Privacy Policy

Brickwise AI Privacy Policy

1. Introduction and Scope

Brickwise Labs, Inc., a Delaware corporation (together with its UK affiliate Brickwise Labs Ltd, a company incorporated in England and Wales, trading as Brickwise AI) ("Brickwise," "we," "us," or "our"), respects your privacy and protects your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data across our websites, web applications (app.brickwiseai.com, eu.app.brickwiseai.com), documentation site (docs.brickwiseai.com), mobile inspection app, APIs, Model Context Protocol (MCP) server, and AI assistant ("Alice") (together, the "Services").

This policy applies to:

• Account Users ("Customers"): Property operators, landlords, letting and managing agents, HOA/WEG managers, and their staff holding accounts on the Services.
• Portfolio Contacts: Tenants, prospective tenants (leads), landlords, and contractors (vendors) whose contact and tenancy records are uploaded or synced by Customers, or who interact with Alice via phone, SMS, WhatsApp, or email.
• Website Visitors: Visitors to our websites, documentation pages, demo lines, and scheduling pages.

2. Data Controller and Data Processor Roles

• Data Controller: Brickwise Labs, Inc. (and, for UK and EEA users, Brickwise Labs Ltd) acts as the data controller for Account User profile details, organization billing records, website analytics, and demo or sales inquiries.
• Data Processor / Service Provider: For all portfolio records and Portfolio Contact data uploaded, synced, or generated on a Customer's behalf (including tenant records, leases, issues, call recordings, transcripts, inspections, and accounting data), the Customer is the data controller (or "Business") and Brickwise acts as the Service Provider (US CCPA/CPRA and state privacy laws) and data processor (UK/EU GDPR Art. 28). We process that data strictly under Customer instructions and our Data Processing Agreement (DPA).

3. Information We Collect

a. Account and Billing Data

• Profile Data: Name, work email, phone number, role (admin, property_manager, accountant, leasing_agent, field_operator, or managing_agent), working hours, calendar availability, and notification preferences.
• Billing & Demo Data: Company name, billing address, payment method details, subscription history (via Stripe), and demo or support requests.

b. Portfolio and Contact Data (Processed on Customer Instructions)

• Property and Unit Records: Addresses, unit details, lockbox/access notes, compliance certificates (Gas Safety, EICR, EPC, smoke/CO alarms, property licenses), and move-in/move-out inspection reports.
• Contact Records: Tenant, lead, landlord, and vendor names, emails, phone numbers, addresses, preferred languages, screening documents, lease terms, rent schedules, deposit details, and contractor trade rates.
• Financial Records: Rent payments, payment links, AutoPay schedules, supplier bills, account codes, landlord statements, WEG/utility settlements, and read-only bank transactions imported via Plaid or CSV.
• Communications: Inbound and outbound voice call recordings, transcripts, and summaries, plus SMS, WhatsApp, email, Slack, and Computer Mode messages and media attachments (photos, videos, PDFs, invoices).

c. Automatically Collected and Third-Party Data

• Logs and Diagnostics: IP address, browser/device metadata, API key usage (last_used_at), product analytics (PostHog, GA4, Microsoft Clarity), and error traces (Sentry) with automatic authentication token redaction.
• Connected Integrations: Data synced at Customer instruction from AppFolio, Rent Manager, Alto, Guesty, OwnerRez, Buildium, 10ninety, ShowMojo, Bayut, Xero, Stripe, Plaid, PandaDoc, Slack, Google/Outlook Calendar, Fillout, Calendly, and Google Maps/Places API.

4. How We Use Information and AI Governance

We process personal data to:

• Provide the Services: Authenticate users, enforce role permissions, sync connected property systems, and maintain audit logs.
• Run Property Operations: Enable Alice to verify callers, triage repairs, coordinate approved contractors within Customer spend limits, qualify leads, book viewings, chase compliance renewals, and send rent reminders on the Customer's behalf.
• Process Billing and Payments: Manage subscriptions, tenant rent collection, landlord payouts, and automated bank transaction matching.
• Maintain Security, Quality, and B2B Communications: Monitor uptime, verify webhook signatures, troubleshoot errors, comply with legal obligations, and send service updates.

AI Data Use and Transparency:

• Zero Model Training: Brickwise never uses Customer portfolio data, tenant or landlord personal data, uploaded documents, or call and message transcripts to train or fine-tune public or third-party foundation AI models.
• EU AI Act & Call Recording Transparency: The Services support configurable AI disclosure greetings (EU AI Act Art. 50) and call-recording consent notices (UK/EU GDPR and US all-party consent states). We never use uploaded tenant, landlord, or contractor contacts for Brickwise's own marketing.

5. SMS, WhatsApp, and Voice Communications Policy

• Purpose: We use SMS, WhatsApp, and voice calls to provide 24/7 tenant support, maintenance coordination, viewing confirmations, compliance reminders, and rent updates on our Customers' behalf.
• Consent: Recurring operational messages are sent only where recipients have provided consent to the property operator, initiated contact with the support line, or opted in during onboarding or inquiry submission.
• Opt-Out and Help: Reply STOP to any SMS to unsubscribe from recurring messages (you will receive one confirmation text). Reply HELP for assistance.
• Cost and Frequency: Message frequency varies by tenancy activity and open issues (typically 2 to 5 messages per month for recurring alerts). Standard message and data rates may apply.
• Strict Non-Sharing (TCPA & 10DLC): We do not sell, rent, loan, trade, or share mobile phone numbers, SMS opt-in consent data, or messaging metadata with third parties or affiliates for their own marketing or promotional purposes.

6. Legal Bases (UK/EU GDPR) and US State Privacy Rights

• UK & EU GDPR Lawful Bases: As a controller, we rely on Contract, Legitimate Interests (security, fraud prevention, product reliability, B2B outreach), Consent (optional cookies and marketing), and Legal Obligation. As a processor, we act under the Customer's lawful instructions.
• US State Privacy (CCPA / CPRA & State Equivalents): Brickwise does not "sell" or "share" personal information for cross-context behavioral advertising, and processes portfolio contact data strictly as a Service Provider.

7. Sub-Processors and International Transfers

We share data only with authorized sub-processors, Customer-enabled integrations, counterparties in a property workflow, or legal authorities where required by law:

• Supabase (PostgreSQL database, authentication, and encrypted file storage - US or EU by Customer region).
• Vercel & Google Cloud Platform (hosting, Cloud Run compute, Cloud KMS encryption, Gemini AI inference, Google Maps/Places - US / EU).
• ElevenLabs (voice AI synthesis and orchestration - US / EU).
• Twilio & Meta Platforms (voice telephony, SMS delivery, and WhatsApp Business routing - US / EU).
• Resend (transactional and operational email delivery - US / EU).
• Stripe & Plaid (billing, rent payments/payouts, and read-only open banking feeds - US / UK / EU).
• PandaDoc, Fillout & Calendly (e-signatures, intake forms, and scheduling - US / EU).
• PostHog, Sentry, BetterStack, GA4 & Microsoft Clarity (diagnostics, EU error monitoring de.sentry.io, uptime alerting, and web analytics - US / EU).

Brickwise hosts dedicated regional environments in the US (app.brickwiseai.com) and EU (eu.app.brickwiseai.com). International transfers from the UK, EEA, or Switzerland rely on EU Standard Contractual Clauses (SCCs), the UK IDTA, and the EU-US Data Privacy Framework (with the UK Extension).

8. Data Retention, Security, and Your Rights

• Retention: Account and portfolio data are retained while the Customer's organization is active (and up to 90 days post-termination for export, unless longer tax retention applies). Disconnecting an integration clears its encrypted credentials immediately. Error logs are retained up to 90 days.
• Security: We enforce TLS 1.2/1.3 in transit, AES-256 at rest, AES-256-GCM for integration tokens, PBKDF2-HMAC-SHA256 (100,000 iterations) for API keys, and PostgreSQL Row-Level Security (RLS). See our Security and Data Protocol.
• Your Rights (UK, EU & US): You may request access, correction, deletion, restriction, portability, or consent withdrawal by emailing privacy@brickwiseai.com, or lodge a complaint with the UK ICO (ico.org.uk), your EU supervisory authority, or your US state Attorney General. Tenants, landlords, and contractors should contact their property manager (the Data Controller) first; we assist Customers in fulfilling all verified requests.
• Children's Privacy & Updates: Our Services are not directed to individuals under 18. Material updates will be notified by email or in-app notice.