Iowa Privacy Rights

1. Scope of This Notice

This notice supplements our Privacy Policy for residents of Iowa. It applies to the extent the Iowa Consumer Data Protection Act (in effect from January 1, 2025) applies to BillingMart.com LLC ("BillingMart", "we"). It summarizes that law; the law itself controls, and this notice is not legal advice.

2. Our Two Roles

• For our own records — people who visit billingmart.com, contact us, receive our marketing, or hold a BillingMart account — BillingMart decides how personal data is used, and this notice applies directly.
• For a Business's records — if a business that uses BillingMart (a "Business") bills you, the Business decides what it collects about you and why; BillingMart processes that data on the Business's instructions as its service provider or processor. Requests about those records belong with the Business. If you send one to us, we may refer it to the Business, tell you we have done so, and help the Business respond as the law and our contract with it require.

3. Personal Data We Collect

Depending on how you deal with us, we collect:

• Identifiers and contact details — name, email address, phone number, postal address, account and workspace identifiers.
• Account and sign-in data — sign-in method and security settings. Passwords and second factors are handled by our identity provider.
• Commercial and billing records — invoices, estimates, payments, plans and purchases. For cards we keep only the last four digits and the card type; full card numbers are handled by the payment processor and never stored by us.
• Communications — messages you send us, contact-form and privacy requests, and the delivery status of messages we send.
• Device and usage data — network address, browser and device type, and how the service is used. Website analytics runs only if you enable it in our Cookie Settings, and product analytics in the console and apps only if you accept it.
• Signatures and authorizations — as described in our E-Sign Consent.

We collect it from you, from the Business that bills you, from your device, and from service providers that help us run BillingMart (for example payment processors and identity providers).

4. How We Use It

To provide, secure and support BillingMart; to process payments and deliver records and messages; to verify identity and prevent fraud and abuse; to communicate with you, including marketing you may opt out of; to improve the service; to keep the records the law requires; and to establish, exercise or defend legal claims.

5. How We Disclose It

We disclose personal data to our service providers under contract (listed on our Subprocessors page); to the Business whose records it is; when the law, a court or a regulator requires it, or to protect rights, safety and security; and in a merger, acquisition, financing or sale of assets.

We do not sell personal data, we do not share it for targeted or cross-context behavioral advertising, and we do not use it for profiling that produces legal or similarly significant effects.

6. Your Rights

Subject to the limits in the law and in section 11, Iowa residents have:

• Right to know and access. Confirm whether we process your personal data and get access to it, including the categories we collected, why, and who we disclosed it to.
• Right to delete. Ask us to delete personal data we hold about you, subject to the exceptions below.
• Right to a portable copy. Get a copy of personal data you gave us in a usable, portable format, where technically feasible.
• Right to opt out. Opt out of the sale of personal data, its use for targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these.
• Right to appeal. Appeal our decision on your request, as section 10 describes.

7. How to Make a Request

Use our Data Removal Request form. We email you a link to confirm the request; we act only on confirmed requests. If you cannot use the form, use our Contact page and say it is a privacy request.

8. Verification and Authorized Agents

To protect you, we must verify that a request comes from the person it is about before we act on it. We match the details you give against our records and may ask for more information. For a request to delete or correct, or for specific pieces of data, we may require a higher degree of certainty, including a signed declaration under penalty of perjury where the law allows. If we cannot verify a request, we may deny it and will tell you why. We use the information you give for verification only to process the request.

An authorized agent may submit a request for you where the law allows. We will require proof of the agent's authority signed by you, and we may ask you to verify your identity directly and confirm the request with us.

9. When We Respond

We respond within 90 days of receiving a request. Where reasonably necessary, and as the law allows, we may extend that once by 45 days; if we do, we will tell you within the first period and say why.

We respond free of charge. Where the law allows, we may limit the number of requests in a 12-month period, and may decline, or charge a reasonable fee for, requests that are manifestly unfounded, excessive or repetitive, and will tell you why.

10. Appeals and Complaints

If we decline to act on your request, you may appeal within a reasonable time by submitting an "Appeal a decision" request on the same form with your request's reference number. We will decide your appeal within 60 days and tell you why. If you disagree with our decision, you may contact the Iowa Attorney General.

11. Exceptions and Limits

Your rights are subject to the exceptions in the law. We may keep, or decline to delete, correct or disclose, personal data where the law permits, including to:

• complete a transaction, provide a service you or a Business asked for, or perform a contract;
• keep records the law requires, including financial, tax and payment records — a Business's invoices, payments and receipts that name you remain that Business's records;
• detect, prevent and respond to security incidents, fraud and illegal activity;
• debug, repair and maintain the service;
• comply with a legal obligation, court order, subpoena or regulator;
• establish, exercise or defend legal claims;
• protect the rights, safety or property of any person; and
• carry out internal uses reasonably aligned with your expectations.

We are not required to re-identify de-identified or pseudonymous data, to keep data longer than we otherwise would in order to answer a request, or to disclose data in a way that would reveal trade secrets or another person's data. Data deleted from live systems is removed from backups as they age out on their normal schedule.

12. Retention

We keep personal data for as long as needed for the purposes above, then delete or de-identify it, unless the law requires or permits a longer period.

13. Non-Discrimination

We will not discriminate against you for exercising your privacy rights, for example by denying service or charging a different price, except as the law permits.

14. General Terms

• The Terms of Service control. This page forms part of, and is governed by, the Terms of Service, the Privacy Policy and the Acceptable Use Policy. If this page and the Terms of Service conflict, the Terms of Service control.
• No additional obligations. This page describes how BillingMart.com LLC ("BillingMart", "we", "us") operates. It does not create a contract, a warranty, a guarantee or any obligation beyond those in the Terms of Service and those that applicable law imposes, and nothing on it waives a right, defense, privilege or exemption available to BillingMart under the Terms of Service or the law.
• Disclaimers and limits apply. The warranty disclaimers, limitation of liability, governing law (Delaware) and binding arbitration provisions of the Terms of Service apply to everything described here, to the fullest extent the law allows.
• No third-party beneficiaries. This page confers no rights or remedies on any person other than as applicable law requires.
• Changes. We may update this page at any time by posting a new version here; the "Last revised" date shows when it last changed. A change applies from when it is posted unless the law requires otherwise. Continued use of BillingMart after a change means you accept it.
• Severability. If any part of this page is found unenforceable, the rest remains in effect, and the unenforceable part is limited to the minimum extent necessary.
• Questions. Use our Contact page. For a privacy request, use the Data Removal Request page.