Privacy Policy

1. Overview

This Privacy Policy explains how Brisko AI, Inc. collects, uses, discloses, and protects personal information when individuals use Brisko's websites, applications, and related services.

This policy applies to personal information. It does not apply to information that cannot reasonably be linked to an individual or household.

Where a business customer controls employee or other user information through Brisko, that customer may be the primary decision-maker for that information, and Brisko may process it on the customer's behalf.

2. Information we collect

Information you provide

We may collect:

• Name.
• Email address.
• Telephone number.
• Business name.
• Job title.
• Account credentials through our authentication provider.
• Business address.
• Location information entered for a store.
• Billing contact information.
• Communications with support.
• Privacy requests.
• Feedback.

Business and operational information

We may process:

• Inventory records.
• Counts.
• Vendor records.
• Order records.
• Receipts.
• Invoices.
• Product images.
• Uploaded files.
• Employee assignments.
• Notes.
• Reports.
• Business settings.

Some business information may contain personal information.

Usage and device information

We may collect:

• IP address.
• Browser type.
• Device type.
• Operating system.
• Session and authentication events.
• Page interactions.
• Error logs.
• Security events.
• Approximate location derived from IP.
• Referring page.
• Timestamps.

Information from integrations

Where enabled, we may receive information from:

• Authentication providers.
• Payment processors.
• Email providers.
• AI-model and inference providers.
• Connected business applications.
• Vendor systems.
• Analytics providers.

The information received depends on the integration and permissions granted.

Connected-account cafe context

An administrator may choose to connect a Google Workspace or Microsoft 365 account for cafe context onboarding. When enabled for that account, Brisko requests read-only access to business email and the primary calendar from the previous 90 days to identify possible vendors, tools, ordering patterns, products, and recurring operational events.

The connected-account provider manages the OAuth credentials. Brisko stores opaque connection identifiers and status information, not the OAuth access or refresh tokens. This feature does not send email, change calendar events, or monitor the account continuously.

3. How we use information

We may use information to:

• Create and secure accounts.
• Provide inventory, ordering, vendor, reporting, and related tools.
• Process uploads.
• Generate reports.
• Support users.
• Send service communications.
• Bill for paid services.
• Prevent fraud and abuse.
• Monitor reliability.
• Debug errors.
• Improve usability.
• Develop features.
• Comply with law.
• Enforce agreements.
• Process privacy requests.
• Generate AI-assisted outputs when requested or enabled.
• Propose cafe setup information from a connected work account when an administrator requests that review.

4. AI processing

When users invoke AI-assisted features, Brisko may send relevant input to an AI provider.

Input may include:

• Text.
• Images.
• Receipt content.
• Inventory records.
• Vendor records.
• Prompt context.
• Other information required to complete the request.

For connected-account cafe context onboarding, Brisko first filters, normalizes, shortlists, and redacts source records before sending excerpts through Vercel AI Gateway to a Baseten-hosted Z.AI model. Brisko requires the gateway route to use zero data retention and disallow prompt training. If an eligible route is unavailable, the scan fails instead of using a less protective route.

Raw provider responses, email bodies, calendar descriptions, OAuth tokens, and model prompts are not stored in Brisko's Convex database. Brisko may store proposed structured facts, limited evidence metadata such as source type, optional business domain, timestamp, and an opaque source hash, model and usage metadata, and choices the administrator accepts. Suggested facts do not become authoritative inventory counts or prices automatically.

When an AI provider is enabled, Brisko will configure available data controls consistent with the selected service and identify relevant providers in the Subprocessor List.

AI output may be stored with the related business record, prompt, model identifier, confidence, and audit metadata, depending on the feature.

Do not upload sensitive information to an AI feature unless the feature expressly supports it.

5. How we disclose information

We may disclose information to:

Service providers

Companies that help provide:

• Cloud hosting.
• Authentication.
• Storage.
• Payments.
• Email.
• Monitoring.
• Analytics.
• Customer support.
• AI processing.
• Connected-account authorization and read-only data access.
• Security.

Your organization

Account owners and administrators may access information associated with their organization, including employee activity where permitted by the product and law.

Integrations and vendors

At your direction, Brisko may receive information from or transmit information to connected services or prepare information for vendors.

Legal and safety purposes

We may disclose information where reasonably necessary to:

• Comply with legal process.
• Protect rights and safety.
• Investigate abuse.
• Prevent fraud.
• Enforce agreements.
• Respond to lawful government requests.

Business transfers

Information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law.

6. Sale and targeted advertising

Brisko does not presently sell personal information for monetary consideration.

Brisko does not presently use personal information for cross-context behavioral advertising.

If that changes, Brisko will update this policy and provide legally required choices before the change takes effect.

7. Data retention

Brisko retains information for as long as reasonably necessary to:

• Provide the Services.
• Maintain business records.
• Resolve disputes.
• Enforce agreements.
• Prevent fraud.
• Meet legal obligations.
• Maintain backups.
• Support security investigations.

Retention varies by data type.

For connected-account cafe context onboarding, Brisko stores only the structured learned context and limited evidence and operational metadata described above. An administrator can disconnect a work account and request deletion of unconfirmed learned context tied to that connection. Vendor or other records the administrator separately accepted remain ordinary business records and follow their normal deletion controls.

Deleted information may remain temporarily in encrypted backups and logs until normal expiration.

8. Security

Brisko uses reasonable safeguards designed to protect information.

Safeguards may include:

• Encryption in transit.
• Encryption at rest where supported.
• Access controls.
• Authentication.
• Audit logging.
• Backups.
• Monitoring.
• Least-privilege practices.
• Secure development processes.

No security program eliminates all risk.

Brisko maintains safeguards and response procedures intended to meet obligations that apply to the information it handles.

9. Your choices and rights

Depending on applicable law, you may have rights to:

• Confirm whether personal data is processed.
• Access personal data.
• Correct inaccuracies.
• Delete personal data.
• Obtain a portable copy.
• Opt out of certain sale, targeted advertising, or profiling.
• Appeal a denied request.

An administrator may choose not to connect a work account and may disconnect an existing cafe context connection from Brisko's settings. The core sign-in and inventory workflows do not require this connection.

Submit a request by contacting hello@brisko.ai.

Brisko may need to verify your identity.

If your information is controlled by your employer or another business customer, Brisko may direct your request to that organization.

10. Texas privacy rights

Texas residents may have rights under the Texas Data Privacy and Security Act.

Brisko will provide a reasonable request method and an appeal process where required.

Brisko will not discriminate against an individual for exercising applicable privacy rights.

Whether a particular privacy right applies can depend on the person, data, business relationship, and applicable exemption. Brisko will review each verified request under the laws that apply.

11. Children

Brisko is designed for businesses and is not directed to children under 13.

Brisko does not knowingly collect personal information directly from children under 13.

12. International use

Brisko may process information in the United States and other countries where service providers operate.

Where required, Brisko will use appropriate transfer mechanisms.

13. Cookies

Brisko uses cookies and similar technologies for authentication, security, and essential preferences. Optional analytics cookies or similar storage may be used only after a user allows analytics. Brisko does not currently use marketing cookies.

More information appears in the Cookie Policy.

14. Third-party links and services

Brisko may link to third-party websites or connect with third-party services.

Their privacy practices are governed by their own policies.

Brisko is not responsible for third-party privacy practices.

15. Changes to this policy

Brisko may update this policy.

Material changes will be communicated through reasonable means.

The effective date identifies when the current version applies.

16. Contact

Privacy questions and requests may be sent to:

Brisko AI, Inc. Email: hello@brisko.ai