;
• Billing information: Billing address and payment card details submitted during checkout — note that full card numbers are handled exclusively by Stripe and are never stored on our servers (see Section 8);
• Communication content: Content of emails, support tickets, and chat messages you send to us, including any personal information voluntarily included in those communications;
• Digital signature data: Your typed or drawn signature, IP address at signing, timestamp, and device fingerprint captured when you execute contracts through our Portal.

Business Information

Because we serve business clients, we frequently collect information about the organizations our contacts represent, including:

• Legal business name, DBA names, and entity type;
• Federal Employer Identification Number (EIN) or equivalent business tax identifiers where required for contract execution;
• Business license numbers, DUNS/UEI numbers, and CAGE codes for government contract clients;
• Scope-of-work documents, project briefs, and technical specifications shared during engagement;
• Access credentials and API keys for third-party services we manage on your behalf (stored encrypted).

Technical and Usage Information

When you visit our Site or use our Portal, we automatically collect certain technical information, including:

• Internet Protocol (IP) address and approximate geographic location derived from IP;
• Browser type, version, and operating system;
• Device type, screen resolution, and hardware identifiers;
• Referring URL and pages visited on our Site;
• Date, time, and duration of visits;
• Clickstream data and interaction events (button clicks, scroll depth, form interactions);
• Session identifiers and authentication tokens used to maintain Portal sessions.

4. How We Collect Information

Contact and Quote Request Forms

Our Site contains contact forms and service inquiry forms that collect your name, email address, phone number, company name, and a description of your needs. Submission of these forms is entirely voluntary. The data you provide is transmitted over an encrypted HTTPS connection and stored in our internal systems for the purpose of responding to your inquiry and, if applicable, initiating a client relationship.

Client Portal Registration and Login

When you register for our client Portal, we collect the account information you provide, including your name, business email, and a password you create. Your password is never stored in plaintext — it is processed using bcrypt hashing with a per-user salt before storage. We also log authentication events (successful logins, failed login attempts, password resets) along with the IP address and timestamp of each event for security and audit purposes.

Cookies and Browser Storage

We use cookies, local storage, and similar browser-based technologies to operate our Site and Portal. These are described in detail in Section 6. You can manage cookie preferences through your browser settings or our cookie consent interface.

Server and Application Logs

Our web servers and application infrastructure automatically generate log files that record requests made to our systems. These logs include IP addresses, request URLs, HTTP status codes, response sizes, user agent strings, and timestamps. Logs are used for security monitoring, debugging, performance analysis, and abuse prevention.

Stripe Payment Processing

When you make a payment through our Site or Portal, you are redirected to or interact with a Stripe-hosted payment interface. Stripe collects your payment card number, expiration date, CVV, and billing address directly. We receive a payment confirmation token and basic transaction metadata from Stripe. We do not directly collect, transmit, or store raw payment card data. See Section 8 for full details.

Email Communications

When you email us directly or respond to our communications, we retain those emails as part of our client relationship records. Our email infrastructure may record metadata such as sender address, subject line, and timestamps to support our support ticket and CRM workflows.

Phone Calls

If you contact us by phone at (839) 839-8622, we may take notes during or after the call to document your inquiry. Calls are not recorded without prior notice and consent.

5. How We Use Your Information

We use the information we collect for specific, legitimate business purposes. We do not use your information for purposes that are incompatible with the reason it was collected without seeking your additional consent. Our purposes include:

Service Delivery

We use your information to fulfill contracted services, including setting up and managing hosting environments, delivering development projects, configuring integrations, and provisioning access to managed systems. Contact details and technical specifications are essential to performing our work.

Account Management and Portal Access

Account credentials and session data are used to authenticate you, maintain your Portal session, and enable access to project dashboards, invoices, contracts, support tickets, and other Portal features.

Billing, Invoicing, and Payment Processing

We use billing information to generate invoices, process payments through Stripe, manage subscription renewals, apply credits, and maintain accurate financial records as required by law and sound business practice.

Client Support and Communication

We use contact information and communication history to respond to support requests, provide project updates, schedule calls, and manage the ongoing client relationship. We may send transactional emails such as invoice notifications, service alerts, and contract signature requests.

Analytics and Service Improvement

Aggregated and anonymized usage data collected through Google Analytics 4 and our server logs is used to understand how visitors interact with our Site, identify high-demand content, detect and resolve performance bottlenecks, and make informed decisions about new features and service offerings.

Security and Fraud Prevention

IP addresses, login event logs, and request patterns are used to detect unauthorized access attempts, brute-force attacks, spam submissions, and other malicious activity. We may use this data to block abusive IP addresses and protect the integrity of our systems and our clients' data.

Legal and Regulatory Compliance

We retain and use certain records as required by applicable federal and Texas law, including financial records required for tax compliance, electronic signature records required for contract enforceability, and security incident logs.

Marketing Communications

With your consent or where permitted by applicable law, we may send periodic email communications about new services, case studies, industry insights, or promotional offers. You may unsubscribe from marketing emails at any time using the unsubscribe link in those emails or by contacting us at info@amnowdevelopers.com. Transactional emails related to your account or active services are not subject to marketing opt-out.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our Site and Portal. A cookie is a small text file placed on your device by a web server. Cookies do not contain executable code and cannot access other files on your device.

Session Cookies

Session cookies are temporary and are deleted when you close your browser. We use session cookies to maintain your authenticated state within the Portal, store temporary form data to prevent loss on page navigation, and pass security tokens (CSRF tokens) to protect form submissions from cross-site request forgery attacks.

Persistent Cookies

Persistent cookies remain on your device for a defined period. We use persistent cookies to remember your cookie consent preferences, maintain a "remember me" login state in the Portal (when you opt in), and store UI preferences such as table sort order or display settings.

Analytics Cookies

Google Analytics 4 places analytics cookies on your device (typically named _ga, _ga_XXXXXXXX, and related variants) to assign anonymous, pseudonymous identifiers to your browser and track session activity across our Site. This data is transmitted to Google's servers and processed as described in Section 7. Analytics cookies persist for up to 13 months.

Functional and Preference Cookies

We may use functional cookies to remember language preferences, form auto-fill state, and other interface customizations that improve your experience without collecting personally identifiable information.

Third-Party Cookies

Certain third-party services embedded or linked from our Site may set their own cookies. These include Google Fonts (loaded from fonts.googleapis.com), Google Tag Manager, and any third-party widgets integrated into specific pages. We do not control the cookie behavior of third parties. You should consult their respective privacy policies for details.

Managing Cookies

You may disable or delete cookies through your browser's settings. Note that disabling certain cookies — particularly session cookies — will impair Portal functionality, as authentication requires cookie support. You may also use browser extensions or privacy tools to block analytics cookies while retaining session functionality.

7. Google Analytics 4

Our Site uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC ("Google"). The GA4 tracking identifier used on this Site is G-FTRMF9KVHG.

Data Collected by Google Analytics

GA4 collects the following categories of data when you visit our Site:

• A pseudonymous client ID assigned to your browser (not your name or email);
• Pages visited, time on page, and scroll depth;
• Events such as button clicks, form interactions, file downloads, and outbound link clicks;
• Session and engagement metrics including session duration and bounce rate;
• Approximate geographic location derived from your IP address (country, region, city — not precise coordinates);
• Browser type, operating system, and device category;
• Traffic source, medium, and campaign parameters from UTM tags.

IP Anonymization

GA4 anonymizes IP addresses by default. Google does not store or use full IP addresses for analytics purposes. The IP address used to derive approximate location is discarded after the location lookup is performed.

Data Processing and Google's Role

Google processes analytics data on our behalf under Google's standard data processing terms. Google may also use aggregated, anonymized analytics data to improve its own products and services as permitted by its privacy policy. We do not share personally identifiable information with Google through GA4, and we have not enabled any GA4 features that link analytics data to Google Ads or other advertising products.

Opt-Out Options

You can opt out of Google Analytics tracking in the following ways:

• Install the Google Analytics Opt-out Browser Add-on available from Google;
• Enable "Do Not Track" in your browser (note: GA4 does not honor DNT by default, though we respect user opt-out signals where technically feasible);
• Use a privacy-focused browser extension such as uBlock Origin or Privacy Badger;
• Contact us at privacy@amnowdevelopers.com to request that we exclude your IP address from analytics processing where technically possible.

Google's full privacy policy is available at policies.google.com/privacy.

8. Stripe Payment Processing

All payment card transactions on our Site and Portal are processed by Stripe, Inc., a PCI DSS Level 1 certified payment processor headquartered in South San Francisco, California. We have integrated Stripe's hosted payment elements (Stripe Elements and/or Stripe Checkout) so that your payment card data is entered directly into a Stripe-controlled interface and transmitted over an encrypted connection to Stripe's servers.

What Stripe Receives

When you make a payment, Stripe collects and processes the following data on its own servers:

• Credit or debit card number, expiration date, and CVV/CVC;
• Billing name and billing address;
• Email address associated with the payment (for receipt delivery);
• IP address and device fingerprint for fraud detection;
• Transaction amount and currency.

What We Receive from Stripe

Upon successful payment authorization, Stripe provides us with:

• A payment intent ID and charge ID for our records;
• The last four digits of the card used (for display in your Portal invoice history);
• Card brand (e.g., Visa, Mastercard);
• Payment status (succeeded, failed, refunded);
• Billing address (used for invoice records only).

Stripe's Privacy Policy and Terms

Stripe's collection and use of your payment data is governed by Stripe's own Privacy Policy, available at stripe.com/privacy, and Stripe's Terms of Service at stripe.com/legal. By making a payment through our Site or Portal, you also agree to Stripe's terms.

Stored Payment Methods

If you authorize us to store a payment method for recurring billing or future use, Stripe stores your card details and provides us with a reusable payment method token. This token allows us to initiate future charges without requiring you to re-enter your card details. You may remove stored payment methods at any time through the Portal or by contacting us.

9. Contact Forms and Lead Data

Our Site includes contact forms, service inquiry forms, and quote request forms. When you submit one of these forms, the information you provide — including your name, email address, phone number, company name, and message content — is transmitted securely to our internal systems and reviewed by our team.

This data is used exclusively to respond to your inquiry and, where you proceed to become a client, to initiate and document our business relationship. We do not sell, trade, or rent contact form submissions to third-party marketers or list brokers.

Contact form submissions from individuals who do not proceed to become clients are retained for a period of twelve (12) months from the date of submission, after which they are deleted from our active systems. Inquiries that result in a client engagement are retained in accordance with the data retention schedule described in Section 15.

We may send an automated acknowledgment email when you submit a contact form. This email is transactional in nature and does not constitute marketing. It does not add you to a marketing list without your explicit consent.

10. Client Portal Data

Our client portal at amnowdevelopers.com/client/ is a secure web application through which clients manage their projects, invoices, contracts, support tickets, and service configurations.

Authentication and Session Data

Portal authentication uses JSON Web Tokens (JWT) with server-side session validation. Upon successful login, a JWT is issued and stored in an httpOnly, Secure, SameSite=Strict cookie to prevent client-side script access and cross-site request forgery. Session tokens expire after a configurable idle period and are invalidated upon logout.

Login Event Logging

Every authentication event — including successful logins, failed login attempts, password reset requests, and logouts — is recorded in an audit log. Each audit log entry captures:

• The account identifier (user ID) associated with the event;
• The IP address from which the request originated;
• The date and time of the event (UTC);
• The event type and outcome (success or failure);
• The user agent string of the browser or client used.

Login audit logs are retained for a minimum of twelve (12) months for security monitoring purposes and up to thirty-six (36) months where required for compliance with government contract requirements.

Activity Within the Portal

We log significant actions performed within the Portal, such as invoice downloads, contract executions, support ticket submissions, and service configuration changes. These activity logs support audit trails for our clients' records and our own compliance and quality-assurance processes.

IP Address Logging

IP addresses associated with Portal activity are retained in server and application logs. We use this data for security purposes, including detecting unauthorized access, session hijacking attempts, and anomalous activity patterns. IP addresses are not used for advertising targeting.

11. Managed Hosting Customer Data

Clients who subscribe to our managed hosting services entrust their website data, databases, files, application code, and end-user data to our hosting infrastructure. In this context, AM Now Developers acts as a data processor on behalf of the client, who is the data controller responsible for their end-users' personal information.

Our Obligations as Data Processor

We process hosted client data only in accordance with the client's instructions as documented in our Master Service Agreement and applicable data processing addenda. We do not access, analyze, share, or monetize client website data, databases, or application data except as necessary to:

• Provide, maintain, and troubleshoot the hosting services;
• Perform contracted maintenance, backups, and security monitoring;
• Respond to a support request initiated by the client;
• Comply with a valid legal order, subpoena, or government demand (in which case we will notify the client to the extent permitted by law).

Server Logs for Hosted Sites

Our hosting infrastructure generates server access logs for all websites hosted on our platform. These logs include IP addresses, request URLs, HTTP methods and status codes, referrers, and user agent strings of visitors to the hosted website. These logs belong to the client as the data controller. We retain them for operational and security purposes for up to ninety (90) days, after which they are automatically purged unless the client requests extended retention.

Backups

We perform automated backups of hosted environments as part of our managed hosting service. Backup data is encrypted at rest and in transit. Backups are retained according to the backup schedule specified in the client's service agreement (typically daily backups for 30 days and weekly backups for 90 days). Clients may request copies of their backup data at any time.

12. Digital Signatures and Electronic Records

AM Now Developers supports the execution of contracts, service agreements, statements of work, and other legal documents through electronic (digital) signatures via the client Portal. Our digital signature functionality is designed to produce legally enforceable electronic records under the federal Electronic Signatures in Global and National Commerce Act (E-SIGN Act, 15 U.S.C. § 7001 et seq.) and the Texas Uniform Electronic Transactions Act (TUETA, Tex. Bus. & Com. Code § 322.001 et seq.).

What We Capture at Signing

When you execute a document electronically through our Portal, we capture and permanently record:

• Your name and email address as entered in your Portal account;
• Your typed or drawn signature as presented in the signing interface;
• The IP address from which the signing action was performed;
• The precise date and time (UTC) of the signing event;
• A cryptographic hash of the document at the time of signing, enabling detection of any post-signature modification;
• The Portal session identifier active at the time of signing;
• A device fingerprint including browser user agent and screen characteristics.

Retention of Signed Documents

Signed contracts and their associated audit trails are retained for the longer of: (a) the duration of the client relationship plus seven (7) years; or (b) any longer period required by applicable law or the nature of the contract (e.g., government contracts may require longer retention). Signed documents are stored in encrypted form and are available for download by authorized Portal users at any time.

Your Consent to Electronic Signatures

By executing documents electronically through our Portal, you confirm your consent to the use of electronic signatures and agree that such signatures have the same legal effect as a handwritten signature. If you prefer to execute documents by wet ink signature, please contact us at legal@amnowdevelopers.com and we will accommodate that preference.

13. Data Sharing and Third-Party Providers

We do not share your personal information with third parties for their own marketing purposes. We share data only as described below, with vendors and partners who are contractually obligated to protect it and use it only for the specific purposes we authorize.

Service Providers and Sub-Processors

• Google LLC — We use Google Analytics 4 (with tracking ID G-FTRMF9KVHG) for website analytics and Google Fonts for typography rendering. Google processes analytics data as our service provider under Google's data processing terms. Google Fonts requests are made directly from your browser to Google's servers, which may result in Google receiving your IP address. We use the font preconnect method to minimize data exposure.
• Stripe, Inc. — Stripe processes payment card transactions as our payment processor. Stripe receives payment and billing data as described in Section 8. Stripe operates as an independent data controller for fraud prevention and its own compliance purposes under its Privacy Policy.
• Hosting Infrastructure Providers — Our hosting infrastructure may rely on datacenter and cloud infrastructure partners (including but not limited to tier-1 datacenter facilities in Texas and the continental United States). These infrastructure providers provide physical and virtual server resources and have no access to application-layer data. All infrastructure agreements include appropriate data protection terms.
• Email Service Providers — We use a business email provider for transactional and operational email delivery. Our email provider may process sender and recipient addresses, subject lines, and message content as necessary to deliver email. We do not use third-party email marketing automation platforms that would receive your data for cross-client tracking or profiling.
• Security and Monitoring Tools — We may use server-side security monitoring and intrusion detection software that processes log data, IP addresses, and traffic patterns for the purpose of protecting our systems and our clients' data.

Legal Disclosures

We may disclose personal information when we have a good-faith belief that disclosure is required to: (a) comply with a valid legal obligation, court order, subpoena, or government request; (b) protect the rights, property, or safety of AM Now Developers, our clients, or the public; (c) detect, prevent, or address fraud, security vulnerabilities, or technical issues; or (d) enforce our Terms of Service or other agreements. We will endeavor to provide affected clients advance notice of legal disclosures where permitted by law.

Business Transfers

In the event of a merger, acquisition, asset sale, or other corporate transaction involving AM Now Developers, personal information held in our systems may be transferred to the acquiring or successor entity as part of that transaction. We will provide notice of any such transfer and the opportunity to request deletion of your data where feasible and as permitted by applicable law.

14. Data We Do Not Sell

This commitment applies to all categories of personal information described in this Policy, including contact details, account credentials, billing information, communication content, analytics data, and hosted client data. We maintain this position as a matter of both legal compliance and core business principle — our clients are our customers, not our product.

We do share limited data with service providers as described in Section 13, but such sharing is for the purpose of delivering services to you and is governed by data processing agreements that prohibit the service provider from using your data for their own purposes.

15. Data Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The following table describes our standard retention periods by data category:

• Contact form submissions (non-converting leads): 12 months from submission date, then deleted;
• Client account and contact records: Duration of the client relationship plus 7 years after termination;
• Invoices and payment records: 7 years from invoice date (required for tax compliance under Texas and federal law);
• Executed contracts and digital signature audit trails: Duration of the client relationship plus 7 years, or as required by contract type;
• Portal authentication and login event logs: 12 months minimum; up to 36 months for government contract clients;
• Portal activity logs: 24 months from the date of the recorded activity;
• Website server access logs (amnowdevelopers.com): 90 days from log generation, then automatically purged;
• Hosted client website server logs: 90 days from log generation, then purged (unless client requests extended retention);
• Hosted client backup data: Per the schedule in the client's service agreement (typically 30 days for daily backups, 90 days for weekly backups);
• Google Analytics data: Governed by Google's retention settings, configured at 14 months of user-level data retention on our property;
• Support ticket communications: Duration of the client relationship plus 3 years;
• Email correspondence: Duration of the client relationship plus 3 years for client emails; 12 months for pre-sales correspondence from non-clients;
• Security incident reports: 5 years from the date of the incident.

At the end of applicable retention periods, data is securely deleted or anonymized such that it can no longer be associated with any individual. Backups containing personal data are purged on the backup rotation schedule described above.

16. Security Measures

We implement technical, organizational, and administrative safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Our security practices include:

Encryption

• In transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or TLS 1.3. We enforce HTTPS across our entire domain and use HSTS (HTTP Strict Transport Security) headers to prevent protocol downgrade attacks;
• At rest: Sensitive data stored in our databases — including credentials, signed document archives, and client configuration data — is encrypted at the storage layer using AES-256 encryption;
• Backups: All backup archives are encrypted prior to transfer to backup storage and remain encrypted throughout their retention period.

Password Security

Portal user passwords are never stored in plaintext. Passwords are hashed using the bcrypt algorithm with a per-user random salt and a work factor calibrated to current hardware capabilities. This ensures that even if our database were compromised, individual passwords could not be feasibly recovered.

Authentication Controls

Portal authentication uses JSON Web Tokens (JWT) with short expiry periods and server-side session validation. Portal sessions are invalidated upon explicit logout and after a configurable period of inactivity. We support and encourage multi-factor authentication for Portal accounts with elevated privileges.

Access Controls

Access to production systems and client data is restricted to authorized personnel on a need-to-know basis. We use role-based access control (RBAC) to enforce least-privilege principles. Administrative access to production databases and servers requires VPN or bastion host authentication with logging enabled.

Third-Party Security

We select service providers who maintain recognized security certifications and practices, including Stripe's PCI DSS Level 1 compliance and our infrastructure providers' SOC 2 compliance where applicable.

Limitation of Guarantees

While we implement these and other security measures and continuously evaluate and improve our security posture, no system connected to the internet can be guaranteed 100% secure. We encourage you to use strong, unique passwords for your Portal account and to report any suspected security vulnerabilities to info@amnowdevelopers.com promptly.

17. Children's Privacy

Our Site and Services are intended for use by business professionals, organizations, and adults who are at least eighteen (18) years of age. We do not knowingly collect personal information from children under the age of thirteen (13), and our Services are not directed to children.

If you are a parent or guardian and believe that we have inadvertently collected personal information from a child under the age of 13, please contact us immediately at privacy@amnowdevelopers.com. Upon verification of such a report, we will promptly delete the child's personal information from our records in accordance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.

We do not knowingly create accounts for, deliver services to, or enter into contracts with minors. If a client's website hosted on our infrastructure collects data from children, the client — as the data controller — is responsible for ensuring COPPA compliance for their own service.

18. Texas Residents' Rights (TDPSA)

The Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code § 541.001 et seq., grants Texas residents certain rights with respect to personal data processed by covered businesses. To the extent that AM Now Developers is subject to the TDPSA with respect to your personal data, the following rights apply:

Right to Know

You have the right to confirm whether we are processing your personal data and to access the personal data we hold about you in a portable, readily usable format.

Right to Correct

You have the right to request correction of inaccurate personal data we hold about you, taking into account the nature of the data and the purposes of processing.

Right to Delete

You have the right to request deletion of personal data we hold about you, subject to certain exceptions (including our need to retain data to complete a transaction, fulfill a legal obligation, exercise a legal claim, or comply with a governmental order).

Right to Data Portability

Where you have provided personal data to us and we process it in a structured, commonly used, machine-readable format, you may request a copy of that data.

Right to Opt Out of Certain Processing

You have the right to opt out of the processing of your personal data for purposes of (a) targeted advertising, (b) the sale of personal data, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects. As stated in Section 14, we do not sell personal data, engage in targeted advertising using your data, or profile individuals in ways that produce legally significant decisions. Accordingly, there is currently no processing of this type for which an opt-out is required, but you may contact us to exercise this right and receive confirmation.

Right to Appeal

If we decline to act on your privacy rights request, you have the right to appeal that decision within a reasonable period. To appeal, submit your appeal in writing to privacy@amnowdevelopers.com. We will respond to your appeal within sixty (60) days and will provide a written explanation of our decision. If your appeal is denied, you may contact the Texas Attorney General's office to submit a complaint.

How to Submit a TDPSA Request

To exercise any of the above rights, please submit a written request to privacy@amnowdevelopers.com with the subject line "TDPSA Privacy Request." We may request that you verify your identity before processing your request. We will respond within forty-five (45) days of receiving a verified request and may extend that period by an additional forty-five (45) days where reasonably necessary, with notice.

19. California Residents (CCPA/CPRA)

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), grants certain privacy rights to California residents where the business subject to CCPA/CPRA thresholds applies. AM Now Developers is a Texas-based company that primarily serves business clients. We do not operate retail consumer-facing services subject to the primary thresholds of the CCPA/CPRA at this time. However, we respect the spirit of California's privacy law and extend the following commitments to California residents who interact with our Site or Services:

• We do not sell personal information as defined under CCPA/CPRA;
• We do not share personal information for cross-context behavioral advertising;
• California residents may submit a request to know, delete, or correct their personal information by contacting us at privacy@amnowdevelopers.com;
• We will not discriminate against you for exercising any privacy rights;
• Sensitive personal information (as defined by CPRA) is processed only as necessary to provide requested services and is not used for advertising or secondary purposes.

If California's CCPA/CPRA fully applies to your situation and you have a specific rights request, please contact our privacy team and we will make a good-faith effort to accommodate your request consistent with applicable law.

20. Contacting Us About Privacy

We take privacy inquiries seriously and are committed to responding promptly and thoroughly. If you have questions about this Policy, want to exercise a data subject right, need to report a potential privacy issue, or wish to request access to, correction of, or deletion of your personal information, please contact our Privacy Office:

Please include your full name, contact information, the nature of your request, and any relevant account identifiers in your communication so we can respond efficiently. We will acknowledge receipt of your request within five (5) business days and provide a substantive response within the timeframes required by applicable law.

We may need to verify your identity before fulfilling certain requests to ensure we do not disclose information about you to an unauthorized person. Verification may include confirming your email address, account details, or other identifying information.

21. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the introduction of new services, changes in applicable law, or other operational needs. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page;
• Post a notice on our Site's homepage or in the Portal for a period of at least thirty (30) days following the change;
• For changes that materially affect your rights or how we handle previously collected data, send an email notification to current active clients using the email address on file.

Your continued use of our Site or Services after the effective date of a revised Policy constitutes your acknowledgment and acceptance of the changes. We encourage you to review this Policy periodically to stay informed about how we protect your information. The current version of this Policy is always available at amnowdevelopers.com/privacy-policy/.

If you disagree with any changes to this Policy, you may stop using our Site and Services and request deletion of your personal information as described in Section 20.

22. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Texas, United States, without regard to its conflict-of-law principles. Any disputes arising under or relating to this Privacy Policy that cannot be resolved informally shall be resolved in the courts of competent jurisdiction located in Texas, or through binding arbitration as provided in our Terms of Service, and you consent to personal jurisdiction in such courts or proceedings.

We comply with applicable United States federal and Texas state privacy laws, including but not limited to: the Texas Data Privacy and Security Act (TDPSA), the Children's Online Privacy Protection Act (COPPA), the Electronic Communications Privacy Act (ECPA), the Gramm-Leach-Bliley Act (GLBA) where applicable, and the federal Electronic Signatures in Global and National Commerce Act (E-SIGN Act). We also monitor developments in emerging state and federal privacy legislation and update our practices accordingly.

If any provision of this Policy is found to be unlawful, void, or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.