Privacy Policy

Effective date: October 27, 2026

1. Who we are

Big Hint is a product of Knuckle Labs LLC ("we", "us"). This policy covers our website, bighint.com, and the Big Hint app. Questions go to hello@bighint.com.

2. What we collect on bighint.com

When you request early access, we collect your name, work email, company or agency name, website (optional), account count (optional), and whether you run ChatGPT Ads. We also store campaign tags, the referring page if supplied, and a hash of your IP address to limit spam and repeat submissions. The hidden company-fax field is a spam check and is not stored as a contact field.

When you use the "Find an agency" form, we collect your name, work email, business name, website, industry and monthly ad budget, plus a hash of your IP address to limit spam. We store these requests separately from early-access requests and use them to connect you with an agency that runs ChatGPT Ads on Big Hint. To make that introduction, we share your request details with the agency we connect you with. The hidden company-fax field is a spam check and is not stored.

Our free launch kit tools save your answers (business type, what you sell, ad groups and hints, budget, business name, chosen ad drafts, and tracking choices) in your own browser's local storage so each step can fill in the next. To write ad previews, we send your business name, what you sell, ad groups and hints, landing page goal and industry status through our server to an OpenAI model through Lovable's AI gateway. We do not store those inputs or results on our server during generation. We keep only a salted IP hash and time of use to limit abuse, for up to two days. That plan stays on your device until you clear it. If you request early access from the launch plan page, we collect your work email address and save a summary of your plan with your request, including chosen ad drafts (it does not include your Pixel ID), plus a hash of your IP address to limit spam. We store the summary with your early-access request, tagged as a launch plan request, and use it to tell you about Big Hint. We do not email the plan. You can download a PDF copy from the launch plan page.

Google Fonts receives your IP address and browser request details when it delivers our fonts. Product screenshots, logos and the founder photo load from a hosted asset service, which receives ordinary request details. Hosting and error-reporting services may receive page requests, error messages, stack traces and the page address.

Bighint.com uses Google Analytics 4 to understand how people use the site. A cookie banner asks for your choice before analytics storage turns on: until you accept, analytics, advertising and personalization storage all stay off, and Google receives only anonymous consent-state pings. If you accept, only analytics storage turns on (advertising signals stay off, since we don't run Google Ads), and Google Analytics sets cookies such as _ga (about 2 years) and collects pages visited, approximate location, and device and browser details. If you reject, analytics storage stays off. You can change your choice at any time through the Cookie settings link in the footer. Your choice is stored in this browser's local storage with no automatic expiry. When you submit the early access form, we record a lead event that contains none of your form entries: no name, email, company or website.

Free Context Hint Generator. When you use the tool at /tools/context-hint-generator, the business type and the text you enter are sent through our server to an AI model provided by OpenAI, accessed through Lovable's AI gateway, to generate hint ideas. We do not store what you enter or the results. To limit abuse we keep a one-way hash of your IP address and the time of each use for up to two days, then delete it. If a bot check is enabled, Cloudflare Turnstile processes technical signals from your browser to tell people from bots. Analytics events for this tool record only the business type you picked, never the text you typed.

3. What we collect in the app

• Accounts and teams: email, name, sign-in identity, session records, workspace membership, roles, invitations and client assignments. Password sign-in is handled by our authentication provider, not stored as plaintext in an app table.
• Business settings: agency and client names, websites, industry, service area, branding, account identifiers, contact and booking links, sender details, goals, budgets, attribution settings and preferences.
• Connected ad accounts: connection credentials, account and audience details, campaigns, ads, hints, creative text and image URLs, budgets, bids, impressions, clicks, spend, results and change history.
• CRM leads and customers: names, email addresses, phone numbers, companies, contact IDs, attribution details, and lead, booked-call and customer events, including values and dates. GoHighLevel imports can include readable contact details. Custom CRM webhooks receive contact details over HTTPS, then remove names and hash email and phone before storing their event payloads.
• Meetings: contact email, meeting date and type, awareness and consent records, uploaded or pasted transcripts and notes, summaries, quoted evidence, decisions, next steps and review records. These meeting tools parse text and documents; they do not provide audio or video recording or audio transcription.
• Prospect audits: prospect contact details, business information, website content and images, public sources, competitors, questions, answers and audit reports.
• AI features: prompts, recent conversation, authorized performance and business information, website text, meeting evidence, image prompts and submitted images. Generated drafts, summaries and images may be stored with the relevant records. The assistant's conversation is held in the page rather than an app conversation-history table.
• Reports and sharing: business identities, metrics, commentary, branding, recipients, schedules, shared snapshots, access controls, approvals and delivery records.
• Proposals and signatures: signer and company details, fees, billing email, signature dates, signer IP address and browser information, document and signature hashes, verification records and signed PDFs.
• Billing, emails and alerts: billing customer and subscription IDs, plan and payment status, invoice and checkout information, recipients, message content, alert preferences, delivery status, errors and operational history. Stripe collects payment-card details; we do not store card numbers or CVCs in Big Hint's app tables.

4. Website tracking and browser storage

On customer websites using our tracking snippet, we collect visitor and event IDs, landing-page origin and path, referrer origin, campaign tags, advertising click and attribution references, channel and timestamps. Attribution can be copied into matching form fields and supported form-iframe links. A same-origin form submission can send email and optional phone to Big Hint over HTTPS, where they are normalized and hashed to link a visitor to a lead. The snippet does not send the rest of the form.

• _zl_vid: visitor-ID cookie, renewed for up to 400 days. Its local-storage copy has no automatic expiry.
• _zl_ft and _zl_lt: first- and latest-touch attribution cookies, lasting 90 days.
• _zl_choice_<tracking key>: local storage for the consent choice, country and notice version, with no automatic expiry. Rejecting tracking clears attribution cookies.
• __obref: an existing OpenAI attribution cookie our snippet can read. Big Hint does not set this cookie.

We keep consent choices, region, notice version and timestamps as evidence. Regional consent mode requires acceptance in regulated or unresolved regions. Ordinary mode may collect by default unless disabled or rejected. Customers must choose settings appropriate to their obligations. The visit-tracking records do not store IP addresses or browser user-agent fields, but hosting services still receive network request details.

In the Big Hint app, browser storage keeps sign-in sessions and functional preferences such as theme, table settings, selected client, chart selections, tabs and dismissed reminders. Most preference storage persists until cleared; session validity is managed by our authentication provider. Temporary navigation uses zc.crm-wizard-client session storage, the crm_return_client cookie for one hour, and setup_crm_return for 10 minutes. These are app navigation tools, not customer-site attribution cookies.

5. Our role and how we use data

Knuckle Labs LLC is responsible for website, account and service-administration data. For our customers' leads, customers and website visitors, we process data on the customer's behalf to measure ad results. Customers are responsible for their own privacy notices, consent and right to share that data with us.

We use data to provide sign-in and access controls, connect services, match ad visits to CRM outcomes, show performance, prepare recommendations and AI drafts, create reports and agreements, handle billing, send emails and alerts, answer requests, troubleshoot problems and keep the service secure. We never sell personal data.

6. Who we share it with

Depending on the features and connections used, recipients include:

• Supabase: authentication data, database records, private files, credentials in Vault and API requests.
• Lovable and Cloudflare infrastructure: website and app requests, server-function inputs, hosted assets and operational or error telemetry where enabled.
• Lovable AI Gateway and OpenAI models: prompts, transcripts, authorized results, business and website content, sources, image prompts and submitted images for AI features. Provider retention is not confirmed; we do not promise that providers retain nothing.
• OpenAI Ads: account requests, approved ad settings and creative content, and hashed email or phone identifiers when an approved custom-audience operation runs. Live conversion-signal delivery is not enabled.
• GoHighLevel: account, contact, appointment and opportunity requests; GoHighLevel supplies connected contact and outcome data to us.
• Zapier, Make, n8n or a custom webhook sender: contact and outcome data configured by the customer upstream, which the service submits to Big Hint. These services may keep their own copies.
• Zoho ZeptoMail: sender, recipient, CC and reply-to addresses, subject, message content, links and optional attachments. Email open and click tracking is disabled in the current transport.
• Slack: alert messages, client or business context and app links sent to a configured workspace.
• Stripe: billing identity, checkout and subscription information, with payment results returned to Big Hint.
• Sign-in providers: if enabled and used, Google or Microsoft receives sign-in requests and returns identity and email information through our authentication provider.
• Google Fonts: font requests and ordinary browser network details.
• Google Analytics: site usage data such as pages visited, approximate location, and device and browser details, collected only after you accept analytics cookies in the banner.
• Website-reading, DNS and AI search services: hostnames, requested URLs and search questions. Websites being read receive a server request, not a visitor's complete browsing session.
• People you share with: the report, audit, proposal or exported information selected for sharing. Ad-image URLs can be read by anyone who has the URL.

Customer-installed analytics and advertising pixels are separate from Big Hint's snippet and need the customer's own disclosures.

7. How long we keep it

Most app data is kept while the account is active and until deletion is requested. Most categories do not yet have an automatic deletion period. Early-access requests also have no automatic deletion schedule. A daily cleanup job is configured to remove live-activity events older than seven days; successful runs have not been independently verified. This does not delete the underlying leads, conversions or other business records.

The cookie lifetimes are listed above. Local-storage copies generally have no automatic expiry. Some invitations expire after seven days, CRM authorization state after 10 minutes, and signed-PDF download URLs after five minutes. These limits prevent access or reuse; they do not delete the underlying records.

Archiving a client, disconnecting a service, or expiring a share link does not erase its data. Backup, infrastructure-log and third-party retention periods are not confirmed. We do not promise that raw events are deleted after 13 months.

8. Security

Big Hint's database, authentication and private files are hosted on Supabase, encrypted in transit and at rest. Access is limited by role. Integration credentials are stored in a secure vault; shared service secrets are held in server-side secret storage.

Email and phone identifiers are normalized and hashed before being sent to ad platforms through the implemented custom-audience transfer. Hashing supports matching; it is not anonymization. Not all data is hashed: CRM contacts, meeting text and user-supplied content can contain readable personal information. Live conversion-signal delivery is currently blocked.

9. Your rights

You can request access, correction, deletion or export of your personal data, or opt out of emails, by contacting hello@bighint.com. We respond within 30 days. We may need to verify your identity and the scope of the request. For data processed on a customer's behalf, contact that customer or us so the request can be handled with them.

Some tools export individual tables or documents or delete specific meeting or audit records. There is no complete self-service account-wide export or deletion tool. Removing a membership, signing out, archiving a client or deleting one record does not erase all related data, shared copies or provider records.

California residents (CCPA/CPRA)

Where California law applies, you may request to know and access the personal information collected about you, correct it, or request deletion, subject to legal exceptions. You may use an authorized agent and have the right not to be discriminated against for exercising these rights. We never sell personal data. If a use qualifies as sharing for cross-context behavioral advertising, the applicable opt-out rights apply. Contact hello@bighint.com for requests.

People in the EU and UK (GDPR)

Knuckle Labs LLC acts as controller for website and account data and as processor for customer lead and visitor data. Where GDPR applies, the legal basis depends on the purpose:

• Contract: providing the service and account administration.
• Legitimate interests: responding to early-access requests, preventing abuse and operating a secure service, subject to your rights.
• Consent: processing that requires consent, including applicable website tracking. Consent can be withdrawn.
• Legal obligation: processing required by applicable law.

Customers determine the legal basis for data we process on their behalf. You may also have rights to portability, restriction and objection, and may complain to your local data protection authority.

10. International transfers

Data may be processed in the United States and other countries where our providers operate. We do not promise that all processing stays in one region. Provider locations and contractual transfer safeguards have not yet been confirmed for this policy.

Children

Big Hint is not for anyone under 18, and we don't knowingly collect their data. If you think a child has given us data, email hello@bighint.com and we will delete it.

Changes to this policy

We will post changes on this page and update the Last updated date. Any further notice required by applicable law will be provided.