Consumer Privacy Policy

Effective Date: January 7, 2025

This Consumer Privacy Policy describes the types of information gathered by Shovels, Inc. (“Shovels”, “us” or “we”) in the process of providing data products and data-related services, (collectively, the “Services”), how we use it, with whom the information may be shared, what choices are available to you regarding collection, use and distribution of information, and our efforts to protect the information we access. It is important that you take the time to read and understand this Consumer Privacy Policy so that you can appreciate how we gather and use your personal information (“PI”), and understand your privacy rights and choices.

About Shovels – Our Services and Our Customers

Shovels aggregates, analyzes, and enriches building permit information for residential and commercial construction to help enterprise customers such as construction companies and contractors (“Customer(s)”) market and sell services and products (“Use Case”).

We collect personal information (“PI”) of individuals (“Individuals”) from both publicly available information, such as government entities (“Public Sources”) as well as from private providers, such as third-party data aggregators and brokers (“Providers”).

The PI about Individuals we typically access is a combination of the following: names; addresses; email addresses (personal and professional); hashed emails; phone numbers (personal and professional); employment information (current employer, title, history, status, and level); information about their current employer; whether the phone number(s) and email address(es) provided are still valid for the Individual; the Individual’s education; the Individual’s marital and family status; age/date of birth, gender; and socioeconomic status.

Shovels does not knowingly collect or access the PI of any non-U.S. resident or child under the age of 18. We will retain PI for as long as needed to provide the Services to our Customers, and as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

1. Who Collects the PI Incorporated in our Services?

Shovels obtains publicly available PI from Public Sources. Shovels also licenses and purchases certain PI from Providers. Providers are responsible for notifying Individuals of the Providers’ collection of PI, and for obtaining any required consents from the Individuals to allow them to lawfully disclose the Individuals’ PI for use in the development and licensing of our Services. Providers may collect PI through the methods disclosed in their respective privacy policies.

2. What PI Is Collected?

Shovels collects the following PI from or about consumers from Public Sources as well as from Providers (as categorized by the California Consumer Privacy Act of 2018, as amended (the “CCPA”)):

• Identifiers such as name, mailing address (both personal and professional), email address (both personal and professional), hashed emails, phone number (both personal and professional), whether the phone number(s) and email address(es) are still valid, , the Individual’s marital status and family information, and socioeconomic status;
• Personal information categories identified in the California customer records statute such as the Individual’s name, mailing address (both personal and professional), email address (both personal and professional), phone number (both personal and professional), education, and employment history;
• Characteristics of protected classifications, namely as an Individual’s gender and age/date of birth;
• Professional or employment information, including, but not limited to an Individual’s current employer, title, level of seniority, employment history, publicly available education information (such as institutions attended, degrees obtained, and majors), and information about their current employer;
• Geolocation data, namely, latitude and longitude data about Individuals; and
• Inferences drawn from any of the information identified above including behavioral and intent data (i.e., comparison shopping, ready to purchase).

We do not collect or process commercial information; biometric information; sensory data; non-public education information; or sensitive personal information.

3. How Do We Use the PI?

We use the PI of Individuals for the following purposes:

• Provide Services to Our Customers. We use the PI in order to provide the Services that we offer to our Customers so that they may pursue their individual Use Cases.
• Internal Uses. We may use PI to develop and improve the Services, prevent security issues, enforcing the written agreements we have with Customers, and to perform analytics on the use of the Services and functionality issues that may arise.
• AI Training. We may use PI to train, develop, and improve the artificial intelligence models and algorithms that we have created, or otherwise have rights to (collectively, “AI Models”). Our AI Models contribute to the Services by working to match similar records and to collate them into a single identity.
• Product Development. We may also use PI to develop new products and services.
• Aggregate/De-Identified Information. We may aggregate and/or de-identify any PI collected through the Services so that such information can no longer be linked to an Individual (“Aggregate/De-Identified Information”). Because it is no longer PI, we may use Aggregate/De-Identified Information for any purpose, including without limitation for research purposes, and may also share such data with any third parties in our discretion.

4. Do We Share PI?

We will not share PI except: (a) for the Use Case as defined in this Consumer Privacy Policy, and, in the case of PI obtained from Providers, only on the basis that the Providers provided necessary notices to, and obtained required consents from, the Individuals; (b) with the consent of the Individual; (c) as may be required by law or as we think necessary to protect our organization or others from injury (e.g., in response to a court order or subpoena, in response to a law enforcement agency request, or when we believe that someone is causing, or is about to cause, injury to or interference with the rights or property of another); (d) with persons or organizations (including affiliates) with whom we contract to perform services for us, including the performance, or development of, aspects of the Services and other internal operations or business activities Shovels; and except to the extent that an Individual has opted out of having their PI included in the Services (provided here, [LINK TO SHOVELS OPT OUT]). Customers may transmit or share Individual PI subject to the Master Services Agreement we have in place with each respective Customer.

We may also share Aggregate/De-Identified Information with others, including affiliated and non-affiliated entities.

Finally, we may transfer PI to another party (affiliated or non-affiliated), or our successor-in-interest, in relation to, or in the event of, a merger, acquisition, sale of all or substantially all of our assets, reorganization, bankruptcy, or other change of control. After such disclosure or transfer, the third party or successor in interest may use the PI in accordance with this Consumer Privacy Policy.

5. How Can Individuals Exercise Privacy Rights?

In order to access and/or control their PI, Individuals may email us at [PROVIDE EMAIL ADDRESS] to access their PI that we have collected, or correct errors in such PI.

If an Individual would like to opt out of their PI being included (on a forward-looking basis) in our Services, they may do so here, [PROVIDE LINK (SAME AS ABOVE)]. It should be noted that, even after opting out, Individuals may still see ads or be contacted by Customers that obtained access to their PI before it was removed from our Services. We may retain some PI after an opt out to the extent necessary to honor an Individual’s request in the future.

We do not control Providers’ collection or use of the PI of an Individual including, but not limited to, serving interest-based advertising. However, our Providers may provide Individuals with ways to choose not to have your PI collected or used in this way. To the extent our Customers email Individuals for commercial purposes, Individuals should proceed to locate an “Unsubscribe” link at the bottom of each such email to opt out of receiving further emails of that nature.

To protect privacy and security of Individuals, we will take reasonable steps to help verify their identity before granting access, making corrections, or removing your PI.

6. How We Store, Protect, and Retain Your PI

A. After receiving PI, we will store it on our servers for future use. We have physical, electronic, and managerial procedures in place to safeguard and help prevent unauthorized access, maintain data security, and correctly use the PI we collect from Public Sources and Providers. Unfortunately, no data transmission over the internet or data storage solution can ever be completely secure. As a result, although we take industry-standard steps to protect your PI (e.g., strong encryption, multifactor authentication, database monitoring, and limiting access to only those employees whose job function truly requires access to the PI), we cannot ensure or warrant the security of any PI that is transmitted to or received by us or that we store on our or our service providers’ systems. Similarly, our Customers access and use the Services, which includes access to the PI of Individuals, and we cannot ensure or warrant the security or handling by our Customers of such PI, whether on the Customers’ systems, or as part of their respective Use Cases.

B. We store PI until the earlier of (i) it no longer being necessary to fulfill our business purposes, namely to provide Services to the Customer(s), i.e., until the termination of the, or Shovels has determined that the PI is no longer accurate; or (ii) our receipt of an Individual’s opt-out request, or that we delete the PI/remove the PI from our servers. We will use commercially reasonable efforts to remove the affected PI from our Services and/or system within 30 days of the first to occur of either (i) or (ii).

7. Children and Young People’s PI

We do not knowingly collect any PI from any minors, and we comply with all applicable privacy laws including the CCPA, and the Children’s Online Privacy Protection Act (“COPPA”), and associated Federal Trade Commission (“FTC”) rules for collecting PI from minors. Please see the FTC’s website (www.ftc.gov) for more information. If you have concerns about our Services, wish to find out if your child has accessed our Services, or wish to remove your child’s PI from our servers, please contact us at legal@shovels.ai. Our Service will not knowingly accept PI from anyone under 13 years old in violation of applicable laws, without consent of a parent or guardian. If that we discover that a child under the age of 13 has provided PI to us, we will make efforts to delete the child’s PI in accordance with the COPPA. If you believe that your child under 13 has gained access to our Service without your permission, please contact us at legal@shovels.ai.

9. General Privacy Rights

Individuals have the following rights with respect to our practices regarding their PI:

A. Individuals have the following rights with respect to our practices regarding their PI:

• The right of access. This is an Individual’s right to be informed about what PI of theirs we are processing, why, and who else the data may be passed to.
• The right to correct. This is the right of an Individual to have its PI corrected or amended if what is held is incorrect in some way.
• The right to deletion. Subject to certain exceptions, and limitations, this is an Individual’s right to have its PI deleted.
• Right to Non-Discrimination. If an Individual exercises one of their other rights described in this policy, we won’t treat the Individual differently in terms of the goods or services available to the Individual from Shovels, if any.

B. Exercising Your Rights. Instructions for enforcing some of rights can be found in Section 5 and elsewhere in this Consumer Privacy Policy. Otherwise, if an Individual wishes to find out more about, or to exercise, any of its rights as described in this Consumer Privacy Policy, please contact us at legal@shovels.ai and include “Privacy Rights Request” in the subject line of the email. We will acknowledge receipt of an Individual’s request within 10 days of receiving it, and will do our very best to respond within 30 days of receipt of the request, and in no event will our response come more than 90 days after receiving the request.

Before we respond to any requests relating to your PI, we will take steps to reasonably verify the identity of the person making the request (“Requestor”) to make sure it is you, or your authorized agent. We do this to make sure we are sending it to the Individual, or someone the Individual has approved, not to inconvenience the Requestor. As the sensitivity of the PI relating to the request increases, we will do more to verify the Requestor’s identity, in order to properly protect this PI. If someone is making a request on your behalf, we will need to also verify that person’s identity and if they can truly act on an Individual’s behalf. If the identity of the Requestor cannot be reasonably verified, as you or someone acting on an Individual’s behalf, then in order to protect that Individual, we shall deny the applicable request(s).

10. Notice to California Residents

The California Consumer Privacy Act, as amended (“CCPA”) applies to our practices with respect to PI of people residing in California (“Consumers”), collected from Public Sources and Providers. In addition to the rights described in Section 9 above, under the CCPA, Consumers have certain rights regarding their PI.

A. Additional Information Regarding Your Right to Access (Collect). As a Consumer, your Right of Access in Section 9 includes any PI we have collected about you and disclosed in the previous 12 months including the categories of PI collected by us, the specific pieces of PI collected, the source(s) of such PI, and the purpose for collecting such PI. In the previous 12 months, we have collected the categories of PI about Consumers as disclosed in Section 2.

We collect PI for the purposes described in Section 3 above, and as required to comply with applicable law.

B. Right to Access (Sale/Share). As a Consumer, you also have the right to request that we tell you which of your PI we have disclosed, sold, and/or shared in the previous 12 months. With respect to PI being disclosed, the Consumer shall receive the specific pieces of PI disclosed, sold, or shared, and the types of entities that receive this PI. In the past 12 months, we have disclosed and shared PI falling under the following categories:

• Identifiers such as name, mailing address (both personal and professional), email address (both personal and professional), hashed emails, phone number (both personal and professional), whether the phone number(s) and email address(es) are still valid, IP address, unique personal identifier, the Individual’s marital status and family information, and socioeconomic status;
• PI categories identified in the California customer records statute such as the Individual’s name, mailing address (both personal and professional), email address (both personal and professional), phone number (both personal and professional), education, and employment history;
• Characteristics of protected classifications, namely as an Individual’s gender and age/date of birth;
• Professional or employment information, including, but not limited to an Individual’s current employer, title, level of seniority, employment history, publicly available education information (such as institutions attended, degrees obtained, and majors), and information about their current employer;
• Geolocation data, namely, latitude and longitude data about Individuals is collected as part of digital ad placement data; and
• Inferences drawn from any of the categories identified above including behavioral and intent data (i.e., comparison shopping, ready to purchase).

In the past 12 months, we have sold services that include PI falling under the following categories:

• Identifiers such as name, mailing address (both personal and professional), email address (both personal and professional), hashed emails, phone number (both personal and professional), whether the phone number(s) and email address(es) are still valid, IP address, unique personal identifier, the Individual’s marital status and family information, and socioeconomic status;
• Personal information categories identified in the California customer records statute such as the Individual’s name, mailing address (both personal and professional), email address (both personal and professional), phone number (both personal and professional), education, and employment history;
• Characteristics of protected classifications, namely an Individual’s gender and age/date of birth;
• Professional or employment information, including, but not limited to an Individual’s current employer, title, level of seniority, employment history, publicly available education information (such as institutions attended, degrees obtained, and majors), and information about their current employer; and
• Inferences drawn from any of the categories identified above including behavioral and intent data (i.e., comparison shopping, ready to purchase).

C. Right to Limit the Use and Disclosure of Sensitive Personal Information. Consumers may, at any time, request that we cease using or disclosing any sensitive personal information that we have received about them to only such uses as permitted by the CCPA. In the past 12 months, we may have inadvertently collected or received sensitive personal information from Providers, and unfortunately, we may again in the future. We use our AI Models and other commercially reasonable means to filter this sensitive personal information within our system so that it is not shared with, disclosed to, or sold to any third parties, though we cannot guarantee our efforts will prevent all such data from being disclosed, sold, or shared.

D. Right to Opt-Out of Selling and/or Sharing of Your PI. Consumers have the right to opt-out of the “sale” or “sharing” of their PI to third parties, including when we do so to track you across sites that we don’t own to serve you targeted ads. You can request that all or a portion of your PI in our possession or control not be “sold” or “shared” by clicking the “Do Not Sell or Share My Info” link, available here https://www.shovels.ai/contact, or through the Shovels website () and following the instructions to submit your request.

E. Right to Opt-In. If you are a Consumer under the age of 16, or have previously elected to opt out of the sale (as defined in the CCPA) or sharing of your PI, you may elect to opt in, or back in, as applicable. The opt-in process will require a two-step verification to confirm your election, and will be governed by the disclosures, policies, and procedures described here, in our Privacy Policy. You can opt-in by e-mailing us at legal@shovels.ai with “Opt-In to the Sale or Sharing of My Personal Information” in the subject line and your first and last name, email address.

As part of our on-going compliance efforts, below are the metrics for our CCPA responsiveness in the previous calendar year:

11. Notice to Nevada Residents

If you are a Nevada resident, we “sell” your “covered information” as such terms are defined in Chapter 603A of the Nevada Revised Statutes (“Nevada Privacy Law” or “NPL”). To exercise this right, please follow the process described in Section 9B above. As someone that is subject to the NPL, under your Right of Access described in Section 9, you are entitled to additional information about what PI of yours that we have or use. For this information, please see Sections 2 and 10 for the PI we have collected, sold, and disclosed. Please note that defined terms, such as “sell” may have a different definition under the NPL than they do under the CCPA.

12. Notice to Virginia Residents

If you are a Virginia resident, this section and the Virginia Consumer Data Protection Act (the “VaCDPA”) also apply to you.

A. As someone that is subject to the VaCDPA, under your Right of Access described in Section 9, you are entitled to additional information about the PI of yours that we have or process. For this information, please see Sections 2 and 10 above the categories of PI we have collected, sold, and disclosed. Please note that defined terms, such as “sell” may have a different definition under the VaCDPA than they do under the CCPA.

B. Additional Rights for Virginia Residents. In addition to the rights described in Section 9 above, under the VaCDPA, consumers have the following rights:

• The Right to Opt-Out of Sales of Your PI. You may opt-out of such sales at any time.
• The Right to Opt-In to the Use of Your Sensitive Personal Information. Five by Five will not process your sensitive personal information without first obtaining your consent to do so.
• The Right to Opt-Out of Profiling. You may opt-out of automated processing of PI to make decisions that produce legal or very significant effects on you.
• The Right to Opt-Out of Targeted Advertising. As a Virginia consumer, you may also be able to opt-out of targeted advertising based on your activity on websites that we do not own. You may still see generic ads, and ads based on what you do on the Internet, even if you exercise this right.
• Right to Appeal Denial. If we deny your request to exercise rights under the VaCDPA, we will tell you why, and will have the right to appeal our decision by emailing us at legal@shovels.ai with “VaCDPA Appeal” in the subject line. If we deny your appeal, you have the right to submit a complaint to the Virginia Attorney General’s Office at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

13. Notice to Connecticut Residents

If you are a Connecticut resident, this section and the Connecticut Data Privacy Act (the “CTDPA”) also apply to you.

A. As someone that is subject to the CTDPA, under your Right of Access described in Section 9, you are entitled to additional information about the PI of yours that we have or process. For this information, please see Sections 2 and 10 above, specifically the subsections on the Right of Access and what categories are collected, sold, and disclosed. Please note that defined terms may vary among different state laws, and that the CTDPA definitions of certain terms apply to this Section 13, and your reading of Section 10 in reference to this Section.

B. Additional Rights for Connecticut Residents. In addition to the rights described in Section 9 above, under the CTDPA, Connecticut residents have the following rights:

• The Right to Opt-Out of Profiling. You may opt-out of automated processing of PI to make decisions that produce legal or very significant effects on you.
• The Right to Opt-Out of Targeted Advertising. As a Connecticut consumer, you may also be able to opt-out of targeted advertising based on your activity on websites that we don’t own. You may still see generic ads, and ads based on what you do on the Internet, even if you exercise this right.
• Right to Appeal Denial. If we deny your request to exercise rights under the CTDPA, we will tell you why, and you will have the right to appeal our decision by emailing us at legal@shovels.ai with “CTDPA Appeal” in the subject line. If we deny your appeal, you have the right to submit a complaint to the Connecticut Attorney General’s Office.

14. Notice to Colorado Residents

If you are a Colorado resident, this section and the Colorado Privacy Act (the “CPA”) also apply to you.

A. As someone that is subject to the CPA, under your Right of Access described in Section 9, you are entitled to additional information about the PI of yours that we have or process. For this information, please see Sections 2 and 10 above, specifically the subsections on the Right of Access and what categories are collected, sold, and disclosed. Please note that defined terms may vary among different state laws, and that the CPA definitions of certain terms apply to this Section 14, and your reading of Section 10 in reference to this Section.

B. Additional Rights for Colorado Residents. In addition to the rights described in Section 9 above, under the CPA, Colorado residents have the following rights:

• The Right to Opt-Out of Profiling. You may opt-out of automated processing of PI to make decisions that produce legal or very significant effects on you.
• The Right to Opt-Out of Targeted Advertising. As a Colorado resident, you may also be able to opt-out of targeted advertising based on your activity on websites we don’t own. Please be aware, if you do exercise this right, you may still see generic ads on the Internet based on that activity.
• Right to Appeal Denial. If we deny your request to exercise rights under the CPA, you will be notified of the basis for such denial, and will have the right to appeal such denial by emailing us at legal@shovels.ai with “CPA Appeal” in the subject line. If we deny your appeal, you have the right to contact the Colorado Attorney General’s Office to submit a complaint.

15. Notice to Utah Residents

If you are a Utah resident, this section and the Utah Consumer Privacy Act (the “UCPA”) will apply to you as of December 31, 2023.

A. As someone that is subject to the UCPA, under your Right of Access described in Section 9, you are entitled to additional information about the PI of yours that we have or process. For this information, please see Sections 2 and 10 above, specifically the subsections on the Right of Access and what categories are collected, sold, and disclosed. Please note that defined terms may vary among different state laws, and that the UCPA definitions of certain terms apply to this Section 15, and your reading of Section 10 in reference to this Section.

B. Additional Rights for Utah Residents. In addition to the rights described in Section 9 above, under the UCPA, Utah residents have the following rights:

• The Right to Opt-In to the Use of Your Sensitive Personal Information. Five by Five will not process your sensitive personal information without first obtaining your consent to do so.
• The Right to Opt-Out of Targeted Advertising. As a Utah consumer, you may also be able to opt-out of targeted advertising based on your activity on non-affiliated websites and services. You may still see generic ads, and ads based on what you do on the Internet, even if you exercise this right.

16. Changes to this Privacy Policy

Because our business needs may change over time, we reserve the right to update this Consumer Privacy Policy. If at any time in the future we plan to use your data in a way that is materially different than as described in this Consumer Privacy Policy, we will revise this Consumer Privacy Policy as appropriate. If we do change this Privacy Policy, we will post the updated policy and on our website (website link).

17. Our Contact Information

If you have any questions or concerns about this Privacy Policy:

Shovels, Inc.

3515 Mt. Diablo Blvd

Unit #51

Lafayette, California 94549

Telephone: (800) 511-7457

E-mail: legal@shovels.ai