Skip to content

PRIVACY POLICY

Last Updated: 29 Jun 2026

Company information, standard definitions, regulatory compliance framework, and document integration: See Shared Legal Definitions and Legal Framework Integration

1. INTRODUCTION

1.1 Scope and Purpose

This Privacy Policy ("Policy") describes how Innovatica Technologies FZ-LLC collects, uses, processes, shares, retains, and protects personal data and non-personal information when you access or use our Brilio platform. This Policy has been designed to achieve global legal defensibility across all jurisdictions where we operate.

1.2 Service Coverage

This Policy applies to all users of the Brilio platform, including individuals who create an account, create or use AI agents, or otherwise interact with our Services. It covers information collected through: - The Brilio website (brilio.ai) - The Brilio platform and all associated services - Communications between you and Innovatica regarding the Service - Any mobile applications or API integrations we may offer - Third-party integrations and connected services

1.3 User Acknowledgment

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, subject to your rights under applicable law.

2. DATA CONTROLLER AND PROCESSOR ROLES

2.1 Data Controller Responsibilities

Innovatica Technologies FZ-LLC is the data controller for personal information processed in connection with our Services. For users who create and deploy AI agents on our platform, Innovatica acts as a data processor with respect to information processed by those agents on behalf of the agent creator, who acts as the data controller for such processing activities.

2.2 Contact Information

Data Controller Contact Information: - Company: Innovatica Technologies FZ-LLC - Address: VUNE0632, Compass Building - Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates - Email: legal@brilio.ai

Data Protection Officer: - Email: legal@brilio.ai - Responsible for: Privacy compliance, data subject requests, and regulatory correspondence

3. CATEGORIES OF DATA WE COLLECT

3.1 Account Information

  • Email address
  • Full name
  • Password (stored in hashed format)
  • Billing information and payment details (processed through our payment provider)
  • Account preferences and settings
  • Profile information you choose to provide

3.2 Usage Data

  • Log data (IP address, browser type, referring/exit pages, operating system)
  • Device information (device type, operating system, unique device identifiers)
  • Usage metrics (features used, interactions with agents, session duration)
  • Location data (region and country, derived from IP address)
  • Telemetry data for platform performance monitoring
  • Subscription information and credit usage
  • Cookie consent audit records (IP address and browser user-agent captured when you interact with our cookie consent banner — see §11.4)
  • Content provided to create and train agents
  • Names, descriptions, and configuration of agents
  • Knowledge bases and data sources connected to agents
  • Agent interactions and usage statistics
  • Content generated by agents

3.4 Communications Data

  • Customer support inquiries and related communications
  • Responses to surveys or feedback requests
  • Marketing preferences and interactions with marketing communications

3.5 Platform-Generated Data

  • Automatically generated IDs and technical identifiers
  • Timestamps and audit logs
  • Technical error reports and debugging information
  • Performance metrics and analytics

3.6 Shopify Integration Data

If you connect your Shopify store to Brilio via our Shopify App ("Brilio Concierge"), we process two distinct categories of data: data about your store, and data about the shoppers who use the chat on your storefront.

3.6.1 Store data (about you, the merchant)

We collect your Shopify store domain, Shopify store ID, store locale/timezone/currency, billing relationship identifiers, and a Shopify OAuth access token (stored in encrypted form). We use this data solely to provision and operate the Brilio Concierge integration with your store.

3.6.2 Shopper data (about visitors to your storefront)

When a visitor uses the chat on your storefront, the following is processed and stored by the Brilio platform:

  • The text of their messages, stored in order to generate a reply and to keep the conversation coherent across turns.
  • The text of the replies the assistant sends them.
  • Any personal data the visitor chooses to type into the chat. This matters and we state it plainly: the assistant will only look up an order after the shopper proves the order is theirs, which in practice means the shopper types their email address (and sometimes an order number or phone number) into the chat. That text is stored as written, both in the message itself and in the record of the order lookup the assistant performed.
  • An email address the visitor supplies when asking to speak to a person. If the assistant cannot help and the visitor asks for a human, they may leave an address so your store can reply. It is stored for that purpose.
  • Order information returned by Shopify for an order the visitor has identified — for example its status, fulfilment and tracking details — which appears in the reply shown to that visitor.
  • A technical fingerprint (a hash derived from IP address and browser user agent) used only for rate limiting, so that one visitor cannot exhaust your store's message allowance.

Conversations are anonymous by default: we do not ask a visitor who they are, and we do not link a conversation to a Shopify customer account. What makes the content personal data is what the visitor types.

3.6.3 Who can see shopper conversations

You can. The Brilio Concierge admin, inside your Shopify admin, shows you the conversations your assistant has had, including the full text of each exchange, and lets you search them. This is intentional — it is how you see what your customers are asking and where the assistant is failing them — but it means the messages a shopper types, including any personal data in them, are visible to you and to anyone you have given access to your Shopify admin.

For this data, you are the data controller and Brilio is your processor, as set out in §2 and in our Data Processing Agreement. You are responsible for telling your own customers, in your own privacy policy, that a chat assistant is available on your storefront and that its conversations are stored.

3.6.4 What we do not do with it

We do not use shopper conversations to train AI models. We do not sell it, and we do not share it except as described in §6 (Service Providers) and as required to operate the integration (Shopify's APIs, and the AI model provider that generates the reply).

3.6.5 Erasure

Shopify sends us three mandatory privacy webhooks and we act on two of them automatically:

  • customers/redact — when a shopper asks you to erase their data, we redact their email address and phone number from the stored messages of that store's conversations, including the record of any order lookup that contained them, and we clear any address they left when asking for a person.
  • shop/redact — sent by Shopify approximately 48 hours after the app is uninstalled. We erase the stored conversation content for that store and scrub the stored Shopify credential.
  • customers/data_request — a request to see stored data. Because you hold the customer relationship and can read the conversations directly in the Brilio Concierge admin, this request is fulfilled by you; we log the request and will assist on request at privacy@brilio.ai. See Responding to a customer data request.

3.7 Telegram Integration Data

If you connect a Brilio AI agent to Telegram Business, or if Telegram users interact with such an agent via your integration, the following data is processed and stored by the Brilio platform:

  • Business account owner: your Telegram user ID (owner_user_id) and your Telegram user chat ID (owner_user_chat_id), used to establish and maintain the Telegram Business connection.
  • End-users of the connected agent: when a Telegram user messages your AI agent, the following data is stored:
  • their Telegram chat ID (customer_chat_id), used for conversation routing;
  • their Telegram @username (if one is set on their Telegram account), stored in the conversation session context;
  • their display name (Telegram first name, or @username if no first name is available), stored as the conversation label;
  • the text of their message, stored to generate an AI response.

We use this data solely to route and respond to Telegram messages through the Brilio platform. We do not use it to train AI models, and we do not share it except as described in §6 (Service Providers) and as required to operate the integration (Telegram's Bot API).

4. HOW WE USE YOUR DATA

4.1 Service Provision

  • Creating and managing your account
  • Providing platform features and functionality
  • Processing payments and managing subscriptions
  • Delivering customer support

4.2 Platform Operation

  • Monitoring platform performance and security
  • Detecting and preventing fraud, abuse, and security threats
  • Troubleshooting technical issues
  • Maintaining data integrity and backup systems

4.3 Improvement and Development

  • Analyzing usage patterns to improve platform features
  • Developing new products and services
  • Conducting research and development
  • We do not use your personal content or agent conversations to train AI models; anonymous, aggregated usage data may be used to improve platform functionality
  • AI inference requests, including system prompts and knowledge base content, are processed by Microsoft Azure AI (Foundry) and are not used to train models. We contractually require our AI infrastructure sub-processors to provide equivalent no-training commitments.
  • Complying with legal obligations and regulatory requirements
  • Protecting our rights and interests
  • Responding to law enforcement requests
  • Enforcing our terms of service

4.5 Communication

  • Sending service-related communications
  • Providing customer support
  • Delivering marketing communications (with proper consent)
  • Notifying you of policy changes or security issues

5.1 Contractual Necessity

We process personal data as necessary to perform our contract with you, including account management, service delivery, and payment processing.

5.2 Legitimate Interests

We process data based on legitimate interests including platform security, fraud prevention, service improvement, and business operations.

We process data to comply with applicable laws, regulations, and legal proceedings.

For certain processing activities, we rely on your explicit consent, which you may withdraw at any time.

6. DATA SHARING AND DISCLOSURE

6.1 Service Providers

We share data with trusted third-party service providers who help us operate the platform, including: - Cloud hosting providers (Microsoft Azure) - Email delivery services (Azure Communication Services) - Payment processors (Stripe) - AI model providers (OpenAI, Anthropic) - Analytics and monitoring services - Customer support tools - Shopify (for Shopify App integration) - Telegram (for Telegram Business API integration — message routing and delivery)

6.2 Business Transfers

In connection with any merger, acquisition, or sale of assets, user data may be transferred as part of the transaction.

We may disclose data when required by law, regulation, legal process, or governmental request.

6.4 Protection of Rights

We may disclose data to protect our rights, property, safety, or that of our users or others.

We may share data for other purposes with your explicit consent.

7. DATA RETENTION AND DELETION

7.1 Retention Principles

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law.

7.2 Account Data Retention

  • Active accounts: Data retained while account is active
  • Deleted accounts: Data is deleted periodically following account closure; to request expedited deletion, contact legal@brilio.ai
  • Billing data: Retained for tax and regulatory compliance (typically 7 years)
  • Support communications: Retained for 3 years for service improvement

7.3 Usage and Analytics Data

  • Raw usage logs: 2 years
  • Aggregated analytics: 5 years (anonymized)
  • Security logs: 1 year (unless incident-related)

7.4 Storefront Conversation Data (Shopify Concierge)

  • Conversations and their messages: retained while the app is installed, so that you can review what your customers asked. Erased on shop/redact, which Shopify sends approximately 48 hours after uninstall.
  • Individual shopper data: redacted on receipt of customers/redact for that store, as described in §3.6.5.
  • To request erasure sooner, or erasure of a specific conversation, contact privacy@brilio.ai.

7.5 Agent and Content Data

  • Agent configurations: Retained until account deletion
  • User-uploaded content: Retained according to user preferences
  • AI-generated content: Subject to user control and deletion requests

7.6 User-Requested Deletion

Users may request data deletion through account settings or by contacting our Data Protection Officer. We will process deletion requests within 30 days, subject to legal retention requirements.

8. DATA SECURITY

8.1 Technical Safeguards

  • Encryption of data in transit (TLS 1.3) and at rest (AES-256)
  • Multi-factor authentication for administrative access
  • Regular security assessments and penetration testing
  • Automated threat detection and response systems

8.2 Organizational Measures

  • Employee training on data protection and privacy
  • Access controls and need-to-know principles
  • Regular security policy reviews and updates
  • Incident response and breach notification procedures

8.3 Third-Party Security

All service providers are required to maintain appropriate security measures and undergo regular security assessments.

8.4 Limitations

While we implement industry-standard security measures, no system is completely secure. We cannot guarantee absolute security of your data against all possible threats.

8.5 Data Breach Notification

8.5.1 Detection and Assessment We maintain continuous monitoring and detection systems to identify potential data breaches. Upon detecting a suspected breach, we immediately: - Contain the breach and secure affected systems - Assess the scope and severity of the breach - Determine what data was affected and how many users are impacted - Investigate the root cause and attack vector

8.5.2 Notification to Supervisory Authorities (GDPR Compliance) For breaches affecting EU residents' personal data, we will: - Notify the relevant supervisory authority (data protection authority) without undue delay and where feasible within 72 hours of becoming aware of the breach - Provide required information including: - Nature of the breach (categories and approximate number of affected individuals and records) - Name and contact details of our Data Protection Officer (legal@brilio.ai) - Likely consequences of the breach - Measures taken or proposed to address and mitigate the breach - Provide updates as more information becomes available

Supervisory Authority Contact: We will notify the supervisory authority in the EU Member State where the affected data subjects primarily reside, or the lead supervisory authority under GDPR Article 56 where applicable.

8.5.3 Notification to Affected Users We will notify affected users without undue delay when a breach is likely to result in a high risk to their rights and freedoms.

User Notification Timeline: - Without undue delay and where feasible within 72 hours of confirming the breach for high-risk incidents affecting personal data - Notification sent via email to the address on file - Additional notification methods (in-platform alerts, website banner) for severe breaches

User Notification Content: - Clear description of the breach in plain, non-technical language - Categories of personal data affected (e.g., names, emails, passwords, payment information) - Likely consequences of the breach for the individual - Measures we have taken to address the breach and prevent future incidents - Recommendations for users to protect themselves (e.g., change passwords, monitor accounts) - Contact information for questions and support (security@brilio.ai)

8.5.4 When User Notification May Be Delayed or Exempted We may delay or not provide user notification if: - Law enforcement request: Authorities request delay for investigation purposes (documented in writing) - Not high risk: Breach does not pose high risk to users' rights and freedoms (e.g., encrypted data with secure key management) - Protective measures: Technical protection measures (strong encryption) render data unintelligible to unauthorized parties - Disproportionate effort: Large-scale breach where individual notification is impossible (public communication substituted)

8.5.5 Breach Response Assistance Following a breach that affects your data, we will: - Provide dedicated support channel for affected users (security@brilio.ai) - Answer questions about the breach and its impact - Assist with account security measures (password reset, enable MFA, review access logs) - Provide updates as remediation progresses - Issue written incident report upon request (within 30 days of resolution)

8.5.6 Your Responsibilities After a Breach If you are notified of a breach affecting your data: - Change your password immediately on Brilio and any other services where you used the same password - Enable multi-factor authentication (MFA) if not already enabled - Monitor your accounts for suspicious activity (financial accounts, email, other services) - Review account activity logs in your Brilio account settings - Contact us if you notice unauthorized access or suspicious activity (security@brilio.ai) - Be vigilant for phishing - we will never ask for your password via email

8.5.7 Breach Records We maintain records of all data breaches including: - Facts of the breach (date, scope, affected data) - Effects and consequences - Remedial actions taken - Notifications provided (to authorities and users)

These records are available to supervisory authorities upon request and may be provided to you upon request under data subject rights.

8.5.8 Right to Lodge Complaint If you are unsatisfied with how we handled a data breach affecting your data, you have the right to lodge a complaint with your local data protection authority (supervisory authority in your EU Member State, or relevant authority in your jurisdiction).

9. INTERNATIONAL DATA TRANSFERS

9.1 Global Operations

Data may be transferred to and processed in countries where we or our service providers operate, including the United States, European Union, and Asia-Pacific regions.

9.2 Transfer Safeguards

For transfers outside your jurisdiction, we implement appropriate safeguards including: - Standard Contractual Clauses (SCCs) - Adequacy decisions by relevant authorities - Binding Corporate Rules where applicable - Additional security measures as required

9.3 Data Sovereignty Options

Enterprise customers may request data residency in specific regions subject to technical and commercial feasibility.

10. YOUR PRIVACY RIGHTS

10.1 Universal Rights

Regardless of location, you have the right to: - Access your personal data - Correct inaccurate information - Request data deletion (subject to legal requirements) - Object to certain processing activities - Withdraw consent where applicable

10.2 Enhanced Rights (GDPR, CCPA, and Similar Laws)

If you are in a jurisdiction with enhanced privacy laws, you may also have rights to: - Data portability - Restriction of processing - Automated decision-making opt-out - Detailed information about data processing

10.3 Exercising Your Rights

To exercise your privacy rights, contact us at legal@brilio.ai or use the privacy controls in your account settings. We will respond to requests within 30 days (or as required by applicable law).

11. COOKIES AND TRACKING TECHNOLOGIES

11.1 Types of Cookies

We use the following categories of cookies:

Essential Cookies (Always Active) - Required for basic platform functionality - Authentication and session management (login state, security tokens) - Security and fraud prevention (CSRF tokens, rate limiting) - Load balancing and performance optimization - These cookies cannot be disabled as they are necessary for the platform to function

Functional Cookies - Remember user preferences and settings (language, theme, dashboard layout) - Provide enhanced features and personalization - Support multi-language functionality - Store non-sensitive user interface preferences - Can be disabled through browser settings (may reduce functionality)

Analytics Cookies (Requires Consent) We use Google Analytics to understand how users interact with our platform and to improve our services.

Google Analytics Cookies: - _ga: Distinguishes unique users (expires after 2 years) - ga: Persists session state (expires after 2 years) - _gid: Distinguishes users (expires after 24 hours) - _gat: Used to throttle request rate (expires after 1 minute)

Data Collected by Google Analytics: - Pages visited and time spent on each page - Device type, browser, operating system, screen resolution - Geographic location (country, region, city - based on IP address) - Referral source (how you arrived at our website) - User interactions (clicks, scrolls, form interactions - no form data content) - Session duration and bounce rate

Google Analytics Configuration: - IP anonymization enabled (last octet of IP address removed before storage) - User ID tracking for logged-in users (allows cross-device behavior analysis) - No personally identifiable information (PII) is sent to Google Analytics - Data retention: 26 months (Google's default)

Your Google Analytics Choices: - Opt-out via cookie banner: Decline analytics cookies when prompted - Browser extension: Install Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout) - Browser settings: Block third-party cookies or all cookies - Platform settings: Adjust analytics preferences in your account settings

Google's Privacy Policy: https://policies.google.com/privacy

Marketing Cookies (Requires Consent) - Deliver relevant advertising (currently not used) - Measure marketing campaign effectiveness (currently not used) - Personalize marketing communications (email preferences) - Will only be deployed with explicit user consent

You can control cookies through: - Browser settings and preferences - Platform cookie consent tools - Third-party opt-out mechanisms

Disabling certain cookies may limit platform functionality and user experience.

When you interact with our cookie consent banner — including when you accept or decline cookies — we record your choices together with your IP address and browser user-agent string. This consent record is created at the time you interact with the banner, including for visitors who have not yet created an account. We collect this information to maintain an auditable record of consent as required for GDPR Article 30 (records of processing) and to demonstrate valid consent under GDPR Article 7. These consent audit records are retained in accordance with the retention period for raw usage logs described in §7.3.

12. CHILDREN'S PRIVACY

12.1 Age Restrictions

The Brilio platform is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18.

12.2 Parental Rights

If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

13. CHANGES TO THIS POLICY

13.1 Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

13.2 Notification of Changes

We will notify users of material changes through: - Email notifications to registered users - Prominent notices on our website - In-platform notifications

13.3 Continued Use

Continued use of the platform after policy changes constitutes acceptance of the updated policy.

14. CONTACT INFORMATION

For questions about this Privacy Policy or our privacy practices, contact us at:

Email: legal@brilio.ai
Data Protection Officer: legal@brilio.ai
Support & Billing: support@brilio.ai
Address: VUNE0632, Compass Building- Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

This Privacy Policy consolidates data protection terms from multiple documents to provide comprehensive coverage while maintaining regulatory compliance across all jurisdictions.