Before Semicolon Privacy Policy

Effective date: July 31, 2026

Before Semicolon LLC ("Before Semicolon," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use:

• our public website at beforesemicolon.com;
• the Before Semicolon content management system at cms.beforesemicolon.com;
• related websites, applications, communications, and support services that link to this Privacy Policy; and
• the Before Semicolon CMS Alerts text-message program.

We refer to these together as the "Services." This Privacy Policy does not apply to a customer-controlled website merely because that website was created or managed with our Services. The owner of that website is responsible for its own privacy disclosures and legal obligations.

1. Who is responsible for your information

Before Semicolon LLC is responsible for personal information it collects for its own website, accounts, billing, support, security, analytics, and communications.

When a business customer places personal information in project content or asks us to process information solely on its behalf, that business may be the controller or business responsible for the information, and Before Semicolon may act as its service provider or processor. Requests about that customer-controlled information should first be directed to the relevant business customer.

Company contact:

2. Personal information we collect

The information we collect depends on how you interact with the Services.

Information you provide

We may collect:

• account details, such as name, email address, profile image, authentication identifiers, and account preferences;
• business details, such as business name, role, team membership, timezone, websites, domains, projects, and subscription plan;
• project and content data, such as pages, assets, documents, templates, forms, project requests, change history, and publishing configuration;
• communications, such as support requests, bug reports, feedback, feature requests, survey responses, and correspondence;
• billing details, such as billing name and address, subscription state, invoice identifiers, payment status, and limited payment-method metadata; payment-card information is collected and processed by Stripe rather than stored in full by us;
• notification details, such as email destinations, mobile numbers, notification preferences, quiet hours, consent evidence, verification state, opt-out state, and delivery history; and
• any other information you choose to provide.

Information collected automatically

We may automatically collect:

• device and browser type;
• IP address or privacy-preserving hashes derived from it;
• operating system;
• pages, features, and actions used;
• referring and exit pages;
• dates, times, and approximate location inferred from an IP address;
• cookie, session, and similar identifiers;
• application logs, audit records, error reports, performance data, and security signals; and
• email or SMS delivery, bounce, complaint, failure, and opt-out events.

Information from integrations and service providers

At your direction or as needed to provide the Services, we may receive information from:

• Auth0 for identity and authentication;
• GitHub for repositories, source content, commits, and publishing workflows;
• Netlify for hosting, deployments, logs, database, and blob storage;
• Stripe for subscriptions, invoices, payment status, and payment-method metadata;
• Google Analytics for usage analytics and, for configured customer projects, analytics reporting;
• Sentry for application error and performance information;
• Resend for email delivery;
• Telnyx for phone-number verification, SMS delivery, carrier status, and inbound compliance keywords; and
• other integrations you authorize.

3. How we use personal information

We use personal information to:

• provide, operate, maintain, and support the Services;
• create and secure accounts, authenticate users, and enforce permissions;
• create and manage businesses, websites, projects, repositories, content, and deployments;
• process subscriptions and payments;
• send account verification, invitations, service messages, billing notices, and opted-in SMS notifications;
• process requests, reports, feedback, and customer support;
• personalize settings and remember preferences;
• measure usage, diagnose errors, improve reliability, and develop the Services;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
• maintain audit records and enforce legal rights;
• comply with law, legal process, tax, accounting, and regulatory obligations; and
• complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law.

We may de-identify or aggregate information so it can no longer reasonably identify a person. We may use and disclose de-identified or aggregated information for lawful purposes and will not attempt to re-identify it except to test our de-identification safeguards where permitted by law.

4. SMS and mobile information

The Before Semicolon CMS Alerts program sends transactional messages only to mobile numbers enrolled through the consent and verification process described in our SMS Terms.

We use mobile numbers, SMS consent records, and messaging activity to:

• verify control of a mobile number;
• deliver the transactional alerts selected by the recipient;
• respond to HELP, STOP, and related compliance requests;
• prevent messages after an opt-out, reassignment, invalid-number signal, or carrier block;
• investigate delivery failures and abuse; and
• demonstrate and maintain compliance.

We do not sell mobile information. We do not share a person's SMS opt-in, mobile number, or consent status with third parties or affiliates for their own marketing or promotional purposes. We may provide this information to vendors that help us operate the SMS program, such as messaging platforms, carriers, hosting providers, and compliance vendors, but only as needed to provide, secure, and administer the program. We may also disclose information when required by law or as part of a business transfer subject to appropriate protections. A recipient's consent to receive SMS from Before Semicolon is not transferred to another party for that party's independent use.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. You may also disable SMS in Business Settings or contact us through a reasonable support channel. Opting out of SMS does not disable email, in-app notices, or messages required to complete a transaction you separately request.

5. Cookies and similar technologies

We use cookies, browser storage, and similar technologies to:

• keep sessions active and secure;
• prevent cross-site request forgery and other abuse;
• remember settings;
• understand feature and website usage; and
• diagnose errors and measure performance.

The CMS uses necessary session/security technologies and may use Google Analytics and Sentry in production. These providers may collect device, usage, and diagnostic information under their own terms and our service-provider arrangements.

You can control cookies through your browser. Blocking necessary cookies may prevent account login or other features from working. Where applicable law requires consent before non-essential analytics technologies are used, we will request that consent.

6. How we disclose personal information

We may disclose personal information:

• to vendors and service providers that host, secure, analyze, support, bill for, or deliver the Services;
• to integrations you or your business administrator enable;
• to a business account owner or authorized team member when information belongs to that business workspace;
• to professional advisers, such as lawyers, accountants, auditors, and insurers;
• to law enforcement, regulators, courts, or other parties when we reasonably believe disclosure is required by law or needed to protect rights, safety, security, and the integrity of the Services;
• in connection with a corporate transaction, with notice or other protections where required; and
• with your direction or consent.

Current service providers and integration platforms may include Auth0, GitHub, Netlify, Stripe, Google, Sentry, Resend, and Telnyx. Their role and the data involved depend on the features you use.

We do not sell personal information for money. We do not use or disclose SMS opt-in information for cross-context behavioral advertising or another party's marketing.

7. Business administrators and other users

If you use the Services through a business account:

• the business owner and authorized administrators may access and manage your account membership, role, project activity, content, notification destinations, and related records;
• content and activity may be retained by the business after you leave; and
• the business may have its own policies that govern its use of your information.

Before Semicolon is not responsible for a customer's independent use of personal information outside our Services.

8. International data transfers

Before Semicolon is based in the United States. We and our service providers may process information in the United States and other countries whose privacy laws may differ from the laws where you live.

When required, we use appropriate contractual or legal safeguards for cross-border transfers. A Cape Verde launch will require a separate review of local privacy, electronic-communications, consumer-protection, data-transfer, language, and recordkeeping requirements before residents are intentionally enrolled.

9. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security and audit history, resolving disputes, and meeting legal, tax, accounting, and compliance obligations.

Our starting operational schedule is:

• notification event and delivery records: up to 180 days;
• notification delivery attempts: up to 90 days;
• minimized provider-webhook records: up to 30 days;
• phone verification challenges: deleted after successful verification or expiry, subject to short security logs;
• SMS consent and revocation evidence: for the life of the enrollment and afterward for as long as reasonably necessary to document consent and revocation, resolve disputes, and comply with legal and carrier requirements;
• account, business, project, repository, content, and support records: while the account or service relationship is active and for a reasonable period afterward;
• billing and transaction records: for the period required by tax, accounting, fraud-prevention, and legal obligations; and
• de-identified analytics: as configured with the provider or until no longer useful.

We may retain a minimal suppression record after an SMS opt-out so we do not contact the number again without valid new consent. Backup copies may remain until ordinary backup rotation is complete.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include access controls, destination masking, secret management, encrypted transport, verification, signed provider webhooks, audit records, rate limits, and data minimization.

No system is completely secure. You are responsible for protecting your credentials, using appropriate account security, maintaining authorized team membership, and promptly notifying us of suspected unauthorized access.

11. Your choices and privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to:

• request access to personal information;
• request correction or deletion;
• receive a portable copy;
• object to or restrict certain processing;
• withdraw consent for future processing;
• opt out of certain sale, sharing, targeted advertising, or profiling;
• appeal a denied privacy request; and
• complain to a privacy regulator.

To make a request, contact support@beforesemicolon.com. We may verify your identity and authority before acting. If your request concerns information controlled by one of our business customers, we may direct the request to that customer.

You may:

• unsubscribe from optional email using the link provided, when applicable;
• disable configured notification channels in Business Settings;
• opt out of SMS by replying STOP, changing Business Settings, or contacting us; and
• control browser cookies through browser settings and any consent tool we provide.

We will not discriminate against you for exercising a privacy right protected by law.

12. Children's privacy

The Services are intended for business users and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact support@beforesemicolon.com.

If the Services are later intentionally offered to minors or in a jurisdiction with a higher minimum age, we will update the product and this Privacy Policy before doing so.

13. Third-party websites and services

The Services may link to or integrate with third-party services. Their privacy practices are governed by their own notices, except where we process information on their behalf under a service-provider agreement.

14. Changes to this Privacy Policy

We may update this Privacy Policy. We will post the updated version with a new effective date and provide additional notice when required by law. Material changes to SMS data use or consent practices will not expand an existing consent beyond the message categories and purposes the recipient accepted.

15. Contact us

Questions or privacy requests: