--- title: "Privacy Policy" version: 2026-10-16.1 effective: 2026-10-16 reviewed_by: null canonical: https://brdg2b.ai/legal/privacy --- # Privacy Policy > **Draft pending review by counsel — not yet in force.** Version 2026-10-16.1, effective 2026-10-16. Bridge to Brands is a product of RunOps Inc. ## In short - We collect your Google sign-in profile, how you use the service, your orders, and consumer details only on drop-ship orders. - Portal passwords are sealed: encrypted, never shown back, never readable by API keys or AI agents. - Consumer drop-ship details are purged 90 days after the order is finished, and are redacted from all logs. - We do not sell personal data. This website sets no tracking cookies. - You can access, correct, export or delete your data by writing to us. This policy explains how **RunOps Inc.** ("**RunOps**", "**we**") handles personal data in Bridge to Brands: the website brdg2b.ai, the app at app.brdg2b.ai, the REST API and the MCP server. Capitalised words have the meanings in the [Terms of Service](/legal/terms). ## 1. Who is responsible 1.1 For account, usage and website data, RunOps is the **controller**. Contact: [PRIVACY CONTACT EMAIL], RunOps Inc., [ADDRESS]. [DPO OR EU/UK REPRESENTATIVE, IF REQUIRED.] 1.2 For consumer data in drop-ship Orders, the Retailer is the controller and RunOps is its **processor** under the [Data Processing Addendum](/legal/dpa). Consumers should contact the Retailer first; we will help the Retailer respond. ## 2. What we collect | Category | What | Source | |---|---|---| | Identity | name, email address, profile picture and Google account id from Google sign-in | you, via Google | | Account | your Account, role, invitations, settings, Caps and acceptance of our legal documents (version, time, IP address, browser) | you | | Portal Credentials | dealer-portal usernames and passwords | you, in the app only | | Usage | API requests, MCP tool calls, searches, result counts, Orders, lines and units, per API Key; request ids; errors | generated by your use | | Orders | Brand, ship-to, PO, lines, prices, status and the Brand's order numbers | you and the Dealer Portals | | Consumer drop-ship data | consumer name, address and, where a Brand requires it, phone; the store's email | the Retailer | | Technical | IP address, user agent, timestamps, security events | your device | | Website | standard server logs (IP, user agent, page) on brdg2b.ai | your browser | ## 3. Why we use it (and legal bases) | Purpose | Data | Legal basis (GDPR / UK GDPR) | |---|---|---| | Provide the Service: sign-in, connecting portals, reading data, staging and submitting Orders | identity, account, credentials, orders, consumer data | contract; for consumer data, the Retailer's instructions | | Metering and the usage dashboard; billing once fees apply | usage | contract | | Security, fraud prevention, abuse detection, audit trail | technical, usage, account | legitimate interests | | Support and service messages | identity, account | contract; legitimate interests | | Records of acceptance of our Terms | account | legal obligation; legitimate interests | | Improving the Service, using aggregated or de-identified data | usage | legitimate interests | We do not sell or share personal data for cross-context behavioural advertising, and we do not use it to train AI models. ## 4. Cookies and local storage 4.1 **Website (brdg2b.ai):** no tracking or advertising cookies and no consent wall. Your light or dark theme choice may be kept in your browser's local storage. 4.2 **App (app.brdg2b.ai):** we store only the session token (in local storage) and your preferences. No third-party tracking. ## 5. How long we keep it | Data | Retention | |---|---| | Consumer drop-ship data | sealed on the Order and **purged 90 days** after the Order reaches a final state; never written to logs | | Portal Credentials | until you disconnect the Brand or close the Account, then deleted | | Session tokens | 24 hours | | Orders and usage records | for the life of the Account, then [RETENTION PERIOD] after closure, unless the law requires longer | | Acceptance and audit records | [RETENTION PERIOD, e.g. 7 years] for evidence of agreement | | Server and security logs (no consumer data) | [RETENTION PERIOD, e.g. 30–90 days] | | Backups | rolling, overwritten within [BACKUP WINDOW] | ## 6. Who we share it with 6.1 **Brands**: the Order data, and consumer data for drop-ships, go to the Brand's Dealer Portal you directed. Brands use it as independent controllers under their own policies. 6.2 **AI Agents you connect**: data you ask them to read is sent to them by you; their providers' policies apply. 6.3 **Subprocessors**: the providers on our [Subprocessors](/legal/subprocessors) page, under written contracts. 6.4 **Legal and corporate**: where required by law, to protect rights and safety, or to a successor in a merger or acquisition, with notice. ## 7. International transfers 7.1 We are based in the United States and process data there [AND IN THE REGIONS LISTED ON THE SUBPROCESSORS PAGE]. Transfers from the EEA, UK or Switzerland rely on [THE EU STANDARD CONTRACTUAL CLAUSES / UK ADDENDUM / DATA PRIVACY FRAMEWORK, TO BE CONFIRMED BY COUNSEL]. ## 8. Security 8.1 We encrypt data in transit, seal Portal Credentials and consumer data at rest, isolate every Account's data with row-level security, redact personal data from logs, and limit and audit staff access. See [Security](/security). ## 9. Your rights 9.1 Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. California residents have the rights to know, delete, correct and opt out of sale or sharing (we do not sell or share) and not to be discriminated against for using them. 9.2 Write to [PRIVACY CONTACT EMAIL]. We will verify your request and answer within the time the law requires (one month under GDPR, 45 days under CCPA). You may complain to your data-protection authority. ## 10. Children 10.1 The Service is for businesses and is not directed to children under 16. We do not knowingly collect their personal data. ## 11. Changes 11.1 We will post changes here with a new version and effective date and, for material changes, notify Account Owners in advance. ## Change log | Version | Effective | Change | |---|---|---| | 2026-10-16.1 | 2026-10-16 | First engineering draft, pending review by counsel. |