Privacy Policy

GoBrise LLC

Effective date: 26 September 2026

Last updated: 26 September 2026

GoBrise is an early-stage company. This policy describes our practices as they exist today. Where a feature, control or certification is planned but not yet available, we say so clearly. We will review this policy as the Service grows and may update it before general availability.

1. Introduction

This Privacy Policy describes how GoBrise LLC, a Wyoming limited liability company ("GoBrise", "we", "us", "our"), collects, uses, stores, shares and protects information in connection with the GoBrise AI customer support platform, the AI chat widget, the customer dashboard at app.gobrise.com, and the gobrise.com website (together, the "Service").

The Service allows businesses ("customers") to deploy an AI-supported chat widget and live chat on their own websites, grounded in knowledge base content that the customer provides. In that context:

• Where you are a GoBrise customer, team member or visitor to gobrise.com, GoBrise acts as the controller of your personal data and this Privacy Policy applies directly to you.
• Where you are an end visitor chatting through a customer's widget, that customer is the controller of your personal data and decides what data is collected, how long it is kept and for what purpose. GoBrise acts as a processor (service provider) on that customer's behalf and handles that data only under the customer's instructions. Requests about such data should be directed to the business whose website you were using.

This policy should be read together with our Terms of Service and our Data Processing Terms, which govern our processing of customer data as a processor.

2. Information we collect

2.1 Account and company information

Names, work email addresses, passwords or authentication identifiers, company name and details, website domains, billing contact details, plan and subscription information, and purchase records provided when a customer registers for or manages an account. If you choose to sign in with Google, we receive your name, email address and profile picture from Google. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

2.2 Team member information

Profile details, work email addresses, role and permission assignments, invitation records and activity records for the agents and administrators a customer invites into its workspace.

2.3 End-visitor conversation data

Messages, transcripts, conversation status and assignment records, AI confidence and escalation metadata, and any details a visitor chooses to provide through a customer's chat widget (such as a name, email address, phone number or order reference). Where a customer enables these features, this also includes lead details, meeting booking requests and support tickets that the AI agent captures during a conversation. This data is processed on behalf of the customer that operates the widget.

2.4 Knowledge base content

Text, documents, articles, FAQs and saved replies that customers or their team members create or upload; pages imported from a customer's website when the customer uses our website import feature; question-and-answer pairs a customer chooses to save from resolved conversations; and the search indexes and embeddings derived from this material.

2.5 Integration data

As integrations become available, where a customer connects the Service to a third-party system (for example a helpdesk, CRM, e-commerce store, API or webhook endpoint), the data exchanged through that connection and the credentials or tokens required to maintain it. The customer controls which integrations are enabled and what data flows through them.

2.6 Support and communications data

Correspondence with us, including support requests, bug reports, security or compliance questionnaires, sales enquiries and the contents of emails or messages you send to us.

2.7 Usage and technical data

Standard log, diagnostic and device information generated when the Service is used, including IP addresses, approximate location derived from IP address, browser and operating system type, referring pages, widget and session identifiers (including session tokens used for rate limiting), pages and features used, request timestamps, and error and performance data.

2.8 Website and marketing data

Aggregate analytics data when you visit gobrise.com and, where you submit a form, the details you provide.

2.9 Payment information

Billing details necessary to process subscription payments. Card and payment credentials are collected and processed directly by our third-party payment processor. GoBrise does not receive, store or process full payment card numbers. We receive only limited transaction data such as the last four digits of the card, card brand, billing country, invoice records and payment status.

We do not intentionally collect special category data (such as health, biometric, religious or political data) or government identifiers, and customers must not submit such data to the Service except as permitted in Section 3.4.

3. How we use information, and our legal bases

3.1 Purposes

We use the information described above to:

• provide, operate, host and maintain the Service and its features;
• create and administer accounts, workspaces, team invitations, roles and permissions;
• generate AI responses to visitor questions on a customer's behalf, grounded in that customer's own knowledge base;
• index knowledge base content, and question-and-answer pairs the customer chooses to save, so that the customer's own AI agent improves for that customer;
• route, escalate and hand off conversations to human agents;
• capture leads, meeting requests and support tickets where the customer has enabled those features;
• operate integrations, webhooks and APIs that a customer has enabled;
• authenticate users, secure accounts, apply rate limits, detect and prevent fraud, abuse, spam and misuse, and enforce our Terms of Service;
• provide customer support, diagnose faults and resolve technical issues;
• process payments, invoicing, renewals, taxes and collections;
• communicate with customers about their accounts, service changes, security notices and support matters;
• produce aggregated or anonymised statistics to understand and improve the Service;
• send marketing communications where permitted, subject to Section 12; and
• comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims.

3.2 Legal bases (EEA and UK)

Where the EU GDPR or the UK GDPR applies and GoBrise acts as controller, we rely on the following legal bases:

Where GoBrise acts as a processor for end-visitor conversation data, the legal basis for that processing is determined by the customer acting as controller and is governed by our Data Processing Terms.

3.3 What we do not do

• We do not sell personal information.
• We do not share or disclose personal information for cross-context behavioural advertising.
• We do not use one customer's conversation data or knowledge base content to answer questions for, or otherwise benefit, any other customer.
• We do not use advertising or cross-site tracking cookies.
• We do not use customer content to train general-purpose or foundation AI models. See Section 4.2.

3.4 Customer responsibilities and prohibited data

Customers determine what content is uploaded to the knowledge base and what data is collected through their widget. Customers must ensure they have a lawful basis and any required notices or consents for that data, and must not submit to the Service:

• protected health information or any data subject to the U.S. Health Insurance Portability and Accountability Act (HIPAA);
• payment card numbers, CVV codes or other data subject to PCI DSS;
• government-issued identification numbers, financial account credentials or passwords;
• special category or sensitive personal data as defined by applicable law; or
• any data subject to sector-specific regulatory obligations that GoBrise has not expressly agreed in writing to support.

GoBrise is not currently HIPAA-compliant and does not enter into Business Associate Agreements. Where the Service is used in healthcare, financial services, legal, company-formation or other regulated sectors, it is intended for general customer support and information only, and the customer remains responsible for its own regulatory compliance and for configuring escalation appropriately.

4. AI processing, AI providers and model training

4.1 How AI responses are generated

AI replies are switched off by default for every new workspace; each customer decides when to turn them on. When they are on, the content of a visitor message, relevant excerpts retrieved from the customer's own knowledge base, prior messages in the same conversation, and configuration set by the customer may be sent to third-party AI language model providers acting as our sub-processors. The provider returns a generated response, which is delivered in the conversation.

Retrieval is restricted to the knowledge base of the business whose widget received the question. There is no shared or cross-customer content pool. Where the customer's material does not support a reliable answer, the Service is designed to hand the conversation to a human agent rather than guess. A confidence score is recorded for each AI reply and is visible to the customer's team in the dashboard.

4.2 Model training

GoBrise does not use customer conversation data, end-visitor messages or knowledge base content to train, fine-tune or otherwise develop general-purpose or foundation AI models. We use AI providers and access routes whose published API terms state that submitted content is used to generate the requested response and is not used to train their models.

AI providers may retain submitted content for a limited period for abuse monitoring, security and legal-compliance purposes under their own published terms. GoBrise does not control that period. We will confirm our current AI providers and their applicable terms in writing on request as part of a vendor security review.

Within a single customer account only, knowledge base content and question-and-answer pairs the customer chooses to save are indexed so that the same customer's AI agent answers more accurately over time. This is confined to that customer's own account and never benefits any other customer. We may analyse usage in aggregated or anonymised form (for example volumes, resolution rates, latency and error patterns) to improve the Service; such data does not identify any individual, customer or end visitor.

4.3 AI transparency

Conversations through the widget are handled by an automated system unless and until a human agent takes over. Customers are responsible for ensuring their widget discloses to end visitors that they are interacting with an AI system where required by applicable law, including transparency obligations under the EU AI Act.

4.4 No automated decision-making with legal effect

The Service does not make automated decisions that produce legal effects concerning an individual or that similarly significantly affect an individual. AI-generated answers may be incomplete or inaccurate, are not professional, legal, medical or financial advice, and the customer deploying the widget remains responsible for content published under its brand.

5. How we share information, and our sub-processors

We do not sell personal information. We share information only as described below.

5.1 Service providers and sub-processors

We use third-party service providers ("sub-processors") to operate the Service. They process data only on our instructions, for the purposes we specify, under terms imposing confidentiality and data protection obligations, and may not use the data for their own purposes. We currently use sub-processors in the following functional categories:

We describe sub-processors by function rather than by name because providers may change at this stage. Customers requiring a named list of current sub-processors or completion of a vendor security questionnaire may request this at sales@gobrise.com and we will confirm the current providers in writing.

5.2 Between customers

Never. Every conversation, message and knowledge base entry belongs to exactly one customer account. Access rules are enforced in the database itself, not only in the application: dashboard data is returned only to signed-in members of the company that owns it, and the public chat widget can reach only the single business tied to its widget key.

5.3 Integrations chosen by the customer

Where a customer enables an integration, webhook or API connection, data is transmitted to that third-party system at the customer's direction. Once there, it is governed by that third party's own terms, and GoBrise is not responsible for its practices.

5.4 Legal and safety disclosures

We may disclose information where we believe in good faith that it is necessary to comply with applicable law, a valid legal process or a lawful government request; to enforce our Terms of Service; to detect, prevent or address fraud, abuse, security incidents or technical issues; or to protect the rights, property or safety of GoBrise, our customers, end visitors or the public. Where legally permitted, we will notify the affected customer before disclosing its data.

5.5 Corporate transactions

If GoBrise is involved in a merger, acquisition, financing, reorganisation or sale of assets, information may be transferred as part of that transaction. We will require the receiving party to honour commitments materially consistent with this policy and will notify affected customers of any change of controller.

5.6 Professional advisers

We may disclose information to our auditors, accountants, insurers and legal advisers where necessary, subject to professional confidentiality obligations.

6. Access to conversations by authorised personnel

Customer data, including conversation transcripts and knowledge base content, may be accessed by a limited number of authorised GoBrise personnel and contractors, only for:

• Support: investigating and resolving an issue a customer has reported to us, or that we have detected on the customer's behalf;
• Security: investigating suspected unauthorised access, credential compromise or other security incidents;
• Debugging and reliability: diagnosing errors, data integrity problems, degraded performance or failed AI responses;
• Abuse prevention: investigating suspected violation of our acceptable-use terms; and
• Legal compliance: responding to a valid legal obligation.

Safeguards:

• access is limited to personnel whose role requires it, on a need-to-know basis;
• personnel are bound by confidentiality obligations and internal data handling requirements;
• we use anonymised, aggregated or redacted data where that is sufficient for the purpose; and
• access for support purposes is, wherever practicable, undertaken at the customer's request or with the customer's knowledge.

Customer-visible audit logs and self-serve access reporting are on our Enterprise roadmap and are not yet available.

We do not read conversations for general product browsing, marketing or building data sets, and we do not use content accessed for these operational purposes to train AI models.

7. Data storage and security

The Service runs on managed cloud infrastructure using a PostgreSQL database with tenant-level isolation. Row-level access rules scope every record to the company that owns it, and those rules are enforced in the database itself. The public chat widget can reach only the single business associated with its widget key, and conversation history is readable only by members of the business that received it.

Other measures include encryption of data in transit using TLS, encryption at rest as provided by our cloud infrastructure, role-based access control within customer workspaces, hashed passwords managed by our authentication provider, and rate limiting on public widget endpoints.

To be explicit:

• GoBrise does not currently hold SOC 2, ISO 27001 or any other security or privacy certification, and does not claim to. SOC 2 is on our roadmap and has not been obtained.
• Single sign-on and SAML, customer-facing audit logs, custom data retention configuration and regional data residency are planned Enterprise capabilities that are not yet available.
• No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Customers are responsible for keeping their credentials confidential, managing which team members have access to their workspace, and notifying us promptly of any suspected unauthorised access.

8. Security incident and personal data breach notification

If we become aware of a personal data breach affecting customer data or personal data for which we are responsible, we will:

• take reasonable steps to contain and remediate the incident;
• notify the affected customer without undue delay, and in any event within 72 hours of becoming aware of the breach where the GDPR or UK GDPR applies, or otherwise within the period required by applicable law;
• provide the information reasonably available to us, including the nature of the incident, the categories and approximate volume of data involved, the likely consequences and the measures taken or proposed; and
• where GoBrise acts as processor, support the customer in meeting its own notification obligations.

Where we act as controller and applicable law requires it, we will notify the competent supervisory authority and, where the breach presents a high risk to individuals, the affected individuals directly.

9. International data transfers, hosting location and offshore team access

9.1 Hosting location

Customer data is currently hosted on managed cloud infrastructure located in the United States. Regional data residency is not currently offered. Organisations that require data to remain in a specific region should raise this with us before committing to the Service.

9.2 Transfers out of the EEA and UK

If you are located in the European Economic Area, the United Kingdom or Switzerland, your personal data will be transferred to and processed in the United States and other countries where we or our sub-processors operate, which may not provide the same level of protection as your home jurisdiction. Where such transfers take place, we rely on appropriate safeguards under applicable law, including the European Commission's Standard Contractual Clauses and, for the United Kingdom, the UK International Data Transfer Addendum. Customers that require executed Standard Contractual Clauses or a signed Data Processing Agreement may request them at sales@gobrise.com.

9.3 Offshore team access

GoBrise LLC is registered in the United States, and members of our team and contractors are located outside the United States, including in India. They may access personal data and customer data remotely only for the purposes and under the safeguards in Section 6, subject to confidentiality obligations and the transfer safeguards in Section 9.2 where applicable. Customers should take this into account when assessing the Service against their own data-localisation requirements.

10. Data retention and deletion

10.1 Customer control

Customers decide what data is collected through their widget and what content is uploaded to their knowledge base, and may delete conversations, knowledge base entries and team members from the dashboard at any time. For end-visitor conversation data, the customer determines how long data is kept. Configurable automated retention schedules are a planned Enterprise capability; until then, customers may request bulk deletion at privacy@gobrise.com.

10.2 Default retention

10.3 Account termination

On expiry, cancellation or termination of a customer account, the AI agent and widget stop operating, team member access is revoked, and data is retained and then deleted in accordance with Section 10.2. Customers should export any data they wish to keep before the end of the 30-day period. We may retain data longer only where required by law or to resolve a dispute, and will limit processing to that purpose.

10.4 Deletion requests

Requests for deletion may be made as described in Sections 11 and 16. Where we hold data as a processor on a customer's behalf, we will refer the request to that customer and act on its instructions.

11. Your data protection rights

11.1 EEA and UK (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your data in the circumstances provided by law;
• request restriction of processing;
• object to processing based on legitimate interests, and object at any time to direct marketing;
• receive a portable copy of data you provided to us in a structured, commonly used, machine-readable format;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with your local supervisory authority, or the UK Information Commissioner's Office if you are in the United Kingdom.

Where we process data on behalf of a customer, such as visitor conversations through that customer's widget, direct your request to that business and we will assist it in responding. For data we control directly, contact privacy@gobrise.com.

We will respond to verified requests within one month, extendable by two further months for complex requests. We may ask for information reasonably necessary to verify your identity. Exercising these rights is free unless a request is manifestly unfounded or excessive.

We do not currently have an appointed representative in the European Union or United Kingdom under Article 27 GDPR. Requests may be sent directly to privacy@gobrise.com.

11.2 United States privacy rights

Depending on your state of residence, you may have the right to know or access the personal information we hold about you; to request correction or deletion; to obtain a portable copy; to opt out of the sale or sharing of personal information and of targeted advertising; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

We do not sell personal information and do not share it for cross-context behavioural or targeted advertising, so no opt-out mechanism for those activities is required.

We handle requests individually rather than through a self-serve portal; contact privacy@gobrise.com. You may use an authorised agent, in which case we may require proof of authorisation. We will respond within the period required by applicable state law, generally 45 days, extendable where permitted. If we decline a request, you may appeal by replying to our response, and we will inform you of the outcome and of your right to contact your state attorney general.

11.3 Other jurisdictions

If you are located elsewhere and local law grants you rights over your personal data, contact privacy@gobrise.com and we will respond in accordance with that law.

12. Marketing communications

Service and transactional emails (account verification, sign-in and password resets, team invitations, billing notices, security notifications, changes to terms or policies, and support responses) are necessary to operate the Service, and you cannot unsubscribe from them while you hold an active account.

Marketing and product emails (announcements, feature updates, onboarding tips, newsletters and guides) are sent to business contacts on the basis of legitimate interests where permitted, or with consent where required. Every marketing email includes an unsubscribe link, and you may opt out at any time by using that link or emailing privacy@gobrise.com. We keep a minimal suppression record so that your preference is respected. Opting out of marketing does not affect transactional emails.

We do not use pixels or trackers to build advertising profiles, and we do not disclose your contact details to third parties for their own marketing.

13. Cookies, analytics and similar technologies

13.1 Marketing website (gobrise.com)

We use aggregate website analytics provided through our website hosting platform to understand traffic patterns and improve the site. These analytics do not use advertising cookies. If we introduce any analytics tool that sets non-essential cookies, we will ask for your consent first where required by law and will update this section.

13.2 The Service

The Service uses cookies and browser local storage only where needed to operate it, for example to keep team members signed in, maintain authentication tokens, remember interface preferences, and maintain a widget session so a conversation continues across page views. These are strictly necessary and cannot be disabled without preventing the Service from working.

13.3 What we do not use

We do not use advertising cookies, retargeting pixels or cross-site tracking technologies, and we do not participate in advertising networks or data brokerage.

13.4 Do Not Track and Global Privacy Control

Because we do not track users across third-party sites or engage in targeted advertising, no additional opt-out is necessary. Where we are required to honour an opt-out preference signal such as Global Privacy Control, we will do so.

13.5 Customer widgets

The storage used by a widget on a customer's website forms part of that customer's own site experience. Customers are responsible for reflecting the widget in their own cookie notice and obtaining any consent required in their jurisdiction.

14. Children's privacy

The Service is a business-to-business product intended solely for organisations and individuals aged 18 or over acting in a professional capacity. It is not directed at children, and we do not knowingly collect personal information from children under 16, or under 13 where that lower threshold applies under laws such as the U.S. Children's Online Privacy Protection Act. Customers must not deploy the widget in a manner directed at children without ensuring their own compliance with applicable children's privacy law. If you believe a child has provided us with personal information, contact privacy@gobrise.com and we will delete it promptly.

15. Changes to this policy

We may update this Privacy Policy as the Service evolves, as we add features or sub-processors, or as legal requirements change. The dates at the top of this page identify the current version. Where changes are material, we will give notice before they take effect by email to account administrators, by an in-product notice or by a prominent notice on this page, and will obtain consent where required by law. Previous versions are available on request.

16. Contact information

Data controller: GoBrise LLC, a Wyoming limited liability company, United States

• Privacy and data protection enquiries: privacy@gobrise.com
• Security reports and incidents: security@gobrise.com
• Product support: support@gobrise.com
• Sales, DPAs, sub-processor lists and vendor security reviews: sales@gobrise.com
• Contact page: gobrise.com/company/contact

Data Protection Officer: not appointed. As an early-stage company we are not currently required to appoint one; privacy enquiries are handled by our team at privacy@gobrise.com.

If you used a chat widget on another company's website, please contact that company first, as it is the controller of your data. If you cannot identify or reach them, contact us and we will make reasonable efforts to help.

17. Related documents and governing law

This Privacy Policy should be read together with our Terms of Service and our Data Processing Terms. Where a signed agreement between GoBrise and a customer, including a signed Data Processing Agreement, conflicts with this policy in respect of that customer's data, the signed agreement prevails.

This policy is governed by the laws of the State of Wyoming, United States, without limiting any rights you have under the mandatory data protection laws of your own jurisdiction, including the GDPR, the UK GDPR and applicable U.S. state privacy laws. Nothing in this policy restricts, waives or overrides those rights.