Privacy

Effective Date: June 2, 2025

We are Symbium Corp. (referred to as “Symbium,” “Company,” “us,” “our,” or “we”) and our mission is to reinvent the citizen-to-government experience by providing instant permitting and automated compliance solutions in the building and licensing space. We recognize that personal privacy is important, and that our processing of personal information is a critical part of how we can achieve our mission while maintaining the trust of property owners, contractors, and government partners. We've developed this privacy policy to explain our technologies and to describe how and why we collect, use, and share your information.

Our Services: This privacy policy (“Policy”) applies to personal information we process from our website located at www.symbium.com (“Site”), our instant permitting and compliance software platform (“Platform”), our mobile applications (“Applications”), and based on other interactions you have with us (collectively, our “Services”). Our Services include instant permitting and automated compliance checks across a range of project types.

The Policy applies to all users of our Services, including, but not limited to, property owners and contractors who submit permit applications, government users who rely on Symbium for compliance checks on publicly-submitted applications, and visitors to our Site. This Policy does not cover our processing of information about employees, job candidates, or contractors.

1. Personal Information We Collect

When we use the term “personal information,” we mean any information that can be used to identify you, directly or indirectly, as an individual person. We collect several types of personal information from our users to provide our instant permitting services and ensure compliance with applicable building codes and regulations.

Personal Information You Provide

We request and collect information when you choose to use our Services. You can choose not to provide us with certain information below, but you may not be able to use some or all of our Services without providing the necessary information for permit processing and compliance verification.

Account Information. When you sign up for an account through our Site or Applications, you will be asked to submit your first name, last name, email address, password, and professional affiliations. For business accounts, we also collect business name, professional license numbers, and verification information to confirm your credentials for permit applications.

Permit Application Information. To participate in instant permitting through our Platform, you are required to submit detailed project information including property addresses, project specifications, technical drawings, system designs, and equipment details. This information is necessary for automated compliance checking against applicable building, zoning, and energy codes. We also collect information about the project.

Property Information. Our Services require detailed property information to perform automated compliance verification. This includes property addresses, parcel numbers, building characteristics, and zoning classifications. We collect this information both from your submissions, from our government partners, from standards-setting organizations, and from public records to ensure accurate compliance checking and proper permit issuance.

Professional Verification Information. For contractors and businesses using our Services, we may collect professional license numbers, business registration information, insurance and bonding details, and professional association memberships. This information is used to verify your credentials and ensure compliance with local requirements for permit applications.

Billing Information. To purchase any of our Services or process permit fees, you will be asked to submit payment information including credit card or ACH details. This information is processed by third-party payment providers to facilitate payments for permits, subscriptions, and related services.

Communications. When you engage in any communications with us, with government partners through our Services, or with other users through our platform, we collect information about these communications. If you register for our newsletters or updates, we will communicate with you by email. We also collect information from customer support interactions, surveys, and feedback you provide to help us improve our Services.

Information We Automatically Collect

When you use our Services, we automatically collect certain personal information about how you use them and the devices you use to access them. This information helps us provide better services and ensure platform security.

Location Information. We collect precise geolocation information from property addresses submitted for permit applications, as this is essential for determining applicable building codes, zoning requirements, and jurisdictional regulations. This precise location data is considered sensitive personal information under California law. We may also collect general location information from your IP address to provide relevant services and comply with applicable local regulations.

Device and Usage Information. Like many websites and applications, we automatically collect certain device information when you access and use our Services, even if you have not created a Symbium account or logged in. This information may include your IP address, browser type and version, operating system, device identifiers, access dates and times, pages viewed, time spent on pages, clickstream data, and the websites you visited before and after using our Services. This information helps us understand how our Services are used, identify technical issues, and improve platform performance.

Cookies and Similar Technologies. We and our service providers use cookies, web beacons, and other similar tracking technologies when you use our Platform, Site, or engage with our online communications. These technologies help us recognize you across sessions, customize your experience, analyze platform usage, and provide security features. Most internet browsers allow you to manage cookie functions and adjust your privacy and security preferences. However, disabling cookies may limit your ability to use certain features of our Services.

Government System Integration Data. When you use our Services to submit permits through government partners, we collect audit logs, system integration data, permit tracking information, and compliance verification records. This information is necessary for proper integration with government permit tracking systems and maintaining accurate records for government oversight and auditing purposes.

Information We Collect from Third Parties.

Symbium collects information, including personal information, from various third-party sources to provide comprehensive permit processing services and ensure compliance verification. We do not control how these third parties process your personal information, and any questions about their disclosure practices should be directed to them.

Public Records and Government Databases. We collect extensive information from public records and government databases to support our instant permitting services. This includes property ownership records, property tax assessments, building permit history, zoning information, census data, and land use records. We use this information to verify property details, check compliance requirements, and ensure accurate permit processing. In most cases, this public records data is provided in aggregate form to users who perform property-specific or jurisdiction-wide searches within our Platform.

Professional Licensing and Verification Services. If you apply to use our Services as a contractor or business, we may obtain reports from licensing organizations, professional associations, and verification services to confirm your credentials are in good standing. We may use your name, license numbers, and business information to obtain these verification reports, which help ensure compliance with local requirements for permit applications.

Payment Processing Information. Symbium collects information related to your payment transactions through our Services from applicable payment processors, including payment method details, transaction dates and amounts, billing addresses, and related transaction information. This information is necessary for processing permit fees, subscription payments, and providing our Services to you.

Government Partner Systems. We receive information from government permit tracking systems, code compliance databases, fee schedules, and inspection records when you submit permits through our Platform. This integration ensures that permits are properly recorded in official government systems and that all required processes are followed according to local regulations.

Referrals and Invitations. If you are invited to use our Services by a third party, such as a government partner or contractor, that person may provide us with your contact information and professional details to facilitate your access to our Platform.

2. How We Use Personal Information

In addition to the specific uses discussed above, we collect and use personal information for several purposes related to providing instant permitting services, ensuring compliance with applicable codes and regulations, and improving our platform to better serve property owners, contractors, and government partners.

We use personal information to provide access to our instant permitting Services, including automated compliance checking against applicable building, zoning, and energy codes. Our platform performs real-time verification of project details against current code requirements to enable instant permit issuance for eligible projects. We use automated decision-making systems to evaluate permit applications, verify code compliance, validate contractor credentials, and calculate applicable fees. These automated processes are designed to speed up permit issuance while ensuring all safety and regulatory requirements are met.

We use your information to improve and develop our Services by analyzing how the platform is used, identifying areas for enhancement, and developing new features that better serve our users. This includes monitoring platform performance, testing new compliance checking algorithms, and updating our systems to reflect changes in building codes and regulations across different jurisdictions.

We use personal information to communicate with users about their accounts, permit applications, and platform updates. This includes sending notifications about permit status, changes to applicable codes or requirements, and important updates about our Services. We also use your information to process and fulfill permit applications, calculate fees, and coordinate with government partners to ensure proper permit issuance and record-keeping.

We may provide users with updates, offers, and announcements about new features, additional services, jurisdictional expansions, and improvements to our platform. We also use your information to solicit feedback about your experience and gather input on potential enhancements to our Services.

We use personal information to provide administrative services, manage account preferences, and respond to technical issues or disputes. This includes troubleshooting platform problems, resolving permit processing issues, and ensuring that our Services meet the needs of all users.

To help us optimize and personalize our Services, we analyze usage patterns, user preferences, and platform interactions. This helps us provide more relevant features, improve user interfaces, and customize the experience for different types of users including property owners, contractors, and government personnel.

We use your information to administer, manage, and grow our organization, including business planning, financial management, and strategic development. This helps us expand our Services to new jurisdictions and develop additional features that support those efforts.

We create and maintain a trusted and safer environment by detecting and preventing fraud, spam, abuse, and security incidents. We conduct security investigations and risk assessments, comply with our legal obligations, and perform checks against databases and other information sources including professional licensing verification. We also use your information to resolve disputes, enforce our agreements with third parties, and ensure compliance with our Terms of Service and other policies.

As we determine necessary in our sole discretion, we may use your information to ensure the safety and integrity of our users, employees, third parties, members of the public, and our Services. This includes responding to security threats, preventing misuse of our platform, and maintaining the reliability of our instant permitting system.

3. How We Share Personal Information

We share personal information in several ways to provide our instant permitting services, ensure compliance with applicable regulations, and maintain the security and integrity of our platform.

Government Partners and Agencies. We share personal information with local, state, and federal government agencies as necessary to provide our instant permitting services. This includes sharing permit application details, property information, and contractor credentials with government building departments, planning agencies, and permit tracking systems. We integrate directly with government systems to ensure that permits issued through our platform are properly recorded in official databases and that all regulatory requirements are met. This sharing is essential for the legitimate governmental functions of permit issuance, code enforcement, and public safety oversight.

Service Providers. We share personal information with third-party service providers who perform services on our behalf, including cloud infrastructure providers like Amazon Web Services and Google Cloud, payment processors for permit fees and subscriptions, analytics providers who help us understand platform usage, data storage and security providers, and customer support services. These service providers are contractually obligated to protect your personal information and use it only for the specific services they provide to us.

Professional Verification Services. We may share information with licensing authorities to confirm contractor licenses, business registrations, and professional qualifications. This sharing is necessary to ensure that only qualified professionals can submit permit applications through our platform and helps maintain the integrity of the permitting process.

Legal and Safety Requirements. We may disclose personal information when we believe that disclosure is necessary to protect our rights, your safety, or the rights and safety of others. This includes sharing information to investigate fraud, abuse, misuse, potential violations of law or regulations, and security or technical issues. We also share information in response to lawful requests from government authorities, court orders, subpoenas, and other legal processes.

Business Transactions. If we are involved in a merger, acquisition, reorganization, sale of assets, or similar business transaction, your personal information may be disclosed as part of that transaction. We will provide notice of any such change in ownership or control of your personal information.

Regulatory and Legal Disclosures. We may disclose personal information to governmental regulatory authorities as required by law, in response to judicial, governmental, or legal inquiries, investigations, orders, or proceedings. We may also disclose information to our auditors or legal advisors in connection with assessing our disclosure obligations and rights under this Policy.

Terms Enforcement. We may disclose personal information to third parties in connection with claims, disputes, or litigation, or when otherwise reasonably necessary to enforce our Terms of Service, this Policy, or other legal agreements with our users.

Consent-Based Sharing. Where users have been given an opportunity to consent and have agreed to disclosure of their information, we may share personal information according to those consent preferences.

We do not sell personal information for monetary consideration. However, some of our data sharing practices, particularly with analytics providers or advertising partners, may be considered "sharing" under certain state privacy laws. You have the right to opt out of such sharing where applicable.

4. Privacy Rights and Choices

You have several rights regarding your personal information, and the specific rights available to you may vary depending on your state of residence and the nature of your interaction with our Services.

Access and Portability Rights. You have the right to request access to the personal information we maintain about you. This includes the right to receive a copy of your personal information and details about how we collect, use, and share your data. In certain states, you also have the right to receive your personal information in a portable, structured format that allows you to transfer it to another service provider.

Correction Rights. You have the right to request correction of inaccurate personal information we maintain about you. You can update much of your account information directly through your account settings, and you can contact us to request correction of other inaccurate information.

Deletion Rights. You have the right to request deletion of your personal information, subject to certain legal exceptions. We may need to retain some information to comply with legal obligations, resolve disputes, enforce agreements, or maintain records required for government oversight. When you request deletion, we will delete or anonymize your personal information except where retention is required by law.

Opt-Out Rights. You have the right to opt out of certain uses of your personal information. This includes opting out of marketing communications, which you can do by following the unsubscribe instructions in our emails or updating your communication preferences in your account settings. Depending on your state, you may also have the right to opt out of the sale or sharing of personal information, though we do not sell personal information for monetary consideration.

Sensitive Personal Information Rights. For California residents, you have the right to limit our use of sensitive personal information, including precise geolocation data, beyond what is necessary to provide our services. Because location information is essential for our permit processing services, limiting its use may affect our ability to provide certain features.

Automated Decision-Making Rights. You have the right to information about our automated decision-making processes, including our compliance checking algorithms, risk assessment systems, and credential verification tools. You also have the right to request human review of automated decisions that significantly affect you, such as permit denials or compliance determinations.

Non-Discrimination Rights. We will not discriminate against you for exercising your privacy rights. This means we will not deny you services, charge you different prices, or provide you with a different level of service quality solely because you have exercised your privacy rights.

To exercise these rights, send an email to legal@symbium.com. We will verify your identity before processing your request to protect your personal information from unauthorized access. We aim to respond to verified requests within 45 days, though this period may be extended by an additional 45 days if necessary, and we will notify you of any extension.

5. State-Specific Privacy Rights

Residents of certain states have additional privacy rights under state privacy laws. These rights supplement the general rights described above and provide additional protections for personal information.

California Residents. Under the California Privacy Rights Act (CPRA), California residents have comprehensive privacy rights including the right to know what personal information we collect and how we use it, the right to access and receive a copy of personal information, the right to delete personal information subject to exceptions, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information. You also have the right to designate an authorized agent to make privacy requests on your behalf, though we may require verification of the agent's authority and your identity.

Because we collect precise geolocation information as part of our permit processing services, California residents have specific rights regarding this sensitive personal information. You can request that we limit our use of this information to what is necessary to provide our services, though this may affect our ability to process permits for your projects.

California residents also have rights under the "Shine the Light" law to request information about categories of personal information disclosed to third parties for their direct marketing purposes. You can make such requests by contacting us at legal@symbium.com with "California Privacy Information" in the subject line.

Multi-State Privacy Law Rights. Residents of Colorado, Connecticut, Virginia, Utah, Florida, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, and New Jersey have rights under their respective state privacy laws. These generally include rights to access, correct, delete, and obtain copies of personal information, as well as rights to opt out of certain processing activities. Some states provide additional rights such as the right to opt out of profiling for decisions that produce legal or similarly significant effects.

Appeals Process. If we decline your privacy request, residents of certain states have the right to appeal our decision. We will provide information about how to appeal when we respond to your initial request. Appeals will be reviewed by our privacy team, and we will respond to appeals within the timeframes required by applicable law.

Authorized Agents. You may designate an authorized agent to make privacy requests on your behalf. We may require verification of the agent's authority to act on your behalf and may still require you to verify your own identity directly with us to protect your personal information.

6. Data Security and Retention

We implement comprehensive physical, technical, and administrative safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction. Our security measures are designed to provide a level of security appropriate to the risk of processing personal information and are regularly reviewed and updated to address evolving threats.

Our technical safeguards include encryption of personal information both in transit and at rest using industry-standard encryption protocols. We use secure communication channels for all data transmissions, maintain firewalls and intrusion detection systems to protect our networks, and implement access controls with multi-factor authentication to limit access to personal information. We regularly monitor our systems for security vulnerabilities and conduct security assessments to identify and address potential risks.

Our administrative safeguards include comprehensive employee training on privacy and security requirements, background checks for employees with access to personal information, and clear policies and procedures governing the handling of personal information. We limit access to personal information to employees who need it to perform their job functions and regularly review and update our security policies and procedures.

As a provider of government technology services, we comply with federal security requirements including the Federal Information Security Modernization Act (FISMA) where applicable. This includes implementing security controls that meet federal standards for protecting government information and maintaining appropriate documentation of our security measures.

We retain personal information for different periods depending on the type of information and the purposes for which it was collected. Account information is retained while your account is active and for seven years after account closure to meet legal and regulatory requirements. Permit application information is retained for ten years or longer as required by government record retention schedules, as this information may be needed for future inspections, compliance verification, or legal proceedings. Property information from public records is retained as long as necessary to provide our services and may be retained indefinitely as it supports our platform's core functionality.

Communications records including customer support interactions are typically retained for three years, while usage analytics data is retained for two years to help us improve our services. We securely delete or anonymize personal information when retention periods expire, unless longer retention is required by law or legitimate business needs.

In the event of a data security incident, we have procedures in place to respond quickly and effectively. We will notify affected individuals and relevant authorities within the timeframes required by applicable law, provide information about the nature of the incident and steps being taken to address it, and offer appropriate assistance to affected individuals.

7. Children's Privacy

Our Services are designed for use by adults and are not intended for children under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If you are under 16, please do not use our Services or provide any personal information to us.

If we become aware that we have collected personal information from a child under 16 without appropriate consent, we will take steps to delete such information promptly. If you believe that we may have collected information from a child under 16, please contact us immediately at legal@symbium.com so that we can take appropriate action.

Parents and legal guardians have the right to review any personal information we may have collected about their child, request deletion of such information, and refuse to permit further collection or use of their child's information. To exercise these rights, parents can contact us using the information provided in the Contact Us section below.

8. No International Data Transfers

We primarily operate within the United States and store personal information on servers located in the United States. We are committed to complying with applicable restrictions on international data transfers, including restrictions related to national security concerns. We do not transfer personal information to countries or entities that have been identified as presenting national security risks under applicable U.S. law and policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make changes, we will update the effective date at the top of this Policy and take appropriate steps to notify you of significant changes.

For material changes that significantly affect your privacy rights or how we handle your personal information, we will provide prominent notice through our website, email notifications to registered users, or in-app notifications when you access our Services. We may also seek your explicit consent for certain changes that significantly expand how we use your personal information.

For non-material changes such as clarifications, minor updates, or changes that do not affect your rights, we will post the updated Policy on our website and update the effective date. We encourage you to review this Policy periodically to stay informed about how we protect your personal information.

Your continued use of our Services after changes become effective constitutes your acceptance of the updated Policy. If you do not agree with any changes, you may discontinue use of our Services and contact us to discuss your account options.

10. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or need assistance with your account, you can contact us through several channels.

For privacy-related questions and requests, please email us at legal@symbium.com. Please include "Privacy Request" in the subject line and provide sufficient detail about your request to help us respond appropriately. We aim to respond to privacy inquiries within five business days.

For general questions about our Services, you can contact us through our website contact form. Our customer support team can assist with account questions, technical issues, and general information about our platform.

We are committed to addressing your privacy concerns and questions promptly and thoroughly. If you are not satisfied with our response to your privacy inquiry, you may have the right to file a complaint with your state's attorney general or data protection authority, or to appeal our decision regarding your privacy request where such rights are provided by applicable law.