Privacy Policy · Brigham.ai

1. Who we are and what this covers

Brigham.ai is an AI chief of staff offered by Nead, LLC ("we", "us"), of 1425 Broadway #22689, Seattle, WA 98112, as part of the erp.io suite. This policy explains how we handle personal data when you use Brigham.ai, including this website and the Brigham.ai service you reach by signing in through erp.io.

For workspace content and connected-account data, your company is the controller (or business) and we act as its processor (or service provider). For account, usage and website data, we act as the controller. If you have questions about which applies to you, ask us through the contact form at brigham.ai/company/contact.

2. What we collect

We collect the following categories of information.

Account information. When you sign in through erp.io, we receive your name, work email address, organization, role and the modules you can access. Brigham.ai has no passwords of its own.
Workspace content. What you and your colleagues type to Brigham.ai, the answers it produces, the tasks, notes, memories and documents you ask it to keep, and the records it reads from systems you connect, such as your CRM.
Connected-account data. When you connect an account such as Gmail or Google Calendar, Brigham.ai accesses data from that account through the provider’s interface, within the permissions you grant. Section 4 describes this in detail.
Usage and telemetry. Which tools ran, when, for which workspace, how many tokens and how much cost they used, errors, and audit events recording who did what. We use this to run the service, enforce budgets, bill through erp.io and keep it secure.
Website and contact data. If you request access or write to us, we keep what you send. Our website uses session cookies only (section 11).

3. How we use it

We do not sell personal data. We do not use customer content to train AI models.

To provide Brigham.ai: answer your questions, prepare briefings, draft messages and carry out actions you authorize.
To keep the service secure: authenticate users, enforce permissions and approvals, detect abuse and keep audit logs.
To operate and improve the service: measure reliability, fix defects and control cost.
To bill: report usage to the erp.io billing system.
To communicate with you about the service, including security notices and requested briefings.
To meet legal obligations.

4. Gmail and Google Calendar data

You connect your own Gmail and Calendar accounts. Each connection starts read-only and you can revoke it at any time.

Brigham.ai queries Gmail and Calendar live when you ask a question or when a briefing you have set up runs. It does not copy your mailbox. The limited data we store from these accounts is: message ids, summaries of threads you have seen through Brigham.ai, and follow-up candidates.

Where you opt in to draft access, Brigham.ai creates drafts in your Gmail Drafts folder. It does not send them. Sending, if offered in future, will require your approval of each message.

Your mail and calendar are private to you. Other users in your workspace, including workspace administrators, cannot see them through Brigham.ai. Sharing a thread is an explicit action you take.

Email content is treated as untrusted data. Text in an email cannot approve an action or change Brigham.ai’s permissions.

5. Google API Services User Data Policy

Brigham.ai’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to provide and improve user-facing features that are visible in Brigham.ai, such as search, summaries, follow-up detection, meeting preparation and drafts.
We do not transfer Google user data to others except as needed to provide or improve those features, to maintain security, to comply with applicable law, or as part of a merger or sale with your notice.
We do not use Google user data for serving advertisements, including retargeting or interest-based advertising.
We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is necessary to comply with law, or the data is aggregated and anonymized for internal operations.
We do not use Google user data to train generalized AI or machine-learning models.

6. AI processing

To generate responses, Brigham.ai sends the relevant parts of your request and the data it needs to AI model providers. We send what the task requires, not entire mailboxes or databases. Credentials and secrets are never included.

We do not use customer content to train models, and we choose providers and settings accordingly. Model output can be inaccurate. See the Terms of Service.

7. Who we share data with

We use service providers to run Brigham.ai. They may process personal data only on our instructions and under confidentiality and security obligations. The categories are:

AI model providers, to generate responses.
Cloud hosting providers, with our infrastructure hosted in the EU.
Content delivery and security providers.
Email delivery providers, to send notifications and briefings.
Payment processing, handled through the erp.io billing portal. Brigham.ai does not collect or store card details.

We may also disclose data where the law requires it, to protect rights and safety, or in connection with a merger, acquisition or sale of assets, with notice to you. Within your workspace, other users see only what your workspace’s permissions allow.

8. Protected finance data

Some data, such as accounting, bank and payment data and billing records, is handled as a protected domain. Access comes only from an explicit grant to a named person, never from a role. Content derived from protected data carries the same label, and administrative views show counts rather than content to people without a grant.

9. Data we ask you not to send

Some categories of sensitive data are excluded from Brigham.ai, for example health information. Please do not connect sources or enter content that contains them. The Terms of Service set out the rule.

10. Retention and deletion

Workspace content and stored derived data are kept while your workspace is active.
Connected-account tokens are removed when you revoke the connection or when your workspace is closed.
Audit and usage records are kept for as long as needed for security, billing and legal purposes, with sensitive values redacted before they are written.
After a workspace closes, we delete or anonymize its data within a reasonable period, except where the law requires us to keep it. Backups age out on their normal cycle.
Workspace administrators can export and delete workspace data from the workspace settings. You can also send us a request through the contact form at brigham.ai/company/contact and we will act on it.

11. Cookies

We use session cookies that keep you signed in and protect the session. We do not use advertising cookies or third-party tracking cookies. Because session cookies are strictly necessary, we do not show a cookie banner. If this changes, we will update this policy and ask for consent where required.

12. Security

No system is perfectly secure. If we learn of a breach affecting your data, we will notify you as the law requires.

Credentials and tokens are encrypted at rest and referenced by id. They are never placed in model context, logs or tool results.
Data is encrypted in transit with TLS.
Every tool call passes through policy checks in code, and sensitive actions wait for a person’s approval.
Audit logs record actions, with secrets redacted before writing.
Access is limited by least privilege. Every record is scoped to a workspace, and each query is filtered by it.
We do not currently hold third-party security certifications. We describe what the system does rather than pointing to badges.

13. International transfers

Our infrastructure is hosted in the EU. Some providers, including AI model providers and support systems, may process data in other countries. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

14. Your rights

Depending on where you live, you may have the following rights, and we honor them for everyone where we reasonably can.

Access: to know what we hold about you and receive a copy.
Correction: to fix inaccurate data.
Deletion: to ask us to delete your data.
Export: to receive your data in a portable format.
Objection and restriction: to object to or limit certain processing.
Withdraw consent: where we rely on it, at any time.
Complaint: to your local data protection authority.
Under California law (CCPA/CPRA): to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising, and we do not discriminate against you for exercising these rights.

If your data sits in a workspace run by your employer, your employer is the controller and we may refer your request to them. To make a request, use the contact form at brigham.ai/company/contact. We may need to verify your identity.

15. Children

Brigham.ai is a business service and is not directed to anyone under 18. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

16. Changes to this policy

We may update this policy. If a change is material, we will notify workspace administrators or post a notice before it takes effect. The date at the top shows when it was last updated.

17. Contact

Nead, LLC, 1425 Broadway #22689, Seattle, WA 98112. Privacy questions and requests: the contact form at brigham.ai/company/contact.