Privacy Notice

Who operates the services

Unfettered Minds LLC owns and operates the Briard-AI governance platform and the Briard Alert & Response Console (formerly KAIDAN) AI incident-response add-on.

Information we collect

Account identifiers, organization and membership records, subscription identifiers, support messages, AI-governance metadata, evidence files you deliberately upload, employee policy-recipient name, email, and department when an authorized organization supplies them, policy acknowledgment evidence, and limited campaign attribution. Stripe processes payment-card details; Briard-AI does not store full card numbers.

Metadata-only boundary

Do not submit CUI, PHI, customer production records, secrets, passwords, or raw AI prompt and output content. The product is designed for governance metadata, attestations, evidence references, and controlled evidence files.

Google Cloud connection

Google Cloud discovery is optional. An authorized administrator selects a project and region and approves access with a Google account. Briard verifies that account and project. For resource inventory, it requests model and endpoint names only, reduces them to hashed references, and records resource type, region, check times, and findings for workplace governance review. This check does not read prompts, responses, model contents, or training data, and does not invoke or modify models.

Connection records retain the selected project and region. The renewable grant stores the approving account identifier, project identifiers, permissions, and access credentials in encrypted form. Vercel processes application requests, and Supabase stores the connection and reduced findings with tenant access controls.

Google API information, including derived metadata, is used for the requested governance features and permitted security and support purposes. It is not used for advertising, campaign measurement, sale, or model training. Briard-AI's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Google's AI permission can allow more than reads when the approving account's IAM roles permit them. Use an account limited to the documented project metadata permissions. Briard makes only the inventory requests described here.

Pausing stops new checks. Disconnecting stops this connection's checks and removes its stored credential; it does not automatically remove the app's access from your Google Account or erase existing findings, check receipts, or project connection records. You can separately remove Google access in your Google Account settings. Saved records follow the retention rules below. Request access or deletion through Account or privacy@briard-ai.app; disconnecting alone is not a deletion request.

Browser Check extension

Browser Check is optional. After you agree and turn it on, it notices visits to a fixed list of supported AI website hostnames. It records the tool name, publisher, a site-identity hash, first and last notice time, notice count, and your Briard workspace ID. Pending metadata and the workspace ID are stored in the extension on your browser, then pending findings are sent to your signed-in Briard workspace through a quiet Briard tab. Browser Check does not read or send prompts, answers, page text, URL paths or queries, passwords, cookies, names, or device IDs. After Briard confirms a finding was saved, the pending record is removed and the extension retains the site-identity hash for that workspace to avoid reporting the same tool again. Pausing stops new notices. Removing the extension clears its local storage. Findings saved in Briard follow the workspace retention and deletion rules described below. Browser Check data is used only to deliver, secure, troubleshoot, and support the workspace's Shadow AI review. It is never used for advertising, campaign measurement, or general product analytics, and it is never sold. Vercel processes the request and application traffic needed to deliver Briard, and Supabase processes authentication and stores the tenant-scoped finding; no advertising provider receives Browser Check data. Briard's use and transfer of Browser Check information comply with the Chrome Web Store User Data Policy, including its Limited Use requirements.

How we use information

We use information to provide and secure workspaces, process subscriptions, deliver requested messages, deterministically assemble and export organization AI policies, deliver policy acknowledgment links and reminders, record receipt and understanding, generate governance artifacts, maintain audit history, respond to support and rights requests, prevent abuse, and measure product or campaign performance when you allow analytics.

Service providers

We use Vercel for application hosting, Supabase for authentication, database, and private object storage, Stripe for billing, Resend for transactional email, Google for consent-gated analytics and advertising measurement, and timestamp providers for ledger receipt metadata. Providers process information under their own contractual and security terms.

Sharing and sales

We do not sell personal information. We disclose information to service providers only as needed to operate the service, to a successor in a business transaction, when you direct us, or when required to protect rights, safety, and legal obligations.

Retention

We retain account and workspace information while the service is active and as needed for security, billing, legal, and audit obligations. Policy acknowledgment evidence defaults to seven years and may be configured by the customer from one to ten years. A customer legal hold pauses eligible deletion. When the configured period expires, Briard removes or de-identifies policy-recipient personal information while retaining non-identifying version, hash, and campaign totals. Verified deletion requests remove or de-identify other eligible information, subject to ledger integrity, fraud prevention, tax, dispute, and backup-retention requirements.

Your choices and rights

You may request access, correction, export, or deletion from the Account page or by emailing privacy@briard-ai.app. You may withdraw analytics permission at any time through Privacy choices. We verify requests before disclosing or deleting account information.

Security and incidents

We use tenant authorization, forced row-level security, private object storage, encryption in transit, request rate limits, provider secret isolation, and tamper-evident ledger metadata. No system is risk-free. Report suspected issues to security@briard-ai.app.

Children and international access

The service is intended for businesses and adults acting for an organization, not children under 18. The service is operated from the United States, and information may be processed in the United States.

Changes and contact

We may update this notice as the product or law changes and will revise the effective date. Questions and privacy requests may be sent to privacy@briard-ai.app.