1. Who processes your data
1.1. The controller of personal data is Maksim Pukhalskii, an individual entrepreneur registered under the laws of Georgia, identification number NAP347016659, registered address: 12 Mzia Eristavi, Georgia (the “Controller”, “we”), owner of the Branzy platform available at https://branzy.app (the “Platform”).
1.2. For any question about the processing of personal data, including exercising your rights, contact info@branzy.app.
2. Which law applies
2.1. Personal data is processed in accordance with the personal data protection legislation of Georgia.
2.2. If you are located in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR, EU Regulation 2016/679) additionally applies to the processing of your data, since we offer services to users in the EU.
2.3. The Platform is aimed primarily at users outside Georgia; we do not carry out targeted marketing on the Georgian market. Technical availability of the site does not mean the Platform is offered in every jurisdiction. You are responsible for complying with the mandatory rules of the country from which you access the Platform.
2.4. This Policy covers data we receive through the Platform, the website, the mobile applications, and connected external communication channels.
3. What data we collect
3.1. Account data: first name, last name, email address, password in encrypted form, interface language, notification settings.
3.2. Content you create: tasks, messages, comments, notes, files, calendar entries, and knowledge base materials.
3.3. Messages from connected external channels. If you connect external communication channels to the Platform (for example, messengers or email), we receive the conversations and the contact details of the people you talk to, in order to display them in the Platform.
3.4. Payment data: information about the selected subscription and payments. Bank card details are processed by the payment provider; we neither receive nor store them.
3.5. Technical data: IP address, device and browser type, application version, session identifiers, service access logs.
3.6. Support requests: the content of your correspondence with us.
4. Legal bases for processing
4.1. Performance of a contract — providing access to the Platform, operating its features, billing, and support.
4.2. Consent — optional mailings, analytics cookies (Google Analytics, Yandex Metrica), and connecting individual external services. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing before the withdrawal.
4.3. Legitimate interest — security, prevention of abuse, technical diagnostics, and product development. We rely on this basis only where your rights and interests do not override our interest.
4.4. Compliance with legal obligations — accounting and tax records, responses to lawful requests from competent authorities.
5. Why we process data
- providing the features of the Platform: tasks, messages, calendar, knowledge base;
- creating and maintaining your account;
- processing payments and providing the paid subscription;
- operating generative-model features at your request;
- notifying you about events in the Platform;
- responding to support requests;
- ensuring security and investigating incidents;
- complying with legal requirements.
6. Artificial intelligence features
6.1. Certain features of the Platform use generative models. When you invoke such a feature, the content of your request and the related context are sent to the model provider in order to produce a response.
6.2. We do not use the content you upload to the Platform to train our own or third-party models.
6.3. We do not take decisions producing legal effects concerning you based solely on automated processing, including profiling.
7. Data from Google services
7.1. Connecting Google services — Google Calendar and Google Drive — is optional and is done by you manually in the Platform settings. Without such a connection we receive no data from your Google account.
7.2. When you connect, we request the following scopes and use them strictly for the purposes listed:
openid,email— to identify which Google account the connection belongs to and show it to you in the settings;https://www.googleapis.com/auth/calendar.events— to create, update, and cancel events in your Google Calendar that correspond to meetings you create in Branzy, and to show your availability when you pick a meeting time. We do not read or modify events unrelated to this synchronisation;https://www.googleapis.com/auth/drive.file— to upload a specific file to your Google Drive on your command in a chat and return a link to it in the conversation. This scope grants access only to files created or opened through Branzy and gives no access to the rest of your Drive.
7.3. Limited Use. Branzy’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7.4. We do not use data received from Google services for advertising, do not sell it, and do not share it with third parties except as necessary to operate the features described above, and we do not use it to train generative models, whether our own or third-party.
7.5. Access and refresh tokens are stored by us in encrypted form and are used only for calls to the corresponding Google API on your behalf.
7.6. You can disconnect the integration at any time in the Platform settings: we revoke the token on Google’s side and delete it on ours. You can also revoke access yourself at Google Account · Third-party apps.
8. Who we share data with
8.1. We do not sell personal data and do not share it with third parties for their own marketing purposes.
8.2. Data may be shared with the following categories of recipients:
- hosting and infrastructure provider — Hetzner Online GmbH (Germany; servers located in Helsinki, Finland);
- payment provider — JSC TBC Bank (Georgia);
- generative model provider — OpenAI, L.L.C. (used for chat and voice-message transcription features);
- email and push notification delivery services — the mailbox used to send you emails is hosted with our email provider (TimeWeb); push notifications are delivered via Firebase Cloud Messaging (Google) on Android and Apple Push Notification service (APNs) on iOS;
- Google Analytics — Google Ireland Limited and/or affiliated Google companies, if you consented to analytics cookies;
- Yandex Metrica — Yandex group companies, if you consented to analytics cookies;
- operators of the external communication channels you connected yourself.
8.3. Providers that process data on our behalf act under contracts and our instructions. The payment provider, Google Analytics, and the operators of connected external channels may act as independent controllers for certain operations and process data in accordance with their own policies and applicable law.
9. Transfers outside the country
9.1. Our providers may be located outside Georgia, including in the EU and the USA. In that case the transfer takes place on appropriate legal grounds and with appropriate safeguards.
10. How long we keep data
10.1. Account data and the content you create are kept while the account is active.
10.2. After an account is deleted, your profile data (name, email address, password, avatar, sign-in credentials) is erased immediately, except for information we are required by law to retain. Projects in which you were the only member are deleted within 90 days. Content in projects shared with other members remains available to them, and your name is shown as “deleted user”.
10.3. Accounting and tax records are kept for the period established by the legislation of Georgia.
10.4. Security logs are kept for 12 months.
11. Your rights
11.1. You have the right to:
- obtain confirmation of processing and a copy of your data;
- request rectification of inaccurate data;
- request erasure of data;
- request restriction of processing;
- receive your data in a machine-readable format and transmit it to another controller;
- object to processing based on legitimate interest;
- withdraw consent previously given;
- lodge a complaint with a supervisory authority.
11.2. To exercise any of these rights, write to info@branzy.app. We respond within the period established by applicable law. We may request additional information to verify your identity.
11.3. A complaint may be lodged with the competent data protection supervisory authority of Georgia (under the legislation in force — the State Audit Office of Georgia) and, where the GDPR applies to the processing, also with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.
12. Security
12.1. We apply technical and organisational safeguards: encryption of data in transit, access segregation, storage of passwords as irreversible hashes, access logging, and regular backups.
12.2. In the event of a personal data breach that creates a risk to your rights, we notify the supervisory authority and, where required, you.
13. Children
13.1. The Platform is not intended for persons under 16 years of age. We do not knowingly collect children’s data.
14. Cookies
14.1. The use of cookies is described in the Cookie policy.
15. Changes to this policy
15.1. We may amend this Policy. The current version is always available at https://branzy.app/en/legal/privacy.
15.2. We notify you of material changes by email or through the Platform interface at least 14 days before the changes take effect.