Privacy Policy

This Privacy Policy describes how RendereelStudio LLC ("Company," "we," "us," or "our") collects, uses, discloses, and protects personal information through the Brevvo platform ("Service") at brevvo.ai. We are committed to protecting your privacy and handling your data with transparency and care.

1. Data We Collect

1.1 Account Information

When you register for an account, we collect:

• Full name and email address
• Business name and type
• Phone number (optional)
• Billing address and payment information
• Account credentials (passwords are hashed and never stored in plain text)

1.2 Business Data

In the course of using the Service, you may upload or generate:

• Customer Data — names, contact information, purchase history, preferences, and communications for your business's customers.
• Financial Data — invoices, transactions, revenue records, expense reports, bank feed data, tax-related documents, payroll information, and accounting entries.
• Employee/Staff Data — staff profiles, schedules, performance records, payroll details, W-4/I-9 forms, and benefits information.
• Operational Data — inventory records, appointments, bookings, service records, vendor information, and internal communications.
• Marketing Content — campaigns, email templates, social media content, and customer engagement data.

1.3 Usage Data

We automatically collect:

• IP address and approximate geolocation
• Browser type and version
• Device information and operating system
• Pages visited, features used, and time spent
• AI agent interactions and credit consumption
• Error logs and performance metrics

1.4 Data from Integrations

If you connect third-party services (e.g., banking via Plaid, Google Business Profile), we receive data as authorized by you through those integrations. We only access what is necessary to provide the connected functionality.

2. How We Use Your Data

We process your data for the following purposes:

Purpose	Legal Basis (GDPR)
Providing and operating the Service	Contract performance
AI agent processing and recommendations	Contract performance
Billing, invoicing, and payment processing	Contract performance
Customer support and communication	Contract performance / Legitimate interest
Analytics and service improvement	Legitimate interest
Security monitoring and fraud prevention	Legitimate interest
Legal compliance and regulatory obligations	Legal obligation
Marketing communications (opt-in only)	Consent

We do not use your business data to train machine-learning models. Your Tenant data is processed solely to deliver the Service to you.

3. How We Protect Your Data

• Encryption at Rest — All data is encrypted using AES-256-GCM encryption via AWS Key Management Service (KMS).
• Encryption in Transit — All communications use TLS 1.2+ encryption.
• Tenant Isolation — Row-Level Security (RLS) enforces strict data isolation between Tenants at the database level. No Tenant can access another Tenant's data.
• Web Application Firewall (WAF) — AWS WAF protects against common web exploits, SQL injection, and cross-site scripting.
• Access Controls — Role-based access control (RBAC) with AWS Cognito authentication. Multi-factor authentication (MFA) is available for all accounts.
• Audit Logging — Comprehensive audit trails record all data access and modifications.
• Infrastructure — The Service runs on AWS cloud infrastructure with SOC 2, ISO 27001, and FedRAMP certifications.
• Incident Response — We maintain a documented incident response plan with defined roles, escalation procedures, and communication protocols.
• Regular Assessments — We conduct periodic security reviews and vulnerability assessments of our systems.

4. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information or business data to any third party. We share data only in the following limited circumstances:

4.1 Infrastructure Providers

We use Amazon Web Services (AWS) as our cloud infrastructure provider. AWS processes data on our behalf under strict data processing agreements. AWS is SOC 2, ISO 27001, and GDPR compliant.

4.2 Payment Processors

Payment information is processed by our authorized payment processor to handle subscription billing and credit pack purchases. We do not store complete credit card numbers on our servers.

4.3 Legal Requirements

We may disclose your data if required to do so by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to:

• Comply with applicable laws or respond to valid legal processes.
• Protect the rights, property, or safety of RendereelStudio LLC, our users, or the public.
• Detect, prevent, or address fraud, security issues, or technical problems.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Service before your data becomes subject to a different privacy policy.

5. Data Retention

5.1 Active Accounts

We retain your data for as long as your account is active and as necessary to provide you with the Service.

5.2 After Account Termination

• 30-Day Export Window — After account termination, your data is retained for 30 days to allow you to request a data export.
• Permanent Deletion — After the 30-day window, your Tenant data is permanently deleted from our production systems.
• Backup Purge — Encrypted backups containing your data are purged within 90 days of account termination.

5.3 Legal Retention

Certain data may be retained beyond the periods above if required by law (e.g., financial records for tax compliance, data subject to legal holds, or records necessary for dispute resolution).

5.4 Usage Data

Aggregated, anonymized usage data that cannot be used to identify you may be retained indefinitely for analytics and service improvement purposes.

6. Your Rights Under CCPA (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

6.1 Right to Know

You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it.

6.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, ongoing service performance).

6.3 Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

6.4 Right to Opt-Out of Sale

We do not sell your personal information. As such, there is no need to opt out. If our practices change, we will provide a "Do Not Sell My Personal Information" mechanism.

6.5 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. You will not receive a different level of service or pricing for making a privacy request.

6.6 How to Exercise Your Rights

To submit a CCPA request, email us at privacy@brevvo.ai. We will verify your identity before processing your request and respond within 45 days.

7. Your Rights Under GDPR (EU/EEA/UK)

If you are located in the European Union, European Economic Area, or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR provide you with the following rights:

7.1 Right of Access (Article 15)

You may request a copy of the personal data we hold about you.

7.2 Right to Rectification (Article 16)

You may request that we correct inaccurate or incomplete personal data.

7.3 Right to Erasure (Article 17)

You may request deletion of your personal data where there is no compelling reason for its continued processing.

7.4 Right to Data Portability (Article 20)

You may request your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

7.5 Right to Restriction of Processing (Article 18)

You may request that we restrict the processing of your personal data in certain circumstances.

7.6 Right to Object (Article 21)

You may object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

7.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

7.8 How to Exercise Your Rights

To submit a GDPR request, email us at privacy@brevvo.ai. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us at privacy@brevvo.ai.

9. Cookies & Tracking

9.1 Session Cookies

We use strictly necessary session cookies to authenticate your login and maintain your session state. These cookies are temporary and expire when you close your browser or after your session times out.

9.2 No Tracking Cookies

We do not use third-party tracking cookies, advertising pixels, or cross-site tracking technologies. We do not participate in ad networks or retargeting programs.

9.3 Analytics

We collect anonymized, aggregated usage metrics internally to improve the Service. This data cannot be used to identify individual users.

10. Data Breach Notification

10.1 Detection and Response

We maintain continuous monitoring and alerting systems to detect potential data breaches. In the event of a confirmed breach affecting personal data, we will:

10.2 Notification to Authorities

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33, where the breach is likely to result in a risk to the rights and freedoms of individuals.

10.3 Notification to Affected Individuals

Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34). Notification will include:

• The nature of the breach and the categories of data affected.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach.
• Contact information for our data protection point of contact.

10.4 Notification to Tenants

As a data processor, we will notify affected Tenants (data controllers) immediately upon discovery of a breach affecting their Tenant data, enabling them to fulfill their own notification obligations.

11. California-Specific Disclosures

11.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers — Name, email address, phone number, IP address, account credentials.
• Commercial Information — Subscription records, billing history, credit purchase records.
• Internet or Network Activity — Browser type, pages visited, feature usage, interaction data.
• Professional or Employment Information — Business name, role, industry (as provided during registration).
• Financial Information — Payment method details (processed by our payment processor, not stored on our servers).

11.2 Categories of Information Sold or Shared

We have not sold any personal information in the preceding 12 months. We have not shared personal information for cross-context behavioral advertising purposes.

11.3 Sensitive Personal Information

We do not collect or process sensitive personal information as defined under CPRA for purposes other than providing the Service.

11.4 Authorized Agent

You may designate an authorized agent to submit CCPA requests on your behalf. The agent must provide written authorization signed by you, and we may require you to verify your identity directly.

12. International Data Transfers

The Service is hosted in the United States (AWS us-west-2 region). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. For EU/EEA/UK users, transfers are conducted in accordance with GDPR requirements, utilizing Standard Contractual Clauses (SCCs) where applicable.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service with a revised "Effective Date" and, where appropriate, by sending you an email notification. Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

14. Contact Information

For privacy-related inquiries, data subject requests, or complaints, please contact us:

RendereelStudio LLC
Data Protection Contact
Email: privacy@brevvo.ai
Website: https://brevvo.ai

For EU/EEA/UK residents: If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.