Privacy Policy

1. About This Policy

This policy explains how Brilla ("we", "us") handles information on our website (getbrilla.co), our web app, and our iPhone app (together, the "Service"). Brilla is business software for auto detailing and similar service businesses, operated from the United States.

It covers two groups of people: account holders (business owners and their team members who sign in to Brilla), and their customers (people whose details a business keeps in Brilla, or who book, pay, or receive messages through a Brilla business's pages).

2. Information We Collect

From account holders:

• Account data: name, email address, and password when you register (passwords are stored hashed by our authentication provider, never in plain text). If you use Sign in with Apple or Sign in with Google, we receive the name and email address that service shares with us (with Apple, this may be a private relay address).
• Business data: business name, logo, address, phone, email, services, prices, and other settings you enter.
• Business records: clients, vehicles, jobs, bookings, quotes, invoices, expenses and receipts, mileage, payroll, inventory, team members, notes, marketing campaigns, and social media posts you create.
• Photos and files: job photos, receipt photos, logos, and images you upload for posts.
• Connected accounts: if you connect Google Calendar, Google Business Profile, Facebook or Instagram, we store the access tokens those services issue so we can act on your behalf. If you connect your own Twilio, Whop, or email (SMTP) account, we store the credentials you enter for it.
• Subscription data: Brilla Pro is bought on getbrilla.co through Whop, our payment processor. Whop tells us your subscription's status, its membership identifier, and when it renews or ends. We do not receive or store your card or payment details. Nothing is purchased inside the iPhone app.
• Device data: if you allow notifications in the iPhone app, your device's push notification token.
• Usage and technical data: pages visited, features used, IP address, browser and device type, and similar information collected by our hosting provider and analytics tools (see section 7).
• Support messages: anything you send us by email.

About a business's customers:

• Records a business enters: names, phone numbers, email addresses, service addresses, vehicle details, job history, photos, invoices, and notes.
• Information customers submit: through a business's booking page, customer portal, quote, invoice, or status pages: name, contact details, address or ZIP code, vehicle details, requested times, and notes.
• Messaging records: text messages and emails sent to customers, replies customers send to a business's texting number, whether a campaign email was opened (through a tracking image in the email), unsubscribes, and text-message consent records (the time, IP address, and browser used to give or withdraw consent).

3. Businesses' Customer Data

A business that uses Brilla decides what information it keeps about its own customers and how it contacts them. For that information, the business is responsible for it (the "controller"), and Brilla stores and processes it on the business's behalf, following the business's instructions and this policy. We don't use a business's customer data to market to those customers ourselves.

If you are a customer of a business that uses Brilla and want to see, correct, or delete your information, or stop receiving messages, please contact that business directly. Every marketing email has an unsubscribe link, and you can reply STOP to any text. If you can't reach the business, contact us and we will help where we can.

4. How We Use Information

We use information to:

• Provide, maintain, secure, and improve the Service
• Send the emails and texts a business asks the Service to send (booking confirmations, appointment updates and reminders, quotes, invoices, review requests, and campaigns)
• Sync appointments to connected calendars and publish posts to connected social and business profiles
• Provide the AI features described in section 6
• Manage subscriptions and send account, billing, and service announcements
• Prevent abuse, for example by rate-limiting requests by IP address
• Analyze aggregate usage to improve the product
• Respond to support requests and comply with legal obligations

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

5. Service Providers and Integrations

To run the Service, we share information with these providers, only as needed for the purpose listed:

• Supabase: database, authentication, and file storage for all account and customer data (hosted on Amazon Web Services)
• Vercel: website and app hosting, and page analytics
• Google Analytics: aggregate website and app usage analytics (see section 7)
• Resend: delivers the emails the Service sends, including emails to a business's customers (the recipient's address and the message content)
• Anthropic: processes the content of AI feature requests (see section 6)
• Apple: Sign in with Apple, push notifications to the iPhone app, maps in the iPhone app, and Apple Wallet appointment passes
• Google: Sign in with Google and Google Wallet appointment passes
• Upstash: short-lived rate-limiting counters keyed by IP address
• OpenStreetMap (Nominatim): geocoding, which turns an address or ZIP code into map coordinates
• U.S. Census Bureau geocoder: geocoding of the start and end addresses of a mileage trip
• FOSSGIS OSRM routing server (OpenStreetMap data): the driving distance between two map points for a mileage trip (it receives the coordinates only, not the address text)
• OpenStreetMap and CARTO map tiles: map images shown in the web app, loaded directly by your browser

These are used only when a business chooses to connect them:

• Google Calendar: we add, update, and remove events for jobs and booking requests on the connected calendar. Events include the service, the customer's name, contact details, address, and any booking notes. For online booking requests, the customer is added as a guest, so Google may email them an invitation.
• Google Business Profile: we publish the posts and photos you create to your business profile.
• Meta (Facebook and Instagram): we publish the posts and photos you create to your connected Facebook Page and Instagram account.
• Twilio: sends and receives text messages through the business's own Twilio account and phone number (the customer's phone number and message content). Customer replies are stored and forwarded to the business by email.
• Whop: processes Brilla Pro subscription payments, and separately processes invoice payments from a business's customers through the business's own Whop account. Card details are entered on Whop's pages, not ours, and we don't store them.

Geocoding sends the text of an address to OpenStreetMap. Client and job addresses, and the ZIP code a customer enters on a booking page, are looked up by our servers rather than from a customer's own browser, and the resulting coordinates are stored so each address is looked up once. The mileage log's Auto-calc looks a trip's two addresses up from our servers, with the U.S. Census Bureau's geocoder and then OpenStreetMap, and measures the drive between the two points with the OSRM routing server; these lookups are not stored. The business-address tool, and the mobile app's mileage tool, look addresses up directly from the account owner's browser or device.

Once information is sent to a connected service (for example, a calendar event or a published post), that service holds its own copy under its own privacy policy, and removing it from Brilla may not remove it there.

We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to the information transferred.

6. AI Features

Some features use AI models provided by Anthropic. When you use them, we send Anthropic only what the feature needs:

• AI assistant: your question, plus a summary of your business drawn from your account: business name and contact details, services and prices, counts and totals for jobs, invoices, and bookings, and recent and upcoming jobs and recent clients, including customer names
• Receipt scanning: the receipt photo you scan
• Business plan: your business name and summarized revenue, expense, and payroll figures
• Writing help for campaigns and posts: your business name and the instructions you type

These features only run when you use them. Under Anthropic's commercial terms, the content we send is not used to train their AI models. AI output can be wrong, so please review it before relying on it or sending it to customers.

7. Cookies and Analytics

Brilla uses cookies and your browser's local storage to keep you signed in and remember preferences such as the color theme. We use Google Analytics and Vercel Web Analytics to understand, in aggregate, how the website and app are used. Google Analytics sets cookies and receives the address of each page viewed (with account and record IDs and anything after the “?” removed), along with your IP address and browser and device information. These tools run on our website and in the web app, including public booking and payment pages, but not on private links sent to customers, such as job status, quote, photo gallery, customer portal, invite, and text-message consent links.

You can block or delete cookies in your browser, or use Google's Analytics opt-out add-on, but signing in requires cookies. The iPhone app does not include third-party analytics or advertising SDKs.

8. Data Storage and Security

Your data is stored on servers provided by Supabase (hosted on Amazon Web Services). Data is encrypted in transit (TLS) and at rest by our hosting providers, and access to a business's records is restricted to that business and the team members it grants access to. No system is 100% secure, so please use a strong, unique password.

Job photos taken in the iPhone app, and most job photos uploaded on the web, are resized and re-saved before upload, which generally removes embedded details such as the photo's location. Receipt photos and some image formats are stored as uploaded, so they may keep that information.

9. Your Rights and Choices

You can:

• Access, correct, or update most of your information directly in the app
• Export your client list from the Clients page, or ask us for a copy of your data
• Disconnect Google Calendar, Google Business Profile, Facebook, Instagram, Twilio, or Whop at any time in Settings
• Turn off push notifications in your device settings
• Delete your account (see section 10)
• Opt out of marketing emails from us

Depending on where you live, you may have additional rights under local law, such as the right to know what we collect, to request deletion, or to not be discriminated against for exercising these rights. To make a request, contact us at support@getbrilla.co. We may need to verify your identity first. If you are a customer of a business that uses Brilla, see section 3.

10. Deleting Your Account

You can delete your account at any time in the app or on our account deletion page. If you are a business owner, this deletes your sign-in and your business's data from our live systems, including its clients, jobs, invoices, photos, and other records, and removes your team members' access to the business (their own sign-ins are not deleted). If you are a team member, it deletes your sign-in and your personal settings; records you created for a business stay with that business.

Deleting your account doesn't cancel your Brilla Pro subscription. Cancel it from Billing on getbrilla.co first. Copies may remain in our providers' backups for a limited time until those backups expire, and information already sent to connected services (such as calendar events or published posts) stays there until you remove it.

11. Data Retention

We keep your information for as long as your account is active. When an account is deleted, we delete its data as described in section 10, except where we must keep certain records for legal, tax, or accounting purposes, or to resolve disputes and prevent abuse. Records of text-message consent and opt-outs may be kept after they change so we can honor them. Usage data held by analytics providers is kept according to their own retention settings.

12. Children's Privacy

Brilla is a tool for businesses, and you must be at least 18 to create an account. The Service is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Where Data Is Processed

Brilla is based in the United States, and information is processed and stored in the United States and in other countries where our service providers operate. By using the Service from outside the United States, you understand that your information will be transferred there.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you via email or in-app notice before material changes take effect. Continued use of the Service after changes constitutes acceptance.

15. Contact

Questions about your privacy? Email support@getbrilla.co, or visit our support page.