BILT Privacy Policy

Last Updated: October 26, 2026

1. Introduction

BILT Incorporated (“BILT,” “we,” “our,” or “us”) is committed to protecting the privacy and security of personal information.

This Privacy Policy explains how BILT collects, uses, shares, and protects personal information when individuals interact with BILT services.

BILT provides technology that delivers 3D interactive digital instructions through applications, websites, and integrations with partner platforms.

BILT Services

For purposes of this Privacy Policy, the “Services” include:

• BILT applications available on supported devices, including iOS, Android, Apple Vision Pro, Windows tablets, and compatible virtual or mixed reality headsets
• the BILT website (such as biltapp.com)
• BILT technology integrated into partner applications through software development kits (“SDKs”) or similar integrations
• the BILT Client/Admin Portal, which allows organizations to manage access to instructions.

Organizations

Organizations are entities that use BILT technology to deliver instructions or manage access to instructions through the Services. Organizations may include manufacturers, retailers, businesses, schools, training providers, and institutions.

Users

Users may include:

• consumers accessing product instructions
• individuals accessing instructions through Organizations
• individuals participating in collaborative training or instruction sessions
• users accessing content through an access key or other access mechanism provided by an Organization or institution.

BILT may introduce additional tools and services in the future. When new features are introduced, this Privacy Policy will be updated as necessary to reflect any changes to how personal information is handled.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected when individuals interact with the Services, including when users:

• use BILT applications
• visit the BILT website
• create a BILT account
• access interactive digital instructions through the Services
• register products through the Services
• participate in collaborative instruction sessions
• access instructions provided by an Organization or via an access key.

Organizations

Organizations that provide instructions through the Services may have their own privacy policies governing their relationship with users. BILT is not responsible for the privacy practices of Organizations.

Partner Applications

When instructions are accessed through partner applications that integrate BILT technology, the partner’s privacy policy may also apply to the use of that application.

Institution-Registered Devices

An institution or organization may register a shared device (such as a tablet, computer, or headset) under the institution’s account rather than under an individual user’s account (“Institution Device”). When a student or other individual accesses the Services on an Institution Device, BILT may not collect personal data specific to that individual. The institution that registered the device is responsible for tracking individual user activity, monitoring progress, and complying with applicable privacy laws with respect to users of that device, including obtaining any required consents.

3. Sources of Personal Information

BILT may collect personal information from several sources.

Information Provided Directly by Users

Users may provide information when they:

• create an account
• register a product
• submit reviews or feedback
• participate in collaborative instruction sessions
• contact customer support.

Information Collected Automatically

Certain information may be collected automatically when users access the Services, such as:

• device information
• operating system
• application version
• device identifiers
• browser type and user agent
• device fingerprint
• usage and interaction data
• IP address and approximate location derived from IP address
• Session Activity Data (as defined in Section 4).

IP addresses are used to determine approximate location and may also be recorded in security and audit logs and in Session Activity Data, as described in Section 4 (Personal Information We Collect) and Section 9 (Data Retention).

The Services do not collect precise geolocation data such as GPS coordinates, and do not use device location services, cell-tower, or Wi-Fi positioning to determine location.

Information Collected Based on How You Use the Services

The information BILT collects depends on how a user accesses the Services.

Users Without a BILT Account. Users who access content without creating a BILT account, for example by scanning a QR code or entering an access key, are not asked for their name or email address. These users are assigned an identifier derived from device information, which is used to deliver the applicable content. BILT may collect device identifiers, a device fingerprint, browser type and user agent, operating system, IP address, approximate location (derived from IP address), and Session Activity Data (as defined in Section 4) for these users. Precise geolocation is not collected.

Registered Users. Users who create a BILT account provide Account Information, such as name, email address, and login credentials, as described in Section 4. For registered users, BILT also collects the same automatically collected information described above for users without a BILT account, including Session Activity Data and instruction progress and completion information, and associates such information with the registered user’s account.

Users Who Register a Product. Users who choose to register a product provide Product Registration Information, as described in Section 4. This information is transferred to the applicable product manufacturer at the user’s direction, as described in Section 6. If the user has a BILT account, the registration is associated with the user’s account identifier, but registration details are not used to create or update the user’s account profile.

Users accessing the Services on an Institution-Registered Device are addressed in Section 2.

Information Provided by Organizations

Organizations may provide information to enable users to access instructions, such as email addresses used to grant access to instructional content. Where an Organization provides personal information to BILT and determines how that information is used, the Organization is responsible for providing any notice required by applicable law to the individuals concerned.

Information Collected Through Partner Applications

When BILT technology is integrated into partner applications through SDKs, certain information may be collected through those integrations to deliver the Services.

4. Personal Information We Collect

BILT may collect the following categories of personal information.

Account Information

• name
• email address
• login credentials.

Product Registration Information

• product model information
• serial numbers
• purchase information
• receipts or documentation submitted by users.

Device and Technical Information

• device type
• operating system
• application version
• device identifiers
• browser type and user agent
• device fingerprint (a combination of device and browser characteristics used to recognize a device or session)
• system configuration
• application instance identifiers used for notification delivery.

BILT’s security, audit, and operational logs may record IP addresses, together with service events, timestamps, and system messages, to protect the Services, detect and investigate security incidents, and meet applicable security and compliance requirements. Retention of these logs is described in Section 9 (Data Retention).

Usage and Interaction Information

Information related to how users interact with instructions, such as:

• instruction downloads
• step progression
• completion information
• interaction with instruction elements.

This interaction data may also be used to train and improve BILT’s AI and machine learning systems. See Section 5 (How We Use Personal Information) for details.

Session Activity Data

“Session Activity Data” means information about how a user interacts with the Services during a session, such as the instructions and steps viewed, the user’s position within an instruction or course, interactions with instruction elements, time spent, errors, and performance data, together with the account ID or session identifier, device fingerprint, browser type and user agent, and IP address associated with that session. Session Activity Data may be detailed enough to reconstruct how a session progressed. BILT uses Session Activity Data to operate, troubleshoot, secure, and improve the Services, as described in Section 5 (How We Use Personal Information).

Session Activity Data does not include precise location information. The only location information associated with a session is approximate location derived from the user’s IP address, as described below under Approximate Location Information.

For users in the European Economic Area, the United Kingdom, and related territories, BILT does not collect device fingerprints or Session Activity Data that identifies a user or device for analytics purposes. BILT determines a user’s country from the user’s IP address for this purpose. Security and audit logs are maintained for all users, as described in this Section 4.

Approximate Location Information

Approximate location information may be derived from a user’s IP address when the Services are accessed. This information may include the user’s country, region, or approximate city-level location. Where approximate location is stored for analytics, it is generalized to an area of approximately 10 kilometers.

Approximate location is determined by matching the IP address against internet service provider and IP geolocation data. BILT does not use device location services, GPS, cell- tower, or Wi-Fi positioning to determine a user’s location.

Although IP addresses may be retained in security and audit logs and in Session Activity Data, BILT does not derive or store any location more precise than approximately 10 kilometers from them.

Exception – Product Reviews

When a user submits a product review through the Services, the reviewer’s IP address may be captured and transmitted to a third-party review aggregation or syndication provider (such as Bazaarvoice) to support review authentication and fraud prevention programs.

Organization Reporting Configurations

Depending on how the Services are configured by an Organization, location information associated with user sessions may be made available to that Organization for administrative, access management, or reporting purposes.

User Content

Information users voluntarily submit, including:

• product reviews
• comments or feedback
• uploaded images or media
• testimonials.

Collaborative Instruction Session Information

When users participate in collaborative training, troubleshooting, or instructional sessions, information related to session participation may be processed. This may include:

• user account identifiers
• session participation information
• audio and video communications exchanged between participants during the session.

BILT does not currently record or store audio, video, screen content, or camera feed from collaborative sessions. If recording capability is introduced in the future, BILT will provide advance notice and require affirmative consent before any recording begins.

Camera and Visual Data

The BILT application may request access to a device’s outward-facing camera for the following purposes:

• scanning product serial numbers, barcodes, or QR codes to identify products and retrieve applicable instructions (“Scan Feature”)
• enabling visual collaboration features that allow users to share a live view of their physical environment with BILT support agents, instructors, or subject matter experts in real time (“Camera Share Feature”).

Camera access is optional for general use of the Services and is activated only upon the user’s affirmative permission through the device’s operating system settings. Live camera feeds shared during Camera Share sessions are transmitted in real time to the

applicable session participant. BILT does not currently store camera feed imagery or video from Camera Share sessions.

Biometric Data

When users access the Services through compatible virtual or mixed reality headsets, the headset hardware or operating system may process biometric data, such as eye- tracking or hand gesture data, to enable interaction with the application interface. To the extent BILT or its platform collects or processes such biometric data, BILT will provide any required separate written notice and obtain any required separate written consent prior to such collection, in compliance with applicable state law including the Illinois Biometric Information Privacy Act (“BIPA”) and similar statutes.

Website Analytics Information

When users visit the BILT website, certain information may be collected through cookies or analytics technologies.

5. How We Use Personal Information

BILT uses personal information to operate and improve the Services.

Providing the Services

• deliver interactive digital instructions
• enable users to access instructions
• manage accounts and authentication.

Managing Access to Instructions

• verify eligibility to access instructions
• allow Organizations to manage user access through the BILT Client/Admin Portal.

Product Registration

• process product registrations
• share product registration information with Organizations when users choose to submit registration information.

Collaborative Instruction Sessions

• enable training sessions
• provide troubleshooting assistance
• allow instructors, experts, or support personnel to interact with users.

Analytics and Service Improvement

BILT may use information to analyze how the Services are used in order to:

• understand how instructions are viewed and completed
• improve instruction content and platform features
• enhance usability and user experience

• monitor performance and reliability of the Services.

Analytics may include aggregated or de-identified usage information.

In most cases, analytics shared with Organizations are aggregated and do not identify individual users. In certain configurations enabled by an Organization, identifiable session-level information may be shared with that Organization for administrative or training monitoring purposes.

These configurations are typically used in enterprise or training environments and may require user consent before such information is collected or shared.

AI and Machine Learning Improvement

BILT uses artificial intelligence and machine learning technologies in connection with the creation, delivery, and improvement of its Services and content, including its instruction- creation processes. BILT may collect, analyze, and use data generated through user interactions with the Services — including how users navigate instructions, which steps users engage with, session duration, interaction patterns, and feedback provided — to train, improve, and develop BILT’s AI systems, software, instruction-creation tools, and related products and services.

BILT may aggregate or de-identify information, including Session Activity Data and other interaction data, and may use, share, license, or sell such aggregated or de-identified information to third parties, including partners, customers, and developers of artificial intelligence and machine learning models, for any lawful purpose, including training, testing, and improving their own models, products, and services. BILT maintains and uses de-identified information in de-identified form, does not attempt to re-identify it, and contractually requires recipients not to re-identify it. Aggregated or de-identified information is not personal information and does not identify any individual user.

The licensing or sale of aggregated or de-identified information described above applies to information collected on or after the effective date of this Privacy Policy from users who have accepted this version of the Privacy Policy, and to information collected before that date only where the user has provided consent.

Depending on where they live, users may have the right to object to certain uses of their personal information, including for AI and machine learning purposes, as described in Section 11 (Your Privacy Rights).

Technical Operations

• ensure device compatibility
• diagnose technical issues
• troubleshoot errors and performance issues, including by reviewing Session Activity Data.

Security

• detect fraud
• maintain system security
• maintain security and audit logs and investigate security incidents.

Communications

• send account notifications
• respond to support inquiries.

Promotional email communications from BILT may be opted out of by following the unsubscribe instructions included in those emails or by contacting [email protected].

Legal Compliance

• comply with legal obligations
• enforce agreements.

Legal Bases for Processing (EEA and UK Users)

For users in the European Economic Area and the United Kingdom, BILT relies on the following legal bases to process personal information:

• Performance of a contract: to provide the Services, manage accounts and access to instructions, process product registrations at the user’s request, and support collaborative instruction sessions.
• Legitimate interests: to secure the Services and prevent fraud (including maintaining security and audit logs that contain IP addresses), determine approximate location, analyze and improve the Services, improve BILT’s AI and machine learning systems, and create aggregated or de-identified information. BILT balances these interests against users’ rights, and users may object as described in Section 11.
• Consent: where required by law, such as for certain promotional communications and any biometric data. Users may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation: to comply with applicable laws, regulations, and lawful requests.

6. When We Share Personal Information

BILT may share personal information with third parties in the following circumstances and in accordance with applicable data protection laws. When BILT shares personal information with service providers, BILT enters into data processing agreements to ensure personal information is protected.

Organizations Providing Instructions

When users access instructions provided by an Organization, BILT may share information necessary to support those instructions, including:

• product registrations submitted by users

• user reviews or feedback related to products
• aggregated or de-identified analytics about instruction usage.

In some enterprise or training deployments, Organizations may configure the Services to generate access or session reports for administrative purposes. These reports may include identifiable session information where required for training monitoring and where user consent has been obtained.

Testimonials and Reviews

Testimonials, reviews, or ratings submitted by users may be shared with Organizations associated with the relevant product and may be published on websites, social media platforms, or through review syndication networks. Users should be aware that testimonials may be publicly visible.

Collaborative Session Participants

During collaborative instruction sessions, participants may see or hear information shared during the session, including audio or video communications between participants. Participants may include instructors or experts, representatives of Organizations, and BILT personnel providing support or demonstrations.

Service Providers

BILT may share personal information with third-party service providers that perform services on BILT’s behalf to help operate, maintain, and improve the Services. These service providers are authorized to use personal information only as necessary to perform services for BILT.

Service providers may assist BILT with functions such as:

• cloud hosting and infrastructure services
• content delivery network and network security services
• analytics, observability, and platform performance monitoring
• IP-based geolocation services
• notification delivery services
• system administration and technical support
• security monitoring and fraud prevention.

BILT’s primary hosting infrastructure and content delivery network services are provided through Amazon Web Services (AWS).

BILT applications may also use third-party services such as Google Firebase Cloud Messaging to deliver push notifications or service messages to users.

BILT may also share information with third-party review aggregation providers, such as Bazaarvoice, to support product review authentication and fraud prevention programs.

These service providers are permitted to use personal information only as necessary to perform services for BILT and are not permitted to use the information for their own independent purposes.

BILT remains responsible for the processing of personal information it receives under applicable data transfer frameworks and subsequently transfers to service providers acting as its agents, unless BILT is not responsible for the event giving rise to any damage.

AI, Analytics, and Data Licensing Partners

BILT may share, license, or sell aggregated or de-identified information to partners, customers, affiliates, licensees, and developers of artificial intelligence and machine learning models, as described in Section 5 (AI and Machine Learning Improvement). Such information does not identify any individual user, and recipients are contractually prohibited from attempting to re-identify it.

Partner Applications

When instructions are accessed through partner applications that integrate BILT SDK technology, certain information may be shared between BILT and the partner application to deliver the Services.

Legal Requirements

BILT may disclose personal information if required by law or to protect the rights, safety, or property of BILT, users, or others.

Business Transfers

If BILT is involved in a merger, acquisition, or similar transaction, personal information may be transferred as part of that transaction.

7. Cookies and Tracking Technologies

BILT uses cookies and similar technologies to operate the website and analyze website usage.

Cookies may be used to:

• maintain website functionality
• remember user preferences
• analyze website usage patterns.

BILT uses a consent management tool such as OneTrust or CookiePro to allow users to manage cookie preferences.

BILT also uses Google Analytics to understand how visitors interact with the website.

Mobile applications generally do not use browser cookies but may collect device identifiers, device fingerprints, or similar information for technical and analytics purposes.

Browser-based versions of the Services, including the Web SDK and browser-based instruction viewers, may use similar technologies, such as local storage and device fingerprinting, to recognize sessions and collect Session Activity Data.

BILT applications may use push notification services, including Google Firebase Cloud Messaging, to deliver service notifications or updates to users.

A list of cookies currently used on the website is provided in the Cookie Table located in the Appendix at the end of this Privacy Policy.

8. International Data Transfers

BILT operates globally, and personal information collected through the Services may be transferred to and processed in countries other than the country where it was originally collected, including the United States.

When personal information is transferred internationally, BILT implements appropriate safeguards, which may include:

• Standard Contractual Clauses approved by the European Commission, and the UK International Data Transfer Addendum
• contractual protections with service providers
• other legally recognized transfer mechanisms.

Users may request a copy of the relevant safeguards by contacting [email protected].

8.4 Privacy Framework Participation

BILT may participate in international data transfer frameworks that facilitate the lawful transfer of personal information across borders. If BILT certifies to such a framework, information about BILT’s participation and the framework’s dispute resolution procedures will be made available in this Privacy Policy.

9. Data Retention

BILT retains personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

Retention periods may vary depending on the type of information. Categories of retained data may include:

• account information
• product registration records
• usage and analytics data
• system, security, and audit logs, which may include IP addresses
• communications with users.

Where possible, analytics data may be aggregated or de-identified. Following termination of a user’s account or the Services relationship, BILT retains personal data only as necessary to comply with applicable legal obligations, resolve disputes, and enforce agreements.

Retention of IP Addresses and Related Data. BILT retains IP addresses and related data as follows:

• Security and audit logs (commercial environment): retained for as long as needed for security monitoring, incident investigation, and applicable security and compliance requirements, then deleted.
• Security and audit logs (government (GovCloud) environment): retained for the periods required by applicable federal security requirements, then deleted.
• Session Activity Data that identifies a user or device, including IP address and device fingerprint: retained for as long as needed to operate, troubleshoot, secure, and improve the Services, then deleted or de-identified.
• Approximate location: stored only at approximately 10-kilometer precision and retained for the same period as the associated Session Activity Data.
• Backups: data deleted from active systems may remain in backups until the backups are overwritten in the ordinary course of BILT’s backup cycle.

Aggregated or de-identified information may be retained indefinitely.

10. Security

BILT uses reasonable administrative, technical, and organizational measures designed to protect personal information. These measures may include:

• encryption of data in transit
• access controls
• monitoring systems
• secure infrastructure hosted on AWS.

However, no system can guarantee absolute security.

11. Your Privacy Rights

Depending on the user’s location, individuals may have certain privacy rights regarding their personal information. These rights may include the ability to:

• request access to personal information
• request correction of inaccurate information
• request deletion of personal information
• request a copy of personal information in a portable format
• request restriction of certain processing

• withdraw consent at any time, where processing is based on consent
• object to certain processing activities, including processing based on BILT’s legitimate interests.

Requests may be submitted using the contact information provided below.

Privacy complaints may be submitted to [email protected] with the subject line “Privacy Complaint.” BILT will acknowledge complaints within 30 days of receipt and will investigate and respond without undue delay.

Users in the European Economic Area and the United Kingdom also have the right to lodge a complaint with their local data protection authority.

BILT does not make decisions that produce legal or similarly significant effects concerning users based solely on automated processing, including profiling.

Data Deletion Requests

You may request deletion of your personal information held by BILT at any time. To submit a deletion request:

• Email us at [email protected] with the subject line: “Data Deletion Request”.
• Include your full name, the email address associated with your account, and any relevant account details to help us locate your information.

For your security, we may verify your identity before processing the request. We will respond to deletion requests within a reasonable timeframe and in accordance with applicable law. In certain circumstances, BILT may retain certain information as required by law or for legitimate business purposes.

12. Additional Rights for U.S. Residents

Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws. These rights may include the ability to:

• request access to personal information
• request deletion of personal information
• request correction of inaccurate information
• opt out of certain data processing activities.

BILT does not sell personal information. When a user chooses to register a product through the Services, registration information is transferred to the applicable product manufacturer at the user’s direction and with the user’s consent; this is not a sale of personal information. Aggregated or de-identified information, as described in Section 5 (AI and Machine Learning Improvement), is not personal information, and licensing or selling such information is not a sale of personal information.

13. Children’s Privacy

The Services are not directed to children under the age of 13. BILT does not knowingly collect personal information from children under 13 without appropriate consent where required by law. Certain content available through the Services (C4C instructional content for skilled trades) is intended only for users 18 years of age or older, as set forth in BILT’s Terms of Use.

14. Third-Party Links

The Services may contain links to third-party websites or services. BILT is not responsible for the privacy practices of third-party websites.

15. Changes to This Privacy Policy

BILT may update this Privacy Policy from time to time. When changes are made, the “Last Updated” date will be revised. This Privacy Policy is effective as of the Last Updated date shown above. When BILT makes material changes to this Privacy Policy, BILT will notify users and may require users to review and accept the updated Privacy Policy before continuing to use the Services.

16. Contact Information

If you have questions about this Privacy Policy or BILT’s privacy practices, please contact:

BILT Incorporated 1000 Nolen Drive #400 Grapevine, TX 76051 Email: [email protected]

EU and UK Representative

BILT has appointed an EU and UK representative for purposes of data protection law.

VeraSafe has been appointed as BILT Incorporated’s representative in the European Union for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union.

To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.

Alternatively, VeraSafe can be contacted at: VeraSafe Ireland Ltd. Unit 3D North Point House North Point Business Park New Mallow Road

Cork T23AT2P Ireland

VeraSafe has been appointed as BILT Incorporated’s representative in the United Kingdom for data protection matters, pursuant to Article 27 of the United Kingdom General Data Protection Regulation.

To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +44 (20) 4532 2003.

Alternatively, VeraSafe can be contacted at: VeraSafe United Kingdom Ltd. 37 Albert Embankment London SE1 7TL United Kingdom

Appendix – Cookie Table