Privacy Policy
Who we are
BRAI (brai.bizlegal-ai.com) provides regulatory risk previews and reports. It is operated by BizLegal AI ("we", "us"), reachable at [email protected]. We are the controller of the personal data described here.
Privacy contact: [email protected]. Data protection lead: the BizLegal AI privacy team. EU representative: not appointed. UK representative: not appointed.
When a business customer uploads data about other people for us to process on its behalf, the customer is the controller and we act as its processor under the Data Processing Agreement at /legal/dpa.
What we collect
- Contact details you give us: name, email address, company and the message or form you submit.
- Order and billing records: the product bought, amount, payment method type and payment status. Card and wallet details are handled by the payment provider; we never see full card numbers.
- Technical data: IP address, browser type and pages requested, kept in server and security logs.
- Your consent choices: which optional categories you allowed, when, and the policy version.
- Text you submit to an AI feature, and the output it produced for you.
Why we use it, and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the product or report you asked for, and support you | Contract |
| Take payment, keep invoices and tax records | Contract; legal obligation |
| Send receipts, confirmations and service notices | Contract |
| Send newsletters or product updates you signed up for (double opt-in) | Consent |
| Send 4 short follow-up emails over 7 days about a tool you used, only when you ticked the box for them or confirmed a sign-up that lists them | Consent |
| Use an AI model to help draft our reply to a message you send through a contact or enquiry form | Legitimate interests |
| Count page views with cookieless analytics and Google Analytics 4 | Consent |
| Record partner referrals | Consent |
| Keep the service secure, prevent abuse and fraud | Legitimate interests |
| Improve our tools from aggregated, non-identifying usage | Legitimate interests |
| Comply with law and answer lawful requests | Legal obligation |
We do not sell personal data and we do not share it for cross-context behavioural advertising. We do not use your data for automated decisions that have legal or similarly significant effects on you.
AI processing
Some features send the text or documents you submit to an AI model provider listed below to produce an analysis. Whether a provider may use submitted content to improve its models: it depends on the provider and the plan, and some free tiers we use for drafting may use submitted content to improve their models, so do not submit content you are not allowed to share with a third-party AI provider. AI output can be wrong, and every AI result on our sites is labelled as AI-generated.
Who we share it with
We share personal data only with the service providers (processors) below, who act on our instructions, and with authorities when the law requires it.
If you send us a matter through the contact or real-estate forms, our routing service may send a partner lawyer or adviser a short summary of it (not your contact details) and email you an introduction that you can decline within 48 hours with the opt-out link. BizLegal AI may receive a finder fee if you hire the partner.
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Website hosting and serverless functions | Request data (IP address, user agent), form submissions in transit |
| Cloudflare | DNS, content delivery, bot protection (Turnstile), email routing, web analytics | Request data, IP address, bot-check signals |
| Supabase | Database and sign-in for some products | Account, order and product records |
| Neon | Database for leads, orders, consent records and usage logs | Lead, order and consent records |
| Hetzner | Server that runs scheduled research and content jobs | Lead and research records processed by those jobs |
| PayPal | Card and PayPal payments and subscriptions | Name, email, payment and billing details |
| NOWPayments | Cryptocurrency payments | Email, order and payment details |
| Payoneer | Bank-transfer payments | Payer and payment details |
| Resend | Email: receipts, reports, confirmations, and the newsletters and follow-up emails you agreed to | Email address and message content |
| Formspree | Forwards messages sent through the hub contact form to our inbox | Name, email, company and the message you send |
| Instantly | Sends business outreach email, with an opt-out in every message | Business email address, name and company |
| Google Analytics 4 | Website analytics, only after analytics consent and never when your browser sends Do Not Track or Global Privacy Control | Page views, device and browser data, approximate location, an analytics cookie identifier |
| Cloudflare Web Analytics | Cookieless page-view and page-speed measurement, only after analytics consent | Page views and referrers; no cookies, no personal profile |
| Cloudflare Workers and D1 (email sign-ups) | Stores the email sign-up form you submit, the consent record and your unsubscribe, and sends one confirmation email through Resend | Email address, consent record, campaign tags of the link you arrived on, a hashed network address |
| Plausible Analytics | Cookieless website analytics, only after analytics consent | Page views and referrers; no cookies, no personal profile |
| Google (Gemini API) | AI model that drafts or analyses content | Text submitted for analysis |
| OpenRouter | AI model routing | Text submitted for analysis |
| Ollama Cloud | AI model hosting | Text submitted for analysis |
| NVIDIA (API catalog) | AI model hosting | Text submitted for analysis |
| Anthropic | AI model used by some free hub tools (for example the AI Act and policy-refresh checks) and as a budgeted fallback for paid deliverables | Text submitted for analysis |
| GitHub | Code hosting; also stores the compliance snapshot requests made on the hub | Name, email, company and the request text |
| Firecrawl | Fetching public web pages for scans and research | Public URLs submitted for a scan |
| OpenAI | AI model used by DocAI analyses and by FalseEcho to ask what an AI answer engine says | Text submitted for analysis; the business name and questions in a FalseEcho scan |
| Perplexity | AI answer engine that FalseEcho queries during a scan | The business name and questions in a FalseEcho scan |
| Covalent (GoldRush) and Etherscan | Public blockchain data for TRACR wallet reports | The wallet addresses you submit |
International transfers
Several providers process data outside your country, including in the United States. Where data leaves the EEA or the UK, we rely on the European Commission's adequacy decision for Israel and, for providers in other countries, the EU Standard Contractual Clauses. You can ask [email protected] for a copy of the safeguards.
How long we keep it
- Account and billing records: 7 years after the last transaction, as tax and bookkeeping rules require.
- Lead, enquiry and newsletter records: 24 months after your last interaction with us, or until you unsubscribe or ask us to delete them.
- Uploaded documents and their results: the text of an uploaded document is not kept after the analysis; scan records (email, file name, findings) are deleted 90 days after their last update; AI Policy Generator drafts are kept until you ask us to delete them.
- SellerRadar reports: the figures read from your file (SKU, price, cost, units and the computed fees and margins) are kept with each report, with no automatic deletion, until you ask us to delete them.
- Security and server logs: 90 days.
- Consent records: for as long as we must be able to show your choice.
Your rights (GDPR and UK GDPR)
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to fix data that is wrong or incomplete.
- Deletion: ask us to delete your data, unless we must keep it by law (for example tax records).
- Portability: receive the data you gave us in a common machine-readable format.
- Objection and restriction: object to processing based on legitimate interests, including all direct marketing, or ask us to pause processing while a complaint is checked.
- Withdraw consent: change your cookie choice at any time with "Cookie settings" in the footer; withdrawal does not affect processing before it.
- Complaint: lodge a complaint with your local data protection authority.
Send a request to [email protected]. We answer within one month and may ask you to confirm your identity first.
To ask for access or deletion, email [email protected] from the address you used with us, with the subject "Data access request" or "Data deletion request". The "Request data deletion" link in the footer of every page opens that email for you. Records we must keep by law (for example tax records) are kept for the period above and deleted after it.
California residents (CCPA/CPRA)
California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights.
We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information beyond what the law permits. The categories we collect are the ones listed under "What we collect", from the sources described there, for the purposes in the table above. To use a right, write to [email protected]; an authorised agent may act for you with your written permission.
Security
We use encryption in transit, access controls limited to the people and systems that need the data and the encryption at rest our hosting and database providers apply. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
Children
Our services are for businesses and adults and are not directed to children under 16. We do not knowingly collect data from children under 16. If you believe a child under 16 has given us personal data, a parent or guardian can email [email protected] and we will delete it.
Cookies
See the cookie policy at /cookies for every cookie and storage item we use. Optional ones stay off until you allow them.
Changes
We will post any change here with a new effective date, and ask for consent again where the change requires it. Effective date: 2 October 2026.