Privacy Policy

Account information: email, name, organization, and authentication tokens provided by your identity provider (Clerk, Google, GitHub, etc.).

Customer inputs: the queries, URLs, and parameters you send to our APIs (search queries, extract URLs, research prompts). We process these inputs to deliver the Service.

Payment information: handled by our third-party payment processor. We receive only the card brand, last four digits, expiry, and a billing token — never the full card number.

Usage data: API request metadata (timestamps, endpoint, status codes, byte counts), which we use to enforce quotas, prevent abuse, and bill.

Website information: when you browse brime.dev, we collect IP address, user agent, referrer, and basic interaction events via our analytics provider. EU/UK visitors are not tracked without consent.

We use personal information to:

• deliver, secure, and maintain the Service;
• authenticate you and enforce plan quotas;
• process billing and prevent fraud;
• send transactional and security notifications (you cannot unsubscribe from these while you have an active account);
• send product and marketing communications, only with your opt-in consent — you can unsubscribe at any time;
• investigate misuse and comply with legal obligations.

We do not use customer inputs to train models, and we do not sell personal information.

Customer inputs and outputs: kept transiently in memory while a request runs. Job results and logs are retained for up to 30 days for debugging and reliability. You can request earlier deletion at any time.

Account records and usage logs: retained while your account is active and for up to 24 months after deletion for compliance and tax purposes.

We retain data only as long as we have a lawful basis. After that, we delete or anonymize it.

We share personal information only with:

• Sub-processors providing cloud infrastructure (Cloudflare), authentication (Clerk), payment processing, observability, and email delivery — all bound by data processing agreements;
• Model providers for AI endpoints (search answers, research). Customer inputs sent to model providers are governed by their respective zero-retention or short-retention agreements;
• Search index providers when our index cannot answer a query — only the minimum content necessary to fulfill the request;
• Law enforcement and regulators when we are legally required to do so (court orders, subpoenas, valid legal process);
• Successors in a merger, acquisition, or asset sale — with the same commitments we have made in this Policy.

We do not sell personal information and do not share it for cross-context behavioral advertising.

Brime operates infrastructure on Cloudflare's global edge network. Data may be processed in the United States, the European Union, or other regions where our sub-processors operate. For transfers out of the EEA, UK, or Switzerland we rely on Standard Contractual Clauses (and the UK Addendum where applicable), together with supplementary technical and organizational measures.

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). API keys are hashed; access to production systems is restricted to a small set of on-call engineers and audited. Secrets are managed through hardware-backed key stores.

No system is perfectly secure. If you believe an account has been compromised, email security@brime.dev immediately.

The brime.dev marketing site uses a small number of cookies and similar technologies:

• Essential cookies for authentication and security — always on;
• Preferences cookies for theme, layout, and saved playground settings;
• Analytics cookies for aggregated usage statistics — disabled for EU/UK visitors until consent is given.

You can clear or block cookies in your browser; some features may not work without them.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict our processing of your personal information, and to object to certain processing or withdraw consent. EU/UK customers also have the right to lodge a complaint with a supervisory authority.

To exercise these rights, email privacy@brime.dev. We will respond within 30 days. We may need to verify your identity before acting on a request.

Residents of California, Colorado, Connecticut, Virginia, Utah, and other US states with privacy laws have additional rights, including to know, delete, correct, and opt out of the sale or sharing of personal information for targeted advertising. We do not sell or share personal information for cross-context behavioral advertising.

To exercise these rights, email privacy@brime.dev with “State Privacy Request” in the subject line.

Our website does not respond to Do Not Track browser signals, because there is no industry-standard way to interpret them. We do honor the Global Privacy Control (GPC) signal where required by law.

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, email privacy@brime.dev and we will delete it.

A standard DPA is available on request and is automatically executed for Enterprise customers. To execute a DPA, email legal@brime.dev.

We may update this Privacy Policy from time to time. Material changes will be announced via email or on this page in advance. The “Last updated” date above reflects the most recent revision.

Privacy questions or requests? Email privacy@brime.dev. Our Data Protection Officer can be reached at the same address.

You can also write to: Brime, Inc. — Privacy, Wilmington, Delaware, USA.