Briq — Privacy Policy

Last updated: August 13, 2026

This Privacy Policy describes how Briq, Inc. ("Briq," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our website, platform, and services. This policy applies to all users, including visitors, free trial users, and enterprise customers.

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, phone number, company name, job title
• Payment information: Billing address and payment details (processed by our PCI-compliant payment processor; we do not store full card numbers)
• Communications: Messages you send through our platform, support requests, and feedback
• User content: Documents, data, and files you upload to our platform

1.2 Information Collected Automatically

• Usage data: Feature usage, session duration, pages visited, actions taken within the platform
• Device information: Browser type, operating system, device identifiers, screen resolution
• Log data: IP address, access times, referring URLs, error logs
• Cookie data: Information collected through cookies and similar tracking technologies (see our Cookie Policy)

2. How We Use Your Information

We use your information for the following purposes:

• Providing, maintaining, and improving our Services
• Processing transactions and sending related communications
• Responding to your inquiries and providing customer support
• Sending administrative information, updates, and security alerts
• Analyzing usage patterns to improve the user experience
• Detecting, preventing, and addressing fraud, abuse, and security issues
• Complying with legal obligations and enforcing our Terms

Construction project data processed by Otto is used only within your organization's context and is never shared with other customers or used for AI model training without explicit written consent.

Artificial Intelligence and Machine Learning

Briq uses AI models across its platform to provide document-processing features, such as extracting vendor names, amounts, and line items from invoices and other business documents you upload or import.

Third-party AI providers. These features are powered by API calls to the following providers: Google (Gemini API, paid tier), OpenAI, Anthropic, and Groq. Content is transmitted to these providers only to generate a response for your request and is processed under commercial API terms under which the providers do not use inputs or outputs to train or improve their models. We do not operate any self-hosted or offline AI models; all AI processing occurs through the provider APIs described above.

No model training on your data. We do not use your content — including any data received from Google APIs — to create, train, or improve generalized or foundational AI/ML models, and we do not sell or transfer your data to any third party for that purpose.

Google User Data

If you connect a Google account, we access Gmail data on a read-only basis solely to import business documents you have configured for automated ingestion, along with your email address and profile name to identify the connected account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy. Google Workspace user data is never used to develop, improve, or train generalized AI and/or ML models.

Where AI processing is applied to documents retrieved from your Gmail account, it occurs only through the paid, no-training API services listed above; Google user data is never transferred to any AI service that would use it for model training.

You may disconnect your Google account at any time in Settings → Email Sources or via your Google Account permissions page, which revokes our access and deletes stored credentials. For our full Google API disclosure, see https://briq.ai/google-api-disclosure.

3. How We Share Your Information

We do not sell your personal information. We may share your information with:

• Service providers: Infrastructure providers (AWS, GCP), analytics services, and customer support tools that process data on our behalf under strict contractual obligations
• Business partners: Only with your consent, for joint marketing or integration purposes
• Legal compliance: When required by law, subpoena, court order, or government regulation
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users

Sub-processors are listed in our Data Processing Agreement (DPA), available upon request. We do not share your data with advertising networks or data brokers.

4. Data Retention

We retain your personal information for the duration of your subscription plus ninety (90) days. Upon written request, we will permanently delete all your data within thirty (30) days. Certain information may be retained longer where required by law (e.g., tax records, transaction logs).

5. Data Security

We implement industry-leading security measures to protect your data:

• SOC 2 Type II certified with annual third-party audits
• AES-256 encryption at rest for all stored data
• TLS 1.3 encryption in transit for all data transfers
• SSO/SAML integration for enterprise single sign-on
• Role-based access controls (RBAC) with granular permissions
• 24/7 security monitoring and real-time threat detection
• Annual penetration testing by independent third parties
• Multi-factor authentication (MFA) support

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a structured, machine-readable format
• Opt-out: Opt out of marketing communications at any time
• Restrict processing: Request that we limit how we use your data

To exercise any of these rights, contact us at privacy@briq.com. We will respond within thirty (30) days, or within the timeframe required by applicable law.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

7.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which your information was collected, the business purpose for collecting your information, and the categories of third parties with whom we share your information.

7.2 Right to Delete

You have the right to request that we delete any personal information we have collected from you, subject to certain exceptions (e.g., completing a transaction, detecting security incidents, complying with legal obligations).

7.3 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

7.4 Right to Opt Out of Sale/Sharing

We do not sell your personal information as defined under the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising purposes.

7.5 Right to Limit Use of Sensitive Personal Information

You have the right to limit the use and disclosure of your sensitive personal information to that which is necessary to perform the Services.

7.6 Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality of service, or level of service for exercising your rights.

7.7 Categories of Personal Information

In the preceding twelve (12) months, we have collected the following categories of personal information:

7.8 How to Submit a Request

California residents may submit requests by emailing privacy@briq.com with the subject line "California Privacy Request," or by calling 1-888-BRIQ-AI1. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

8. Other State Privacy Rights

8.1 Virginia (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale of personal data, and profiling.

8.2 Colorado (CPA)

Colorado residents have similar rights to access, correct, delete, and obtain portable copies of their personal data, and to opt out of targeted advertising and the sale of personal data.

8.3 Connecticut (CTDPA)

Connecticut residents may access, correct, delete, and obtain copies of their personal data, and opt out of the sale of personal data, targeted advertising, and profiling.

8.4 Other States

We comply with all applicable state privacy laws, including those in Utah, Texas, Oregon, Montana, and other states with consumer privacy legislation. Contact us at privacy@briq.com to exercise your rights under any applicable state law.

9. International Data Transfers

If you are located outside the United States, your personal information may be transferred to and processed in the United States. We implement appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) where required by applicable law.

10. Children's Privacy

Our Services are not directed to individuals under the age of sixteen (16). We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 16, we will promptly delete that information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least thirty (30) days before they take effect by email or through the Services. The "Last updated" date at the top of this policy indicates when it was last revised.

12. Contact Us

For privacy-related inquiries, contact our Data Protection Officer:

• Email: privacy@briq.com
• Phone: 1-888-BRIQ-AI1
• Mail: Briq, Inc., Attn: Data Protection Officer