Privacy Policy

This Privacy Policy explains how Inceptly LLC, doing business as Bratrax ("Bratrax," "we," "us," or "our"), collects, uses, discloses, and protects information when you visit bratrax.com (the "Site") or use the Bratrax attribution analytics service (the "Service").

If you do not agree with this Privacy Policy, please do not use the Site or the Service.

1. Who This Policy Applies To

This Privacy Policy applies to:

• Visitors to bratrax.com and related subdomains.
• Customers who sign up for a Bratrax subscription (Lite or Clear Vision).
• Authorized users of a customer account.
• Prospects who provide contact information through forms on the Site.

It does not apply to third-party websites or services you reach through links from the Site, or to data processed by LLM providers you connect to Bratrax through the Model Context Protocol.

2. Information We Collect

2.1 Information you provide to us

• Account information: name, email address, password (hashed), company name, and role.
• Billing information: Bratrax does not store payment card details. All billing is handled by our payment processor, Lemon Squeezy. We receive limited billing metadata from Lemon Squeezy (e.g., plan, status, country of billing) but not your full card number.
• Communications: messages you send us via support email, contact forms, or other channels.

2.2 Information we collect from connected platforms

When you connect a third-party platform to Bratrax through OAuth, we collect the data required to deliver the Service. Supported platforms at launch include:

• Shopify: store metadata, orders, customers, products, and revenue data.
• Meta (Facebook and Instagram Ads): ad account information, campaign structure, spend, impressions, clicks, and conversion events.
• Google Ads: account information, campaign structure, spend, impressions, clicks, and conversion events.
• WooCommerce: store metadata, orders, customers, products, and revenue data.
• Other advertising and marketing platforms: TikTok Ads, Microsoft Bing Ads, Pinterest, Taboola, Outbrain, and Klaviyo — each providing account information, campaign or campaign-equivalent structure, spend, and engagement or conversion events.
• Additional platforms may be supported in the future.

We store OAuth tokens with access restricted to the systems that require them, and use them only to access the data you have authorized. You can revoke access at any time from the source platform.

2.3 Information we collect from Slack

If you connect the Bratrax assistant to your Slack workspace, we collect and store the following:

• Workspace and installation details: your Slack workspace and enterprise identifiers, the workspace name, the credentials and permissions Slack issues to us for that installation, and the identity of the Bratrax user who installed the app.
• Channel links: where a specific channel is linked to a Bratrax account, the channel identifier and name, together with the short-lived code used to establish that link.

We do not store the content of your Slack messages. When you mention the assistant or send it a direct message, we read that message and, for follow-up questions, the recent messages in that conversation thread, in order to answer. That content is processed in memory to generate the reply and is not written to our database. Message content is sent to Anthropic to produce the answer, as described in Section 4.2.

The assistant only reads conversations it participates in — channels it has been invited to and direct messages sent to it. It cannot read channels it is not a member of. It responds only when mentioned or messaged directly; it does not post on its own initiative.

In the shared Bratrax community workspace, we read the email address associated with your Slack account in order to match you to your Bratrax account so the assistant answers with the right store's data.

You can disconnect at any time from Settings → Slack in Bratrax, or by removing the app from your Slack workspace. Either action revokes the bot token with Slack and deletes the stored installation record and any associated channel links.

2.4 Information collected automatically

• Usage data: pages you view on the Site, features you use in the Service, timestamps, and actions taken. We use this to operate, secure, and improve the Service.
• Device and connection data: IP address, browser type and version, operating system, referring URL, and similar technical data.
• Storefront integration data: If you are visiting a site that has installed the Bratrax storefront integration (sometimes called the Bratrax pixel), including bratrax.com itself, the integration may record visit metadata such as page URL, referrer, UTM parameters, and a session identifier. It may set one or more first-party cookies for session stitching and attribution purposes. Merchants install, configure, and can remove the integration themselves, and are responsible for any consent required on their own web properties.
• Third-party analytics data: We use Google Analytics 4 across bratrax.com and the Service, including the authenticated dashboard, to measure how visitors and customers find and move through our site and product. Google Analytics sets its own cookies and receives page URLs, referrer, UTM parameters, approximate location derived from IP address, device and browser type, and interactions with our calls to action such as newsletter signups and sign-up clicks. It does not receive Customer Data pulled from your Connected Platforms.

2.5 Information we do not collect

Bratrax is not designed to process sensitive personal information. We do not collect or use "sensitive personal information" as defined by the California Privacy Rights Act (CPRA) or equivalent state privacy laws. We do not knowingly collect health information subject to HIPAA, government identifiers (Social Security numbers, passport numbers), or information about children. Please do not deliberately upload or connect data sources containing these categories. Where data of these kinds arrives incidentally — through an ordinary synchronisation from a connected platform, or a free-text field completed by someone else — rather than through a deliberate act of yours, you are not in breach by reason of that arrival alone. Tell us and we will help remove it. Section 3.3 of our Data Processing Agreement sets out how this is handled.

Location data. The location-related data we hold is limited to postal address received with orders from a connected platform and the approximate location that can be derived from an IP address, both described in Section 2 above. We do not collect precise, device-based geolocation of the kind treated as sensitive personal information under the CPRA, and our storefront integrations do not request location from a visitor's browser or use the browser Geolocation API.

3. How We Use Information

We use information for the following purposes:

1. Deliver the Service. Authenticate you, connect your data sources, build your dashboards, run attribution models, and respond to your queries.
2. Operate our business. Bill you using your account and billing details, provide customer support, send Service-related notices, and enforce our Terms of Service. We do not use the store or advertising data you connect for billing or marketing purposes.
3. Improve the Service. Analyze usage patterns and aggregated, de-identified data to refine attribution models, build new features, and fix defects.
4. Describing what we observe. We may describe patterns, trends, and observations drawn from operating the Service — in our marketing, product communications, and educational content. We do not identify any customer, do not attribute observations to any customer, and do not disclose any individual customer's own metrics. Any figure we cite is drawn from a population large enough that no single customer's contribution can be inferred from it. We do not publish industry benchmarks.
5. Generate AI responses. Where you use an AI feature we operate, process your question and the data needed to answer it in order to generate a response. See Section 4.2.
6. Security, fraud prevention, and legal compliance. Detect abuse, enforce our terms, comply with applicable law, and respond to lawful requests from authorities.

3.1 Legal bases (EU/UK customers)

For customers and users in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

• Performance of a contract: to deliver the Service you have signed up for.
• Legitimate interests: to secure and improve the Service, describe patterns and trends we observe, market our product, and defend our legal interests. We balance these interests against your rights and will not rely on legitimate interests where your interests override ours.
• Consent: where required by applicable law (for example, for non-essential cookies). You may withdraw consent at any time without affecting processing that occurred before withdrawal.
• Legal obligation: to comply with laws and lawful orders.

3.2 Aggregated and De-Identified Data

We create aggregated and de-identified data from the information described in this Policy. We take reasonable measures to ensure that this data cannot reasonably be used to infer information about, or otherwise be linked to, any individual consumer, household, or device.

We publicly commit to maintain and use this data only in aggregated and de-identified form. We will not attempt to re-identify it, except solely to determine whether our de-identification processes are effective, and we contractually require any recipient of such data to comply with the same restrictions.

We use aggregated and de-identified data only to operate, secure, improve, and develop the Service.

4. How We Share Information

We share information only as described below.

4.1 Subprocessors

We use a small number of third-party vendors ("subprocessors") to help us operate the Service. Each is bound by written contractual obligations to protect your data.

The authoritative, current list is published at bratrax.com/subprocessors, which forms Annex III of our Data Processing Agreement.

We give customers at least 30 days' notice before a new subprocessor begins processing Customer Data, with a right to object on reasonable data protection grounds. See Section 5 of our Data Processing Agreement.

4.2 AI providers

There are two distinct ways your data can reach an AI provider, and they carry different responsibilities.

AI features we operate. Some Bratrax features generate answers using a large language model — today, the Bratrax assistant for Slack. When you ask it a question, your message, the recent context of that conversation thread, and the store data needed to answer are sent to Anthropic (Claude) to produce the response. Anthropic is a named subprocessor in Section 4.1 and processes this data on our instructions. These features are optional: they process data only when you use them, and only for the account they are connected to.

Enterprise customers may supply their own Anthropic API key, in which case that traffic runs under your own contract with Anthropic rather than ours.

AI providers you connect yourself. If you connect an AI provider to Bratrax through the Model Context Protocol (MCP) — for example, Anthropic's Claude or OpenAI's ChatGPT — any data you query flows directly from Bratrax to that provider under your contract with that provider. Bratrax is not a subprocessor in that data flow. The provider's own privacy terms govern what they do with the data, and we are not responsible for their data practices.

4.3 Other disclosures

We may also share information:

• With your consent or at your direction.
• With your authorized users within your customer account.
• With professional advisors (auditors, lawyers, accountants) under duties of confidentiality.
• In connection with a business transfer (merger, acquisition, asset sale). We will notify you before your information becomes subject to a different privacy policy.
• To comply with law or respond to lawful requests from public authorities, including to meet national security or law enforcement requirements.
• To protect our rights, property, or safety, or those of our customers or the public.

4.4 What we do not do

Access to personal information is not part of the consideration exchanged under our agreements with our business customers. We receive personal information solely to provide the services those customers have purchased.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We do not commingle one customer's data with another's — each customer's data is logically isolated in its own storage. Our use of Google Analytics is limited to audience and product-usage measurement; data collected is not used for cross-context behavioral advertising.

5. Data Storage and International Transfers

Customer Data is hosted on servers in the European Union (Finland).

Two things involve moving Customer Data, or access to it, outside the European Economic Area:

• Backups are held in cloud storage in the United States, provided by Google Cloud.
• Our team works remotely, and some of our personnel and contractors are located outside the EEA. Their access to Customer Data is itself a transfer of personal data. The countries we access it from are listed in Section 10.1 of our Data Processing Agreement.

Not all of those destinations are covered by an adequacy decision of the European Commission. Where a destination does not provide an equivalent level of protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, supplemented by technical and organizational measures where required. A copy of the safeguards we rely on is available on request to legal@bratrax.com.

We maintain a documented assessment of these transfers, covering the laws and practices of each destination country that are relevant to access by public authorities, and the measures we apply to supplement the Standard Contractual Clauses. Business customers may request a copy at legal@bratrax.com.

Where you use an AI feature we operate, or connect the Bratrax assistant to Slack, the data needed to answer a given question is transmitted to service providers in the United States (see Section 4.1) under the safeguards described above. This is transmission for processing, not storage: those providers are not where your Customer Data is hosted.

Site visit data collected through Google Analytics is processed by Google in the United States under the EU–U.S. Data Privacy Framework and, where applicable, the Standard Contractual Clauses described above.

6. How Long We Keep Your Information

• Active customer data: for as long as your subscription is active.
• After cancellation or termination: we retain customer data for up to 180 days, structured as (i) a 30-day self-serve export window during which you retain access to your dashboards and to direct queryable access to your data, followed by (ii) up to 150 additional days of cold retention, during which your data is not accessible to you but can be restored on written request. After 180 days, we permanently delete customer data.
• Billing records: retained as required by applicable tax and accounting law.
• Marketing and prospect data: retained until you unsubscribe or request deletion.
• Website analytics: Google Analytics data is retained for the period configured on our Google Analytics property (currently 14 months), after which Google deletes event-level data.
• Slack connection data: workspace installation records and channel links are retained while the connection is active and deleted when you disconnect the app or remove it from your Slack workspace. We do not retain Slack message content.
• Backups: backups are taken on a rolling schedule. The longest-retained copy is held for up to 90 days, after which it is overwritten.

If you request deletion under applicable privacy law (see Section 10), we will honor the request within 30 days, subject to narrow exceptions where we are legally required to retain certain records. Copies held in backups are not deleted individually; they are removed as those backups age out, which means a copy may persist in backup for up to 90 days after deletion from our live systems. Backups are encrypted and are not used for any purpose other than restoring the Service.

7. How We Protect Your Information

We use technical and organizational measures designed to protect your data, including:

• Encryption of data in transit, including between our own internal systems.
• Encrypted backups.
• Passwords are stored using one-way hashing and are never stored in plain text.
• Access controls and least-privilege permissions for Bratrax personnel.
• Per-customer data isolation — we maintain logical and access-control separation between customers' data and do not commingle one customer's data with another's.
• Regular review of security practices and subprocessors.

A fuller description of our technical and organizational measures, including those we have not yet implemented, is set out in our Data Processing Agreement and is available to customers and their security teams on request to legal@bratrax.com.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify affected customers without undue delay and consistent with applicable law.

8. Cookies and Similar Technologies

Bratrax uses its own first-party storefront integration on bratrax.com to measure site engagement. It may set one or more first-party cookies for session stitching and attribution purposes.

We also use Google Analytics 4 across bratrax.com and the Service, including the authenticated dashboard, to understand how visitors and customers find and navigate our site and product. Google Analytics sets its own cookies and receives site and product usage metadata such as page URL, referrer, approximate location derived from IP address, device and browser type, and interactions with our calls to action. It does not receive Customer Data pulled from your Connected Platforms. Google processes this information as described in Google's Privacy Policy. You can opt out across all sites using Google's browser add-on.

We use Google Analytics for audience and product-usage measurement only. We do not use it to build advertising audiences or to serve you ads.

We may also use cookies or similar technologies for authentication, security, and essential site functionality.

Where required by applicable law, we will obtain consent before setting non-essential cookies through a cookie consent banner.

You can control cookies through your browser settings. If you disable cookies, some parts of the Site or Service may not function properly.

We do not respond to Do Not Track signals at this time because no consistent industry standard has been adopted.

9. Communications and Marketing

• Service communications. We send transactional emails (billing, security, account notices). You cannot opt out of these while you have an active account.
• Marketing communications. When you create an account, we automatically add the email address associated with your account to The Dashboard, the Bratrax newsletter, and other marketing email lists, and we may send you product updates, newsletters, or promotional emails. You can unsubscribe from any marketing email at any time using the unsubscribe link in the email, or by emailing support@bratrax.com.

10. Your Privacy Rights

Subject to applicable law, you have the following rights with respect to your personal information:

• Access: to know what personal information we hold about you.
• Correction: to correct inaccurate or incomplete information.
• Deletion: to request deletion of your personal information.
• Portability: to receive your data in a portable, machine-readable format.
• Objection and restriction: to object to or restrict certain processing.
• Withdrawal of consent: where we rely on consent, you may withdraw it at any time.
• Non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email legal@bratrax.com. We may need to verify your identity before acting on your request.

Response timelines:

• Under the GDPR and UK GDPR, we will respond within one month of receiving your request. Where a request is complex or where we have received a number of requests, we may extend that period by up to two further months, and will tell you within the first month if we do.
• Under the CCPA, CPRA, and similar U.S. state privacy laws, we will acknowledge your request within 10 business days and provide a substantive response within 45 calendar days, extendable by an additional 45 days with notice to you.

If you are unhappy with our response, you have the right to lodge a complaint with a data protection authority in your jurisdiction.

11. Our Role: Controller and Processor

For information we collect about visitors, prospects, and account administrators (for example, names and email addresses of people who sign up for Bratrax), we act as a controller.

For data you connect to Bratrax from your store, ad platforms, or other third-party sources, we act as a processor on your behalf. You are the controller of that data. That processing is governed by our Data Processing Agreement, which is incorporated into our Terms of Service and takes effect automatically — no signature or request is required. It incorporates the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and Swiss amendments. An executed copy of the Standard Contractual Clauses is available on request to legal@bratrax.com.

12. Notice to California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):

• The right to know what personal information we have collected, the sources, purposes, and categories of third parties with whom it is shared.
• The right to request deletion of personal information.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information (for cross-context behavioral advertising).
• The right to limit the use of sensitive personal information.
• The right not to be discriminated against for exercising these rights.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months and have no plans to do so.

To exercise your California rights, email legal@bratrax.com. You may designate an authorized agent to act on your behalf.

13. Notice to Residents of Other U.S. States

Residents of states including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana have rights under their respective state privacy laws similar to those described in Section 12. To exercise those rights, email legal@bratrax.com. We do not engage in "targeted advertising," "sale" of personal information, or "profiling" that produces legally significant effects, as those terms are defined under applicable state law.

Right to appeal. If we deny your request in whole or in part, you have the right to appeal our decision by emailing legal@bratrax.com with the subject line "Privacy Request Appeal." We will respond to your appeal within 60 days. If we deny your appeal, we will inform you of your right to contact your state attorney general.

14. Notice to Residents of the European Economic Area, United Kingdom, and Switzerland

In addition to the rights described in Section 10, you have the right to lodge a complaint with your local data protection authority.

The controller of your personal information is Inceptly LLC, 131 Morninghill Drive, Columbia, SC 29210, USA, trading as Bratrax. You can contact our privacy team directly at legal@bratrax.com.

Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• United Kingdom (UK)
• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/14060742704

Our EU representative is established in Ireland. Contacting our representative does not affect your right to contact us directly at legal@bratrax.com, or to lodge a complaint with your supervisory authority.

Residents of Switzerland may contact us directly at legal@bratrax.com. We have not appointed a representative in Switzerland.

15. Children's Privacy

Bratrax is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact legal@bratrax.com and we will delete it.

16. Links to External Sites

The Site and Service may contain links to third-party websites and services that are not operated by us. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by prominent notice in the Service before the changes take effect. The "Effective date" at the top of this policy indicates when it was last revised. Your continued use of the Service after an update means you accept the updated policy.

18. Contact Us

Questions about this Privacy Policy or our data practices:

Email: legal@bratrax.com
Mail: Inceptly LLC, 131 Morninghill Drive, Columbia, SC 29210, USA

EU and UK residents may also reach us through our appointed representative, Prighter — see Section 14.