Privacy Policy

brightstack is an AI productivity platform for engineering leaders. The Service ingests information you provide and information you authorize us to access from third-party tools (for example, Google Workspace) to surface signals, summaries, and recommendations that help you run your team.

We designed the Service so that personal data is used only to deliver the features you ask for. We do not sell personal data, we do not use it for cross-context behavioral advertising, and we do not train AI models on your content unless you explicitly opt in.

We collect the following categories of personal data.

We use personal data for the following purposes:

• To provide, maintain, and secure the Service.
• To create, manage, and administer your account, including facilitating payments and responding to inquiries.
• To improve and develop the Service, including debugging and identifying or repairing issues that impair functionality.
• To communicate with you about the Service, including operational notices, security alerts, and (if you opt in) product updates and events.
• To prevent, detect, and investigate fraud, abuse, security incidents, and violations of our Terms of Service.
• To comply with legal obligations and protect the rights, safety, privacy, and property of users, brightstack, or third parties.
• To investigate and resolve disputes or security issues.

We may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described above, such as analyzing how the Service is used, improving features, and conducting research. We will maintain de-identified information in its de-identified form and will not attempt to re-identify it, except as required by law.

We may disclose your personal data in the following circumstances:

• Service providers and business partners (subprocessors). Third-party vendors that support our business operations and help us deliver and improve the Service, including hosting, cloud infrastructure, AI inference, observability, customer support, payment processing, and IT providers. These parties process personal data only as necessary to perform services on our behalf, consistent with our and your instructions and applicable law. The current list is published at our Subprocessors page.
• Business transfers. In the event of a merger, acquisition, restructuring, bankruptcy, or other corporate transaction, personal data may be disclosed to counterparties and advisers as part of due diligence or transferred as part of the transaction.
• Legal compliance and protection of rights. We may disclose personal data to government authorities or other third parties if we believe doing so is necessary to (i) comply with applicable laws, regulations, or legal processes, (ii) respond to lawful requests or investigations, (iii) protect the safety, rights, or property of any person, (iv) prevent fraud, security incidents, or other unlawful activity, (v) enforce our Terms of Service, or (vi) protect brightstack against legal liability.
• Affiliates. Entities that control, are controlled by, or are under common control with us, in a manner consistent with this Privacy Policy.
• Third-party services and integrations. If you choose to connect or interact with third-party services through the Service, your data may be shared with them as needed to deliver that integration, governed by their own terms and privacy policies.
• Business account administrators. If you create or use an account associated with an organization (for example, your employer), administrators may access and manage your use of the Service.
• With your consent. We may disclose personal data when you give us permission to do so.

When you authorize brightstack to connect to Google Workspace (Gmail, Calendar, Drive, Contacts, or related Google services), we access information from Google APIs strictly to provide the features you enable. We follow the principle of least privilege and request only the scopes required for each feature.

brightstack retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks, and any applicable legal requirements.

You can request deletion of your account and associated personal data at any time:

1. Use the in-product "Delete account" control in your account settings, or
2. Email [email protected] with the subject "Delete my account."

Once a deletion request is received, your account is soft-deleted immediately and is no longer accessible. Active-system data is hard-deleted within 30 days. Encrypted backups are retired on their normal rotation, no later than 90 days after the deletion request. We may retain a minimal record of the deletion event itself to demonstrate compliance.

We implement commercially reasonable technical and organizational measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption in transit and at rest, least-privilege access control, multi-factor authentication on production systems, audit logging, secure software development practices, and vendor reviews.

No method of transmission over the Internet or method of electronic storage is completely secure. You should use caution when deciding what information to share with the Service. We are not responsible for any circumvention of privacy settings or security features on the Service or on third-party websites linked through the Service.

Depending on where you live and the laws that apply in your country of residence, you may have certain rights in relation to your personal data, including the right to access, delete, correct, or transfer your personal data; to object to or restrict how we process it; or to withdraw your consent where processing is based on consent. You may also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, you or your authorized agent may contact us at [email protected]. We may request information to verify your identity before processing your request. If we deny your request, you may appeal by emailing the same address. brightstack will not discriminate against you for exercising any privacy rights available under applicable law.

• Right to know what categories of personal data we collect, the purposes for which we use it, and the types of third parties with whom we share it.
• Access and portability. You can request a copy of the personal data we hold about you and, where applicable, ask us to provide it in a portable format.
• Deletion of personal data collected from you in connection with your use of the Service, subject to certain exceptions.
• Correction of inaccurate personal data we maintain about you. While we make reasonable efforts to address correction requests, due to the nature of AI models we cannot guarantee the accuracy of Outputs generated by the Service.
• Objection to certain types of processing. Where applicable, we will stop processing unless we have legitimate legal grounds to continue.
• Restriction of our processing in limited circumstances, such as while a correction request is pending.
• Withdrawal of consent, where the legal basis for our processing is consent. Withdrawal does not affect the lawfulness of prior processing.
• No solely automated decisions. brightstack does not make decisions based solely on automated processing that have legal or similarly significant effects on you.
• No sale or targeted advertising. We do not "sell" or "share" personal data for cross-contextual behavioral advertising, and we do not process personal data for "targeted advertising" purposes (as those terms are defined under applicable US state privacy laws). We do not process sensitive personal data for the purposes of inferring characteristics about a consumer.

brightstack processes your personal data on servers located in various jurisdictions, including in the United States. While data protection laws vary by country, we apply the protections outlined in this policy to your personal data regardless of where it is processed, and we only transfer data in accordance with legally valid transfer mechanisms. For users in the European Economic Area (EEA), United Kingdom, or Switzerland, when you access our Service, your personal data may be transferred to our United States servers and other countries outside the EEA, UK, and Switzerland. Where information is transferred outside those regions, we require an adequate level of data protection (typically the European Commission's Standard Contractual Clauses).

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date at the top of this page, unless another type of notice is legally required. Your continued use of the Service after any change in this Privacy Policy will constitute your acceptance of such change.

If you have any questions about this Privacy Policy or our privacy practices, contact us at [email protected].

brightstack AI, Inc.