Privacy Policy

Information We Collect

We collect account information such as your email address, name, and authentication details, information about your Brea plan and agent instances, and technical information needed to run and secure the service.

When you use the dashboard, we may process agent instance status, model settings, usage totals, estimated costs, and channel connection details such as Telegram bot metadata.

We also collect information about how you use our website and dashboard: the pages you view, the site or ad that referred you, your IP address, your browser and device type, and identifiers stored in cookies and similar browser storage. When you arrive from an advertisement, the advertising platform adds its own click identifier to the link.

If you connect third-party services to your agent, such as Google, Notion, Dropbox, or Slack, we receive the credentials and data those services provide based on the permissions you grant. Google user data is described in more detail in the Google User Data section below.

If you choose to text yourself a setup link, we collect the phone number you provide only to send that requested setup message.

If you use the Brea iOS app, we also collect the information described in Brea iOS App below.

How We Use Information

We use information to create and secure your account, provision and manage agent instances, connect supported channels, send the notifications you allow, apply your purchases, show usage and billing information, provide support, prevent abuse, and improve reliability.

We also use information about how you use our website and dashboard to understand which features are used, to measure whether our advertising works, and to reach people who may be interested in Brea. See Advertising and Analytics below.

Brea iOS App

This section describes what the Brea iOS app collects. The rest of this policy also applies to the app.

Sign-in: you sign in with Apple or Google. We receive your email address and the basic profile information that Apple or Google shares with us, such as your name. If you use Hide My Email with Sign in with Apple, we receive a relay address from Apple instead of your email address. The app keeps your sign-in session in the iOS Keychain on your device.

Messages, photos, and files: we collect the messages you send to Brea in the app, the photos and files you attach, and the replies and files Brea sends you. The app uses your camera or photo library only when you choose to take or attach a photo. We store your conversation and files so your agent can do its work and so you can see them in the app, and we delete them when you delete your account.

Notifications: if you allow notifications, we store a push token for your device and send notifications through Apple Push Notification service. A notification shows the first part of a Brea reply, up to 180 characters, or the name of a file Brea sent, and it can appear on your lock screen depending on your iOS settings. We delete the push token when you sign out on that device or delete your account. You can turn notifications off at any time in iOS Settings.

Purchases: Apple processes all payments in the app, and we do not receive your payment card details. When you subscribe, the app sends us the signed purchase record from Apple, and Apple sends us updates when your subscription renews, changes, or ends. We store your plan, billing period, renewal status, and App Store transaction identifier. The app adds your Brea account ID to each purchase so we can apply it to the correct account. We do not share App Store purchases with advertising providers.

Saved logins: if you save a site login for Brea, we encrypt the username and password before we store them. Brea uses a saved login only to sign in to that site for you. The app does not show a saved password, and you can replace or delete a saved login in Settings.

Support: when you use Report an issue, your message goes to Help Scout, our customer support provider, together with your name, email address, Brea account ID, app version, and iOS version. Help Scout also stores an identifier for your device so the support form works.

Advertising and analytics: the app does not contain advertising or analytics software, and it does not use your device's advertising identifier. We do not send information from the app to advertising providers. When you create an account in the app, we send your email address and name to our analytics providers so we can count new accounts. We do not send your messages, files, or connected-account data to advertising or analytics providers.

On your device: the app keeps messages that are not sent yet and files you open. Signing out removes them.

Google User Data

If you connect Google services such as Gmail, Google Calendar, or Google Drive to your agent, Brea accesses your Google user data through Google's APIs using OAuth. We only request the permission scopes needed for the features you connect, and we only access your Google data when you or the automations you configure ask the agent to do something with it, such as reading or drafting email, checking your calendar, or saving a file to Drive.

How we use Google user data: we use it solely to provide the user-facing features you request, such as briefings, email triage, scheduling help, and the automations you set up in your automation library. We do not use Google user data for advertising, and we do not sell it.

How we store Google user data: OAuth tokens are stored encrypted by our managed OAuth infrastructure provider and are used only to act on your behalf. Content retrieved from Google services is processed to fulfill your requests and automations; we retain it only as long as needed to provide those features and to operate your agent, and we remove it when it is no longer needed.

How we share Google user data: we do not transfer Google user data to third parties except as necessary to provide the features you request, such as processing by the model providers configured for your instance so the agent can respond, or as required for security purposes or to comply with applicable law. Our service providers may process this data only on our instructions. Humans do not read your Google user data unless you give us explicit permission for support, it is required for security or legal reasons, or the data has been aggregated and anonymized.

Brea’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models. Model providers that process your requests are not permitted to use your Google user data to train their models.

You can disconnect a Google integration at any time from your dashboard or the Connectors screen in the iOS app, which deletes the stored connection credentials so Brea can no longer access your Google account. You can also revoke Brea's authorization directly from your Google Account security settings at myaccount.google.com/permissions. You can request deletion of any stored Google user data by emailing [email protected].

SMS and Mobile Data

SMS messages are optional and transactional. We use your mobile number only to send a link when you specifically request one. We do not send recurring or promotional text messages.

Message frequency is one message per request. Message and data rates may apply, depending on your mobile carrier and plan.

We do not sell, rent, or share mobile numbers, SMS opt-in data, or text messaging consent with third parties or affiliates for marketing or promotional purposes. Our SMS delivery provider processes this information only as necessary to deliver the message you requested and may not use it for its own marketing.

Advertising and Analytics

We advertise Brea on third-party platforms and measure whether that advertising works. To do this we share information about your visit — and, when you create an account or start a subscription on the website, information about that event — with the providers below. Some of this sharing happens in your browser, and some happens from our servers after the fact. We receive no money for it, but United States state privacy laws may still treat it as a sale or sharing of personal information.

Meta (Facebook and Instagram): we run the Meta Pixel on brea.ai and also send account and subscription events from our servers through Meta's Conversions API. Meta receives the pages you view, the referring URL, your IP address, your browser user agent, and the identifiers stored in the _fbp and _fbc cookies. For account creation and subscription events it also receives your email address, first and last name, and the city, state, and postal code from your billing details. Email, name, and address values are hashed before they are transmitted to Meta.

TikTok: we run the TikTok Pixel on brea.ai and send account and subscription events from our servers through TikTok's Events API. TikTok receives the same categories of information, the identifiers stored in the _ttp and ttclid cookies, and a hashed identifier we generate for your browser and, once you have an account, for your account. Email and other direct identifiers are hashed before they are transmitted to TikTok.

OpenAI Ads: we run the OpenAI Ads Measurement Pixel on brea.ai and send subscription events from our servers through OpenAI's Conversions API. OpenAI receives the page origin, your IP address, browser user agent, billing city, country, and postal code, hashed email and account identifiers, and the advertising identifiers stored in the __oppref and __obref cookies.

Google Analytics: measures how our website and dashboard are used. Google receives the pages you view, the referring URL, your IP address, device and browser information, and the identifiers stored in Google's _ga cookies.

PostHog: analytics for the website and dashboard, including landing-page experiments and which product features are used. PostHog receives browser and account identifiers and, when you have an account, your email address and name.

RudderStack: the customer data platform that collects these events from our website and our servers and routes them to the providers above. We also keep a copy of this event data in cloud storage we control.

Some of these tools are served from subdomains of brea.ai — hugo.brea.ai, fred.brea.ai, and greg.brea.ai for RudderStack, and f.brea.ai for PostHog. Serving them from our own domain keeps the requests first-party, but the information still goes to those providers. Cookies set through these subdomains should be treated as advertising and analytics cookies, not as cookies we use to run the site.

This section covers information about how you use our website and dashboard. It does not cover the content of your connected accounts. We do not share Google user data, or the email, files, calendars, or messages your agent handles, with any advertising or analytics provider.

Service Providers

We rely on service providers to operate Brea. They may process information only as needed to provide services to us, and only on our instructions. The categories are: cloud hosting and infrastructure; authentication and database; payments and billing, including Apple for purchases in the iOS app; AI model providers; connected-account and integration infrastructure; web search and automated web browsing performed by your agent; messaging delivery for SMS, iMessage, WhatsApp, and Telegram; push notifications through Apple Push Notification service; customer support; monitoring and observability; and the advertising and analytics providers named above.

We name our model providers because they may process the content your agent handles: OpenAI, Anthropic, Cloudflare Workers AI, TypeSafe, and models accessed through OpenRouter.

We require the third parties we share personal information with to protect it at least as well as this policy describes.

For a current list of the specific providers in each category, email [email protected].

We do not sell your personal information for money. We do share personal information with advertising and analytics providers as described in Advertising and Analytics above, which some United States state privacy laws treat as a sale or sharing.

Model Usage and Customer Content

Brea routes model usage through managed infrastructure so we can attribute usage and costs to the correct instance. We avoid storing raw provider keys in the web app and limit access to operational data to what is needed to provide the service.

Content you send through your agent may be processed by configured model providers and connected channels so the agent can respond.

Cookies and Similar Technologies

We and our advertising and analytics providers use cookies and similar browser storage. Some are required to run Brea: they keep you signed in and protect your session. Others measure how the site and dashboard are used, or measure and target advertising.

Some of these cookies are set by our servers rather than by JavaScript in your browser. This makes them last longer in browsers that limit how long script-written cookies survive.

You can clear or block cookies through your browser settings, and you can use browser or extension controls to block advertising and analytics scripts. Blocking the cookies required to run Brea will prevent you from staying signed in.

Retention

We keep information for as long as needed to provide Brea, comply with legal obligations, resolve disputes, secure the service, and maintain business records. We remove or anonymize information when it is no longer needed.

The copy of analytics and advertising event data we keep in our own cloud storage is deleted after 90 days. RudderStack and the advertising and analytics providers listed above retain the data they receive according to their own retention policies.

We store the advertising identifiers described above with your account so that a later signup or subscription can be attributed to the ad you arrived from. They are deleted when you delete your account.

Security

We use technical and organizational safeguards designed to protect customer data. No system is perfectly secure, but we work to limit access, avoid exposing secrets, and protect sensitive operational data.

Your Choices and Rights

You can choose not to provide optional phone information, and you can connect or disconnect third-party integrations, including Google services, at any time from your dashboard or the iOS app.

In the iOS app, you can turn off notifications or camera access at any time in iOS Settings. You can stop using Sign in with Apple for Brea in iOS Settings under your Apple Account.

To opt out of the advertising and analytics sharing described above, email [email protected] and we will stop sharing your information with those providers. You can also limit this directly with the platforms:

Meta: Ad preferences. TikTok: Privacy and ad settings. Google Analytics: Opt-out browser add-on. Industry-wide: optout.aboutads.info and optout.networkadvertising.org.

You can delete your account at any time from your dashboard account settings or, in the iOS app, from Settings > Account > Delete account. This removes your agents, cancels a subscription you bought on the website, and deletes your account data. Deleting your account does not cancel an App Store subscription. To cancel it, go to iOS Settings > your Apple Account > Subscriptions.

You may also contact us to request access to, correction of, or deletion of your personal information at [email protected], subject to legal and operational limits. We will not discriminate against you for exercising these rights.

Policy Changes

We may update this policy as Brea changes. When we make material changes, we will update the date above.

Contact

If you have questions about this policy or how we handle personal information, email us at [email protected].