Called It
Your data, plainly

Called It Privacy Policy and United States State Privacy Notice

How JBX Huddle LLC handles personal information across the Called It app, website, and Shopify storefront.

Effective 2026-09-03 · Version 1.6

1. Scope and responsible business

This Policy explains how JBX Huddle LLC (JBX, Called It, we, us) collects, uses, discloses, and retains personal information through the Called It app, calledit.deals, the Called It Shopify storefront, accounts, shopping and travel discovery, purchases and bookings, support, and related operations.

JBX is the customer-facing business for Called It app/web information and Called It Store orders, subject to roles defined by applicable law and provider contracts. Shopify and some other providers may also act as independent businesses/controllers for their own services, such as Shop Pay, under their notices.

Called It is available to adults in the United States. It is not directed to children under 18.

2. Information we collect

Depending on how you use Called It, we may collect:

  • Identity and contact: name, email, phone, shipping/billing address, account identifiers, authentication provider identifiers, and support contact.
  • Eligibility and membership: age confirmation, ZIP/state, application state, policy acceptances, standing, and optional social-profile information you submit.
  • Preferences: categories, watches, saved items, alert settings, quiet hours, and consent history.
  • Product research: the product request and follow-up answers you type, along with your saved delivery ZIP when Called It researches current products, prices, stock, and delivery.
  • Device and usage: IP address, browser/app/device type, operating system, timestamps, language, approximate location derived from IP, app/site interactions, diagnostics, crash/performance events, and security signals.
  • Deal and attribution: deal/page viewed, approved campaign/source/creator labels, share/referral activity, and handoff destination. We do not intentionally place account identifiers, payment data, or secret checkout material in attribution URLs.
  • Commerce: product, variant, price, cart, order, shipping address, delivery, tracking, cancellation, refund, return, warranty, support, fraud, and supplier-fulfillment events.
  • Payment: payment providers process card/account credentials. JBX receives transaction status, payment method type, risk signals, and identifiers needed to manage the order, but should not receive or store full payment-card numbers through the ordinary Shopify flow.
  • Flight searches and preferences: home airport, origin and destination, dates, party size and traveler ages, budget and cabin preferences, filters, flight search results, selections, saved trips, and interactions with those features. Hotel and stay search or booking is not available in this release.
  • Travelers and bookings: traveler legal name, date of birth, title, supplier-required gender marker, booking email and phone, supplier and offer identifiers, prices, terms acceptances, booking and confirmation references, itinerary, change/cancellation state, disruption information, and Travel Help requests.
  • Travel payment: card and billing details entered in the embedded Duffel card form go directly to Duffel and its payment/security partners, including Evervault. Called It receives only a scoped authentication reference and transaction result needed to submit and reconcile the requested booking, not the full card number.
  • Premium: Apple purchase and subscription status, product and transaction references, price/currency, entitlement state, renewal, cancellation, billing-issue, expiration, and refund events. Apple’s signed transaction and subscription notifications synchronize this information with Called It; Called It does not receive your Apple ID password or full app-platform payment credentials.
  • Dutch Releases and retailer credit: release and featured-product identifiers, retailer, verified price, paid Premium eligibility snapshot, claim time and credit amount, claim and issuance status, provider identifiers, delivery status, and the hosted reward link needed to deliver the retailer credit. Called It does not receive or store the retailer card number or PIN through the ordinary provider-delivery flow.
  • Communications: email, phone/voicemail, support requests, privacy requests, feedback, reviews, safety reports, and related attachments.
  • Supplier and business contact: supplier representatives, contracts, insurance, product evidence, compliance, order and incident communications.
  • Precise location: if you choose to use Location Services for a Lightning Round, precise device geolocation collected at entry and immediately before a live event, together with network, proxy, VPN, and location-integrity signals used to confirm you are in an eligible state. You may choose your current state instead; that selection is checked against independent network-location and integrity signals.
  • Device integrity: platform attestation results, app version and build, device and session identifiers, emulator and modification signals, and single-device session leases.
  • Fair-play signals during an event: screenshot, screen-recording, mirroring, and screen-capture events, and application focus and backgrounding events, detected only while a qualifier, readiness check, live event, or tie-break round is active.
  • Event telemetry: questions presented, answers submitted, per-answer timing at millisecond resolution, results, standings, earned marks, appeals, and integrity determinations.
  • Identity and tax: where you win a prize or where law requires verification, identity documentation, date of birth, and a taxpayer identification number.

Do not send unnecessary sensitive information in free-form support messages.

3. Sources

We collect information from you; your device/browser; authentication, app-platform, hosting, Shopify, payment, analytics, notification, email, support, fraud, and security providers; OpenRouter and the AI service it selects for an approved product search; Duffel and travel suppliers; Tremendous and the retailer or issuer that fulfills a Dutch Release credit; fulfillment suppliers and carriers; affiliate programs and external merchants; public product/seller sources; and lawful business partners. We may infer preferences, eligibility, risk, or deal relevance from collected information but do not use a solely automated decision to deny a legal right without the review required by law.

4. How we use information

We use information to:

  • create, authenticate, recover, secure, and administer accounts;
  • evaluate objective membership/eligibility rules and manage preferences;
  • operate deal discovery, watches, saved items, sharing, and notifications;
  • interpret the product request you approved and research current public product and seller information;
  • verify product/offer evidence and classify Called It Store versus affiliate routes;
  • create carts, process purchases, prevent fraud, fulfill, track, cancel, refund, return, and support Called It Store orders;
  • search current flight inventory, compare prices, remember flight preferences, prepare and submit requested flight bookings, show itineraries, prevent duplicate booking or payment attempts, reconcile supplier responses, and provide Travel Help;
  • provide Premium access, restore purchases, and keep Apple subscription status aligned with the Called It account;
  • determine paid Premium eligibility for a Dutch Release, process the first valid server-confirmed claim, issue the approved retailer and credit amount, prevent duplicate issuance, and reconcile delivery;
  • provide suppliers/carriers the minimum information needed for fulfillment, return, safety, fraud, or legal work;
  • preserve order, assent, tax, accounting, security, fraud, warranty, safety, recall, and dispute records;
  • diagnose errors, protect systems/users, enforce terms, and prevent abuse;
  • measure permitted campaign/affiliate performance and service quality;
  • respond to support, privacy, legal, and regulator requests;
  • comply with law and protect rights, property, health, and safety;
  • improve features using aggregated, deidentified, or appropriately controlled information;
  • determine eligibility for a contest, promotion, or release, including state, age, and account standing;
  • operate and score events, resolve ties, and administer appeals;
  • schedule approved Lightning Round question packs, send requested reminders, publish results, and fulfill the physical product prize;
  • detect and prevent automation, multiple accounts, location misrepresentation, collusion, capture of confidential question content, and other event manipulation;
  • verify winner identity and satisfy prize-reporting and tax obligations; and
  • maintain the integrity records, commitments, and audit trails that let an event result be independently verified.

We do not use order information to authorize supplier marketing to the customer. Suppliers are contractually restricted from independent marketing, audience building, resale, or unrelated profiling with Called It order data.

5. Legal/operational bases

US law does not use one universal list of processing bases. Depending on the context, we process information to perform a requested transaction, operate an account/service, obtain consent, satisfy a legal obligation, protect security/safety, prevent fraud, and pursue legitimate business purposes that applicable law permits. Where consent is required, it must be specific and can be withdrawn prospectively subject to necessary service/legal processing.

6. How we disclose information

We may disclose relevant information to:

  • OpenRouter and the AI service it selects only after you explicitly agree during account setup. Called It sends the product request and follow-up answers you type and your saved delivery ZIP. We do not send your name, email, Called It account ID, payment data, or full street address in that request. We instruct providers not to collect the request for their own use or use it for model training. We do not require zero retention, so OpenRouter and the selected provider may retain request content or metadata under their applicable terms and privacy notices;
  • Shopify and payment providers for storefront, account, cart, checkout, payment, fraud, order, refund, and related services;
  • Duffel, airlines, travel payment partners, and other flight suppliers for search, pricing, fraud prevention, booking, payment authentication, confirmation, itinerary, changes, cancellations, disruptions, and Travel Help;
  • RevenueCat may retain historical prelaunch subscription-test records under applicable retention requirements; the current app does not use its SDK.
  • Apple for Premium purchase, restore, entitlement, renewal, cancellation, billing-issue, expiration, and refund status;
  • Tremendous and the applicable retailer or card issuer to issue, host, deliver, reconcile, and support the exact retailer credit claimed in a Dutch Release;
  • approved suppliers and carriers for acceptance, fulfillment, delivery, tracking, return, warranty, safety, recall, and order support;
  • authentication, hosting, database, security, email, push, analytics, support, and development providers under contracts and instructions appropriate to their role;
  • Amazon, eBay, and affiliate/attribution providers when you interact with an affiliate route, subject to the destination disclosure and program terms;
  • professional advisers, insurers, auditors, banks, and financing/payment partners as needed for legitimate business/legal functions;
  • government, courts, regulators, law enforcement, or other persons when reasonably required by law, legal process, safety, or protection of rights;
  • transaction counterparties in a merger, financing, asset sale, reorganization, or similar transaction, subject to confidentiality and applicable notice/choice duties; and
  • identity-verification, tax-reporting, and prize-fulfillment providers where you win a prize, limited to what each needs for its function.

We do not disclose more order information to a supplier than reasonably needed for the supplier's contracted function.

7. Sale, sharing, targeted advertising, and affiliate links

JBX does not sell personal information for money. Some state laws define sale, sharing, or targeted advertising more broadly than an exchange for money. If Called It activates a practice covered by those definitions, we will provide the required notice and opt-out mechanism before or with that practice.

Meta, TikTok, and comparable advertising pixels are disabled. Essential commerce/security and limited service analytics are not described as targeted advertising merely because they involve a provider.

Called It does not link data collected about a particular user or device with third-party data for cross-app or cross-site targeted advertising or advertising measurement, and does not share that data with a data broker. Product analytics remains limited to service operation, feature improvement, personalization, alerts, and support.

Affiliate links can transmit ordinary request/device data and approved public attribution parameters to the external destination. Those parameters are not intentionally tied to a Called It account identifier, payment data, or secret checkout material. The product action discloses the paid relationship before you leave Called It. The external marketplace/seller's privacy notice applies after the handoff.

8. Cookies and similar technologies

We use essential/security, functional, analytics/performance, and affiliate measurement technologies as described in the Cookies, Similar Technologies, and Privacy Choices Notice. Advertising pixels are disabled. Shopify and other providers may set technologies for their services.

Where applicable law requires it, we honor a recognized Global Privacy Control or universal opt-out signal as a request to opt out of covered sale, sharing, or targeted-advertising processing for that browser/device. Official reference points include California GPC guidance and Colorado universal opt-out guidance.

9. Push, email, and SMS

Transactional account, order, refund, return, security, and safety messages are sent as needed to provide the service or comply with law. Promotional email and push alerts are optional; available settings and unsubscribe controls apply prospectively.

Called It does not send SMS marketing. Collecting a phone number for account security, delivery, or support does not create marketing consent. Any future SMS program will require separate affirmative consent and applicable disclosures.

10. Data retention

We retain information only as reasonably needed for the stated purpose, including active account/service operation and legal, tax, accounting, order, payment, refund, fraud, security, safety/recall, warranty, dispute, and enforcement obligations.

Retention periods depend on record type, relationship duration, limitation periods, legal holds, provider behavior, risk, and deletion feasibility. We delete or deidentify information when it is no longer reasonably needed, subject to backups and records we must or may lawfully retain. A deletion request does not require deletion of information needed for an active order, refund, safety recall, fraud defense, tax record, legal claim, or another exception.

An authenticated in-app account-deletion request revokes Called It access immediately. Our deletion process is designed to complete the remaining account cleanup within 30 days and sends acceptance and completion emails. Some commerce, Premium, travel booking, payment, tax, accounting, fraud, safety, dispute, or supplier records may remain when JBX or an independent provider must lawfully retain them. We restrict retained records to those purposes. Deleting a Called It account does not cancel an Apple subscription; cancel the subscription in Apple Subscriptions to stop future renewal.

Travel selections and temporary provider resources expire on short operational schedules. Confirmed booking, itinerary, supplier, assent, payment-result, refund/change, support, fraud, accounting, and dispute records may remain for the life of the booking and the longer period required by law, provider contracts, or a legal claim. Duffel, airlines, payment partners, and other flight suppliers may retain information independently under their own notices and legal duties.

Called It retains product-search history as described in this Policy so it can return results, continue a search, create a Watch, and improve the feature. We instruct OpenRouter and the AI service it selects not to collect product-search requests for their own use or use them for model training. We do not require zero retention; OpenRouter and the selected provider may retain request content or metadata under their applicable terms and privacy notices.

Contest records — entries, answers, timing, results, integrity determinations, appeals, eligibility checks, and winner and tax records — are retained for the period stated in the applicable Official Rules and for the longer period any tax, record-keeping, dispute, or limitations requirement imposes. A selected state and any precise location you choose to provide for a Lightning Round eligibility check are retained only for that published eligibility and audit period. Dutch Release eligibility, claim, audit, retailer-credit issuance, and delivery records are retained as reasonably needed to provide the benefit, prevent duplicate issuance, resolve support or fraud issues, and satisfy accounting, tax, dispute, and record-keeping obligations.

11. Security

We use administrative, technical, and organizational measures designed for the sensitivity and risk of the information, such as access controls, authentication, encryption in transit, secret isolation, logging, least privilege, monitoring, provider review, and incident response. No system is perfectly secure. Protect your account and contact us if you suspect unauthorized access.

12. Your choices

Depending on the feature, you may:

  • update account, preference, watch, quiet-hour, email, and push settings;
  • unsubscribe from promotional email;
  • disable push through device settings;
  • use cookie/privacy controls where offered;
  • use a recognized GPC/universal opt-out signal where applicable;
  • choose whether to create an account after reviewing the AI-assisted product-search disclosure shown with the Terms and Privacy Policy;
  • request access, correction, deletion, or portability; and
  • appeal a denied state privacy request where applicable.

Account deletion is available in Account → Privacy & account. It does not require a support call or email. If you have an Apple subscription, use the in-app link to Apple Subscriptions before deletion if you want to prevent renewal.

Turning off a preference does not prevent necessary transactional, security, or safety processing.

13. United States state privacy rights

Residents of states with applicable comprehensive privacy laws may have rights to know/access, correct, delete, and obtain a portable copy of covered personal information; opt out of covered sale, sharing, targeted advertising, or qualifying profiling; limit certain sensitive-data uses; receive nondiscriminatory service; use an authorized agent; and appeal a denied request. Rights, exceptions, verification, response times, and applicability vary by state and business thresholds.

Texas's Consumer Data Protection law, California's privacy laws, Colorado's Privacy Act, and other state laws may apply depending on facts and thresholds. This notice offers a common request channel without representing that every statute applies to every person or processing activity.

Submit a request through available account controls or:

  • Email team@calledit.deals with subject Privacy Request;
  • Phone 281-305-9305.

Describe the request and the state of residence. We will verify identity using information appropriate to the request's risk. An authorized agent must provide authority and may need to support identity verification. We will not discriminate for exercising a right, although deleting data may prevent a feature that needs it.

If we deny a request, the response will explain the basis and any applicable appeal method. Appeal by replying with subject Privacy Appeal. If an appeal is denied, the response will identify any regulator-contact option required by applicable law.

13A. Sensitive personal information

Some state laws treat certain categories as sensitive. If you choose Location Services for a Lightning Round, JBX collects precise geolocation, and for prize winners JBX may collect government identification and a taxpayer identification number.

JBX uses these categories only to confirm eligibility for a specific event, to prevent fraud and protect the integrity of an event, to verify a winner's identity, and to meet tax-reporting and record-keeping obligations. JBX does not use or disclose these categories to infer characteristics about you, and does not use them for advertising, profiling, or any purpose unrelated to the event or the legal obligation for which they were collected.

Because these uses fall within the purposes state law permits without a limit right, a request to limit will not extend to processing necessary to run an event you have entered, to verify a winner, or to meet a tax or record obligation. You may decline precise Location Services and choose your current state instead. If Called It cannot confirm that you are in an eligible state through either method, you cannot enter that Lightning Round. Declining identity or tax information required for a confirmed winner may prevent prize fulfillment but does not affect other parts of the Services. To make a request, use the channel in Section 13.

A selected state and any precise location you choose to provide for an eligibility check are retained only for the published eligibility and audit period for that event. Called It does not use them to build a location history or movement profile.

14. Children

The Services are not directed to children under 18, and JBX does not knowingly collect personal information from a child for a Called It account. If you believe a child submitted information, contact us so we can investigate and take appropriate action.

15. Deidentified and aggregated information

We may use information that is aggregated or deidentified so it is not reasonably linkable to an individual. Where law requires, we maintain it in deidentified form, use reasonable measures to prevent reidentification, and do not attempt to reidentify it except to test protections or as law permits.

16. External services

The Privacy Policy of an external Amazon/eBay seller applies after an affiliate handoff. App stores, authentication providers, Shopify/Shop Pay, payment providers, carriers, manufacturers, and other independent services may process information under their own notices. Review them before using those services.

Duffel supplies the embedded flight search, booking, payment, and help components and uses Evervault for card-data encryption and security. Airlines and their service/payment partners fulfill the flight contract shown before booking. Those flight suppliers may act independently for their own legal, operational, safety, fraud, and record-keeping duties. Called It does not authorize them to use booking information for unrelated advertising or data-broker activity.

17. Changes

We may update this Policy prospectively as systems, providers, law, or practices change. The current version and effective date will appear at the top. We will provide additional notice or obtain consent when applicable law requires it, and we keep this Policy aligned with our current practices.

18. Contact

Privacy questions and requests:

  • JBX Huddle LLC / Called It
  • Email: team@calledit.deals
  • Phone: 281-305-9305