Privacy Policy

Last updated June 22, 2026

1. The short version

This Privacy Policy explains how Pattern Build, LLC, the owner of the Column trademark and intellectual property ("Pattern Build," "Column," "we," "us"), handles information in connection with Column. Column is a business tool used by content agencies to create thought-leadership content for their clients. This policy explains what we collect, how we use it, and your choices.

A few things up front:

• We do not train AI models on your content. We don't use your uploads, voice profiles, transcripts, or generated content to train, fine-tune, or improve any AI model — ours or our providers' — unless you explicitly opt in. Our AI providers are contractually barred from training on your data and operate under zero- or short-retention terms.
• We don't sell your data, and we don't show ads.
• Two kinds of data, two roles. For most content our agency customers put into Column (including information about the clients they write for), the agency controls that data and we process it on the agency's behalf. For our own website, sign-up, and billing, we control the data. Section 3 explains the difference.

2. Who this policy covers

This policy applies to: visitors to our website; agencies and their team members who use Column ("Customers" and "Authorized Users"); and individuals whose information an agency uploads, including the clients and other persons an agency writes for ("Represented Persons").

If you are a Represented Person or another individual and an agency has uploaded information about you, that agency decides how your information is used in Column. Please direct requests about your data to the agency. We will help the agency respond and will act on its instructions, and we will comply with applicable law.

3. Our two roles: controller vs. processor

• When we act as a processor (service provider): the personal data inside a Customer's workspace — Customer Content, Voice Profiles, and Output — is controlled by the Customer (the agency). We process it only to provide the Service and on the Customer's instructions, as set out in our Data Processing Addendum. The agency's own privacy policy governs how it handles this data.
• When we act as a controller: account registration data, billing data, website and product usage analytics, and support communications. This policy governs that data.

4. Information we collect

4.1 Information you give us (as controller):

• Account data: name, business email, company name, role, password.
• Billing data: plan, billing contact, and payment information (processed by our payment processor; we do not store full card numbers).
• Support and communications: messages you send us and their contents.

4.2 Information in your workspace (we process on your behalf):

• Customer Content you upload — writing samples, articles, newsletters, resumes, biographies, LinkedIn and other social content, websites and profiles, interview transcripts, meeting notes, and call recordings or summaries.
• Voice Profiles built in your workspace to generate content in a Represented Person's style.
• Output generated by the Service.

You decide what to upload. Please do not upload information you are not authorized to share, special-category or sensitive data you don't need, biometric identifiers (such as voiceprints), or third-party confidential information without authorization.

4.3 Information collected automatically (as controller):

• Usage and device data: log data, IP address, browser/device type, pages and features used, and similar diagnostics, collected via cookies and similar technologies. See Section 10.

5. How we use information

We use controller data to: provide and secure the Service; authenticate users; process payments; provide support; send service and (where permitted) marketing communications; understand and improve how the Service is used in aggregate; and comply with law and enforce our terms.

We use workspace data only to provide the Service to you, including to: operate your workspace and generate Output; troubleshoot issues you report; prevent fraud and abuse; and produce aggregate operational metrics that do not identify you, any Represented Person, or the content of your data.

We do not use workspace data to train, fine-tune, or improve AI models (except with your opt-in), and we do not sell personal data or share it for cross-context behavioral advertising.

6. How AI processing works

Column generates content using third-party large language models accessed through their APIs. When you generate Output, your relevant inputs and Voice Profile context are sent to the model provider to produce a response and returned to your workspace. We use providers that contractually agree not to train on your data and to apply zero- or short-retention terms. Output is an AI-generated draft that may be inaccurate; a human must review it before publication. For more, see our AI Usage Policy.

7. How we share information

We share information only as follows:

• Service providers / subprocessors that help us run Column (hosting, AI model providers, analytics, payment processing, email delivery and marketing email providers including Resend, customer support). They are bound by contract to protect the data and use it only to provide their service to us. A current list of our subprocessors is available on request.
• Within your workspace, with the Authorized Users you invite.
• For legal reasons, to comply with law, respond to lawful requests, or protect rights, safety, and security.
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal data or share it for cross-context behavioral advertising.

8. International data transfers

We are based in the United States and process data there. Where we receive personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including the Standard Contractual Clauses and, where we have self-certified, the EU-U.S. Data Privacy Framework and its UK Extension. Our Data Processing Addendum sets out the transfer terms for workspace data.

9. Data retention and deletion

• Active accounts: we retain workspace data while your account is active and you are using the Service.
• After cancellation/termination: you may export your data for 90 days, after which we delete workspace data from production systems.
• On deletion request: when you delete a Represented Person, Voice Profile, specific content, or a workspace, we remove the data from production systems within 7 days.
• Backups: encrypted backups expire on our regular cycle, within 90 days.
• Audit and access logs: retained for approximately 12 months for security and compliance.
• Controller data (account, billing): retained as needed for the relationship and to meet legal, tax, and accounting obligations.

We may retain limited information where required by law or to resolve disputes or enforce agreements.

10. Cookies and analytics

We use cookies and similar technologies on our website and in the product for authentication, preferences, security, and aggregate analytics. You can control cookies through your browser. Where required, we present a consent banner.

11. Your privacy rights

Depending on where you live and your relationship with us, you may have rights to access, correct, delete, port, or restrict your personal data, to opt out of certain processing, and to withdraw consent.

• If your data is in an agency's workspace (you are a Represented Person), contact that agency, which controls the data. We will assist the agency and act on its instructions.
• For data we control (account, billing, website), contact us at privacy@hicolumn.com and we will respond as required by law.

11.1 California (CCPA/CPRA). California residents have rights to know, access, correct, delete, and opt out of "sale"/"sharing" (we do neither), and to limit use of sensitive personal information, and not to be discriminated against for exercising rights. For workspace data, we act as a service provider and process personal data only under our written contract with the Customer and not for our own purposes. To exercise rights for data we control, contact privacy@hicolumn.com. You may use an authorized agent.

11.2 EEA/UK (GDPR/UK GDPR). Where we are a controller, our legal bases are: performance of a contract (providing the Service), legitimate interests (securing and improving the Service, in aggregate), consent (where required, e.g., certain cookies/marketing), and legal obligation. You may lodge a complaint with your supervisory authority. For workspace data we act as a processor under the DPA.

11.3 Other U.S. states. Residents of states with comprehensive privacy laws have similar rights; contact privacy@hicolumn.com. For workspace data, direct requests to the controlling agency.

12. Security

We use administrative, technical, and physical safeguards designed to protect personal data, appropriate to its nature and the risks involved. These include measures such as encryption of data in transit and logical separation of customer workspaces, and they evolve as our security program matures. No system is perfectly secure. Our security commitments for workspace data are described in the DPA.

13. Children

The Service is for business use and is not directed to children under 16, and we do not knowingly collect their personal data.

14. Changes to this policy

We may update this policy. We will post the updated version with a new date and, for material changes, provide additional notice.

15. Contact us

Pattern Build, LLC — Column
Privacy: privacy@hicolumn.com
Mailing address: Pattern Build, LLC, 30 N Gould St, Ste R, Sheridan, WY 82801