Privacy Policy

Last Updated: October 24, 2026

This Privacy Policy explains how Breevy, Inc. ("Breevy," "we," "us" or "our") collects, uses, shares and protects personal information when you visit breevy.ai, use the Breevy app, connect other services to it or communicate with us. It also explains the choices and rights you have.

1. Who We Are and Our Role

1.1 Breevy, Inc. is a Delaware corporation. For the personal information we handle to run our business, such as accounts, billing, website analytics, support, marketing and our link-building library, Breevy is the controller. You can reach us at support@breevy.ai.

1.2 When our customers use Breevy, they bring their own content and connect their own services. Breevy processes the personal information in that content and those services, such as a customer's Search Console data, the reviews on their Business Profile or the content of their website, on the customer's behalf, and the customer is the controller. Section 13 of our Terms of Use governs that processing. If you have a question about how one of our customers handles your information, please contact that customer.

2. Information We Collect

2.1 Information you give us:

• Account details: your name, email address and password (stored only in hashed form) and, if you sign in with Google, your Google account's name, email address, profile picture and account identifier.
• Team details: your organization, its members, their roles and seats, and the email addresses of people you invite.
• Billing details: billing name, address and tax ID. Stripe handles card payments; we store only the card brand, last four digits, expiry date and payment records.
• Your answers to onboarding questions (such as your role, goals, SEO experience, tools and how you heard about us), survey and feedback responses, and reasons for cancelling.
• Support conversations, including chats through Intercom and emails.
• Requests for agency services (name, email, phone number, company, website and message), newsletter sign-ups and contact form messages.

2.2 Content in your workspaces: prompts and chat messages, agent instructions, files and links you add (with the text extracted from them; we remove location data from uploaded images), brand and business information, documents and drafts, keyword lists and projects, the notes and rules agents keep in memory, automations, approvals and the history of actions taken for you.

2.3 Information from services you connect:

• Google Search Console, Google Analytics 4 and Google Business Profile, as described in Section 6.
• WordPress, Shopify and Wix: your site's content, such as pages, posts, products, media and theme files, and the basic account details needed to connect, such as a Shopify store's name and contact details or a Wix site's members.
• Semrush or Ahrefs: data returned through the API key you provide.
• Email accounts you connect for outreach: sign-in details and the messages you send.
• Slack, webhooks, MCP servers and other tools: the data exchanged with them for the features you enable.

2.4 Information collected automatically:

• Usage information: features and pages used, actions taken, Credits consumed and timestamps.
• Device and connection information: browser and operating system, device type, language, IP address and the approximate location derived from it.
• Diagnostic information: error reports, logs and debugging traces, which can include prompts and responses.
• Cookies and similar technologies. We use optional analytics cookies only if you accept them. See our Cookie Policy.
• If you accept analytics cookies, how you first found us: the referring site, campaign parameters (such as UTM tags and ad click identifiers) and your landing page.

2.5 Information from other sources:

• Public websites and search data. We crawl web pages, such as your site, competitors' sites and pages relevant to your work, and use search, keyword, backlink and AI-assistant data from providers such as DataForSEO and Bright Data. This data can include personal information that people or businesses have published online.
• Link-building contacts, as described in Section 7.
• People who refer you to Breevy, and our payment processor, which tells us whether a payment succeeded.

2.6 Voice input. When you use the microphone in the composer, your browser's built-in speech recognition (in Chrome, provided by Google) turns your speech into text. Breevy receives only the text. Audio is not sent to or stored by Breevy.

3. How We Use Information

3.1 We use personal information for the purposes below. For people in the European Economic Area, the United Kingdom and Switzerland, we rely on the legal bases shown.

3.2 We do not use your content, or data from your connected services, to train AI models.

3.3 We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

3.4 Staff access. Our staff access your workspace content only to provide support you ask for, to fix problems, to protect security or to comply with the law. Staff access to customer transcripts is logged.

4. AI Processing

4.1 Breevy uses AI models from Anthropic, OpenAI and Google (through Google's paid Gemini API), and the other providers listed in Section 5.3. To answer a request, we send the provider the prompt, the relevant conversation and the workspace or connected-service data the task needs.

4.2 We use these providers under business terms that do not allow them to train their models on the data we send. Providers may keep data for a limited time to monitor for abuse, as their terms allow.

4.3 To show how AI assistants mention brands, we send the prompts you choose to track to assistants such as ChatGPT, Perplexity, Gemini, Claude and Microsoft Copilot, directly or through our data providers.

4.4 Output can reflect personal information contained in the inputs.

5. How We Share Information

5.1 We do not share personal information for cross-context behavioral advertising, and we do not use advertising cookies or pixels. We do not sell personal information, with one exception that some US state laws may treat as a sale: customers pay Credits to reveal the business contact details in our link-building library, as Section 7 describes.

5.2 We share personal information with:

• Service providers that process it on our behalf, such as cloud hosting, AI models, payments, email delivery, customer support, analytics and our customer relationship management system. They are listed in Section 5.3 and may use the information only to provide their services to us.
• Services you connect, at your direction, for example when an agent publishes to your site, replies to a review on your Business Profile, sends an outreach email from your mailbox or calls a tool you added.
• Your organization. If you use Breevy as part of an organization, its owner and admins can see and manage the content in its workspaces and your membership.
• Our customers, for contacts in the link-building library, as described in Section 7.
• Authorities and others, where the law requires it or where needed to protect the rights, property or safety of Breevy, our customers or others.
• A buyer or successor, if we are involved in a merger, acquisition, financing or sale of assets.
• Anyone else, with your permission.

5.3 Our service providers ("subprocessors"). The companies below may process personal data on our behalf, including personal data in our customers' content. Services that you connect to Breevy, such as Google Search Console, WordPress, Shopify or Wix, are not our subprocessors; they act under your own agreements with them.

5.4 Changes to our subprocessors. We update this list before a new subprocessor starts processing personal data. Business customers are told in advance and may object, as Section 13 of our Terms of Use describes.

6. Google User Data

6.1 When you connect a Google service, Breevy accesses only the properties you choose, and only the data below:

• Google Search Console: search performance (queries, pages, clicks, impressions and positions), index and crawl status, URL inspection results and sitemaps. Breevy can also submit your sitemaps.
• Google Analytics 4: your account and property names, and traffic and engagement reports. Access is read-only.
• Google Business Profile: your business information (such as name, address, phone number, website, hours and categories), reviews (including reviewers' names and review text), replies and posts.

6.2 How we use it. We use Google user data only to provide the features you use in Breevy: to show your reports, to answer your questions about them and to take the actions you approve. Those actions are submitting a sitemap to Search Console and, on your Business Profile, publishing a post, replying to a review or updating your listing details. Business Profile actions always wait for your approval.

6.3 Sharing. We transfer Google user data only to the service providers that help us provide those features, such as our cloud host and the AI model that analyzes a report you ask about, under terms that keep it confidential and prohibit training on it. We never sell Google user data, use it for advertising, transfer it to data brokers or information resellers, or use it to determine creditworthiness.

6.4 Human access. No one at Breevy reads your Google user data unless you ask us to (for example, in a support request), it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.

6.5 AI training. We do not use Google user data to develop, improve or train generalized AI or machine-learning models.

6.6 Storage and deletion. We store your Google access tokens in encrypted form. We keep synced data while your connection is active, and we refresh or delete Business Profile content within 30 days. When you disconnect a Google service in Breevy, we delete its access token at once and the data synced from that service within 30 days. We also ask Google to revoke our access, unless another Breevy connection in your workspaces uses the same Google account. You can also remove Breevy's access at any time at https://myaccount.google.com/permissions; when we detect that our access was removed, we delete the synced data within 30 days.

6.7 Breevy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

7. Link-Building Contacts

7.1 This section is for people whose business contact details are in Breevy's link-building library, which helps our customers find the right person to contact about their content.

7.2 What we collect and where from. We collect names, job titles and business email addresses that website owners and staff publish on their websites, such as on contact, about and author pages, together with the page where we found them. Where no address is published, we may infer a likely business address from common formats, such as a person's first name at their company's domain, and check with the mail server that it would accept the address, without sending an email. We may use an email-verification service for these checks.

7.3 How it is used. Our customers can search these contact details and pay Credits to reveal a contact's email address, to send individual outreach about content relevant to your website. The customer who contacts you is responsible for that message and must follow anti-spam laws and honor opt-outs. Because customers pay to reveal contact details, some US state laws, including California's, may consider this a sale of personal information.

7.4 Your choices. To opt out of this sale and have your details removed from the library, email support@breevy.ai with "Do not sell my information" or "Remove me" in the subject line, or use the unsubscribe link in any outreach email sent through Breevy. Either way, your details are removed for every Breevy customer and added to our suppression list, and no customer can reveal or email that address through Breevy again. You also have the rights described in Section 10.

7.5 Retention. We refresh the library regularly and keep contact details only while they are relevant. If no customer has revealed your contact details, we delete them after 12 months in which we have not found or checked them again. We keep a suppression record of people who asked to be removed so that we do not add them again.

7.6 Where we found your details. You can ask us at any time where we obtained your contact details. We will tell you the page where we found them, or that we inferred your address from your company's email format.

8. International Transfers

8.1 Breevy is based in the United States, and our systems run on Amazon Web Services in the United States. Our team works in the United States and in Israel, so authorized personnel in either country may access personal information as Section 3.4 describes. The European Commission recognizes Israel as providing an adequate level of protection for personal data. Our service providers process data in the United States and other countries, as listed in Section 5.3.

8.2 When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum and equivalent safeguards, or on a provider's certification under the EU-US Data Privacy Framework where available. You can request a copy of the relevant safeguards at support@breevy.ai.

9. Retention

9.1 We keep personal information only as long as needed for the purposes in this policy:

9.2 We may keep information longer where the law requires it, or to resolve disputes and enforce our agreements.

10. Your Rights and Choices

10.1 Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy in a portable format, restrict or object to its processing (including objecting at any time to direct marketing) and withdraw consent you gave, without affecting earlier processing.

10.2 If you are in the European Economic Area, the United Kingdom or Switzerland, you can also complain to your local data protection authority.

10.3 If you live in a US state with a comprehensive privacy law, you may have the right to know, access, correct, delete and port your personal information, and to opt out of its sale, sharing for targeted advertising or profiling. Apart from the link-building library in Section 7, we do not sell personal information, and we do not share it for targeted advertising or use it for profiling. In that library, the personal information customers can pay to reveal is business contact information: names, job titles, business email addresses and the web pages where they were published. Section 7.4 explains how to opt out. We use sensitive personal information, such as your account password, only to provide the Service and keep it secure. We treat a Global Privacy Control signal as a request to opt out, and because optional cookies stay off unless you accept them, no further step is needed on our website. We will not discriminate against you for exercising your rights. If we decline your request, you may appeal by replying to our decision.

10.4 If you are in Israel, Israel's Privacy Protection Law gives you the right to review the personal information we hold about you and to ask us to correct or delete information that is inaccurate, incomplete, unclear or out of date. You may also ask us to remove your details from any database we use to help others contact you, such as the link-building library, as Section 7.4 describes. If you are not satisfied with our response, you may complain to Israel's Privacy Protection Authority.

10.5 To exercise your rights, email support@breevy.ai. We may need to verify your identity before acting on a request, and an authorized agent may make a request for you with proof of authority. We respond within the time the law requires, generally within 30 days.

10.6 If your request concerns information we process for one of our customers, we will refer you to that customer or help them respond.

11. Security

11.1 We protect personal information with measures appropriate to the risk, including:

• Encryption of data in transit using TLS.
• Encryption at rest for stored files and for credentials to connected services, with secrets kept in a dedicated secrets manager.
• Access to customer data limited to authorized personnel who need it, as described in Section 3.4.
• Separation of each customer's data within the application by account and workspace.
• Redaction of credentials from AI conversations and logs.
• Automated deletion at the end of the retention periods in Section 9.
• Monitoring, logging and alerting for errors, abuse and security events.
• Review of our service providers' security and data protection commitments before we engage them.
• Confidentiality obligations for our personnel, and procedures for responding to incidents.

No system is perfectly secure, and we cannot guarantee absolute security.

12. Children

12.1 Breevy is for people aged 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we delete it if we learn that we have.

13. Marketing Communications

13.1 If you create an account, we may email you product news, tips and offers about Breevy. Every marketing email includes an unsubscribe link, and you can also unsubscribe by emailing support@breevy.ai. We will still send you service messages about your account, security and billing.

13.2 If you sign up for our newsletter, we first send one email to the address you give us, asking you to confirm. We send the newsletter only after you confirm, and then until you unsubscribe.

14. Changes to This Policy

14.1 We may update this Privacy Policy. We will post the new version with a new "Last updated" date and, for material changes, notify you by email or in the app before they take effect.

15. Contact Us

15.1 Breevy, Inc. · support@breevy.ai