Privacy Policy

Last updated: August 11, 2026

Your AI Access ("we", "us", "our") is a program of Biz Dev App Services LLC, a Texas limited liability company with its principal place of business in Houston, Texas. This Privacy Policy explains what information we collect when you use youraiaccess.com or purchase, redeem, or receive a Your AI Access card, and what we do with it.

We take this seriously. If anything below is unclear, email bill@bdsrvs.com and we will explain in plain language.

1. Information we collect

1.1 Information you give us directly

• Purchase information — your name, email, billing address, shipping address (for physical cards), and payment method details. Payment card numbers are processed by Stripe and are not stored on our servers.
• Recipient information — if you buy a card for someone else, we collect the recipient's name, email, and any personal message you include.
• Redemption information — the card code you enter to redeem, and (optionally) your email so we can send a receipt.
• Communications — anything you email us, submit through a contact form, or share in a support conversation.
• Organization API data — for organization account holders, any recipient data your API calls send us for issuance.

1.2 Information we collect automatically

• Server logs — every request to our site or API is logged with timestamp, IP address, request path, response status, and user-agent string. Retained 90 days for security and diagnostics.
• Cookies — we use a single first-party session cookie to preserve your checkout state and prevent double-charge on page refresh. We do NOT use tracking, advertising, or analytics cookies. There is no Google Analytics on this site.
• Ledger events — every purchase, issuance, redemption, and expiration is written to the XODIAK ledger. See section 2.4.

1.3 Information from third parties

• Stripe — payment confirmation, cardholder-name partial match for fraud screening.
• Providers — when you redeem a card, the provider (ChatGPT, Claude, Gemini, etc.) confirms receipt of credit but does not share your account activity back to us.
• Fulfillment vendors — for physical cards, our print/mail vendors return shipping tracking numbers to us.

2. How we use information

2.1 To operate the program

Process purchases; mint access cards; deliver cards to recipients via email, SMS, or physical mail; verify codes at redemption; issue tax receipts for donations; respond to support requests.

2.2 To prevent fraud

Detect card testing, chargeback fraud, and double-spend attempts. This may include comparing your IP against known fraud lists and flagging unusual purchase patterns.

2.3 To improve the program

Aggregate, de-identified usage patterns to understand what denominations are popular, which providers see the highest redemption rates, and where the checkout flow drops off. We do not use individually-identifiable data for this without your consent.

2.4 XODIAK ledger disclosure

The XODIAK ledger records every value pulse on the platform — mint, burn, transfer, settle. Your ledger entries include your user identifier (a UUID, not your email), the amount, the reference type, and a timestamp. Ledger entries are append-only and cannot be edited or deleted. Organization admins can see their own org's ledger entries; individual buyers can see their own ledger entries via the buyer surface. Providers see only ledger entries related to their own redemptions.

3. How we share information

We do not sell your personal information. Ever. That has been our position since day one and is embedded in our LLC's operating agreement.

We share information only in these cases:

• With providers — when you redeem a card, we share the card code, redemption amount, and recipient email (if provided) with the provider so they can apply credit to the recipient's account.
• With payment processors — Stripe (for card processing), Coinbase Commerce or equivalent (for crypto donations, when live).
• With fulfillment vendors — for physical cards, we share shipping name and address with the print/mail vendor (PerfectGift, My Metal Business Card, Lob, or equivalent).
• With organizations — if you received a card from your employer, school, or workforce program, that organization can see that a card was issued to your email, when it was redeemed, and for how much (they do NOT see which provider you chose or your activity on that provider).
• With legal authorities — if compelled by valid legal process (subpoena, court order). We publish an annual transparency report; the count of such requests appears there.
• In a merger or acquisition — if Biz Dev App Services LLC is acquired, your information transfers subject to the acquirer honoring this policy.

4. Data retention

• Account and purchase records — retained for 7 years to satisfy tax and financial recordkeeping obligations.
• Server logs — 90 days.
• Support conversations — 2 years.
• Ledger entries — permanent (append-only by design).
• Communications you have deleted — best-effort purge from active systems within 30 days; backups purge on 90-day rotation.

5. Children under 13

We do not knowingly collect personal information from children under 13. If a card is given to a child under 13, the parent or guardian is the responsible party — they should complete redemption on the child's behalf, and any recipient email should be the parent/guardian's email. If we learn we have collected information from a child under 13 without parental consent, we will delete it. Report concerns to bill@bdsrvs.com.

6. Your rights

6.1 California residents (CCPA/CPRA)

You have the right to:

• Know what personal information we have collected about you
• Delete that information (subject to legal retention requirements above)
• Correct inaccurate information
• Opt out of "sale" or "sharing" — we do not sell or share for cross-context behavioral advertising, so this right is a no-op for us, but you can affirmatively opt in via a Do-Not-Sell request and we will confirm no data is being sold
• Limit use of "sensitive personal information" — again, a no-op for us but you have the right

To exercise any of these rights, email bill@bdsrvs.com with the subject "CCPA Request". We verify identity via a code sent to the email on file and respond within 45 days.

6.2 EU / UK residents (GDPR)

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal information. Legal basis for processing is contract performance (fulfilling your purchase) and legitimate interest (fraud prevention, program improvement). To exercise these rights, email bill@bdsrvs.com with "GDPR Request" in the subject line. Response within 30 days.

Our EU/UK representative is not yet appointed as we do not currently have substantial EU/UK operations. If we cross the GDPR threshold requiring one, we will update this policy and post the representative's contact details.

6.3 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, and other states with consumer privacy laws have similar rights. Email bill@bdsrvs.com with a description of your request.

7. Security

We use industry-standard technical and organizational measures — TLS in transit, encryption at rest for sensitive fields, Row-Level Security on our Supabase database, restricted access on production credentials, and quarterly security review with our fractional CISO. Payment card data is handled by Stripe and never touches our systems.

No security is perfect. If you become aware of a vulnerability, please report it responsibly to security@bdsrvs.com.

8. International transfers

Our servers are hosted in the United States. If you access the site from outside the US, your information will be transferred to and processed in the US. For EU/UK transfers, we rely on Standard Contractual Clauses.

9. Changes to this policy

We update this policy as the program evolves. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced via email to registered users at least 14 days before taking effect.

10. Contact

Privacy questions or requests: bill@bdsrvs.com

General support: bill@bdsrvs.com

Postal: Biz Dev App Services LLC, Attn: Privacy, 2300 McCue Road #106, Houston TX 77056