Legal
Privacy Policy
Version 0.1 · Effective
This policy explains what personal data Brocklore handles, why, and what you can do about it. It is written to be checked: every factual claim below describes something the product actually does today. Where something is not yet established, this policy says nothing rather than something optimistic.
Contact: [email protected]
1. Who we are
Brocklore is an AI-assisted customer-support platform. Organisations use it to run a support desk: tickets arrive, an AI investigation layer researches them against the organisation's own documentation and code, and the organisation's support agents answer.
This policy is published and maintained by the Brocklore Team. Questions, requests, and complaints go to [email protected], and we answer from there.
2. Two roles, two audiences
Almost every question about privacy here resolves once you know which of two relationships you are in, because our role - and therefore your route to exercising rights - is different in each.
| Brocklore as controller | Brocklore as processor | |
|---|---|---|
| Whose data | Visitors to our website, people who fill in our contact form, and the staff of organisations that use Brocklore (accounts, billing contacts), plus operational and security data about their use of the service | End-users - the people who raise support tickets with an organisation that uses Brocklore: ticket content, messages, attachments, and identities inside that organisation |
| Who decides how it is used | We do | The organisation running the support desk does. We act on its instructions |
| How to exercise your rights | Directly with us, at [email protected] | Through the organisation you contacted for support. We provide it the tools; it decides |
If you filled in a form on our website, or you work for a company that uses Brocklore, the first column applies to you. If you raised a support ticket with a company that happens to use Brocklore, the second column applies, and section 3 is written for you.
3. If you use a support portal operated by one of our customers
You did not choose Brocklore - your support provider did. We process your data on their instructions, and they decide what happens to it. Contact them first for any request about your data; they have controls to action it, and we support them in doing so.
One disclosure is ours to make directly:
Where your support provider uses Brocklore, we collect operational usage data - such as sign-in timestamps and which portal pages you visit - to keep the service reliable and secure, to prevent fraud and abuse, and to help your support provider understand overall engagement at a company level. This is recorded server-side; we do not use cookies, beacons, or tracking pixels for it. Raw activity records are deleted within 90 days; only company-level aggregates are retained, and no surface anywhere shows an individual's activity.
Company-level means exactly that: your support provider can see that your company has been quiet this month. Nothing in the product shows them, or us, a per-person activity timeline.
4. What we collect
Account data. Name, email address, and profile picture. If you sign in with Google or Microsoft, we receive your basic profile from that provider. Our sign-in methods are Google, Microsoft, a one-time link sent by email, and a one-time code sent by email - we do not store passwords, because we do not use them.
Organisation and billing data. Organisation profile, team membership, plan and subscription state. Payments are handled by Stripe; card details go directly to Stripe and we never receive them.
Support content (as processor). Tickets, messages, attachments, and the contact and company records the desk is organised around - names, email addresses, company names, and inbound-domain rules.
Operational and security data. The IP address and browser user-agent attached to a session, sign-in timestamps, portal page views (server-side, as described in section 3), and an append-only audit trail of sensitive actions taken in the product.
Website data. If you use our contact form we receive the name, email address, and message you send. The form is protected by Cloudflare Turnstile, a bot check. Our marketing site uses Cloudflare Web Analytics, which is cookieless and sets no identifier in your browser - which is why you have not been asked to accept cookies.
5. Why we use it, and on what legal basis
| Purpose | Basis |
|---|---|
| Providing the service to an organisation, and to its staff | Performance of a contract |
| Billing, invoicing, and plan management | Performance of a contract |
| Keeping the service secure and preventing fraud and abuse | Legitimate interests |
| Measuring engagement, surfaced only at company level | Legitimate interests |
| Understanding how our product and website are used, in aggregate | Legitimate interests |
| Responding to messages sent through our website contact form | Legitimate interests |
| Retaining tax and accounting records | Legal obligation |
Where we rely on legitimate interests, we have considered the impact on you. The engagement measurement in section 3 is the clearest example: it is deliberately built so no individual-level view exists anywhere in the product, which is what makes the interest proportionate.
6. AI processing
This is the part of the service most worth understanding, so it gets its own section.
When a ticket is investigated, context derived from that ticket is sent to large language models to research and draft an analysis. Those models are reached through OpenRouter, an inference gateway. The models currently serving our workloads are provided by DeepSeek (investigation orchestration, analysis, and knowledge consolidation) and Anthropic (the web-search step). Which model serves which role is configuration and can change; the current list is available on request.
Three controls apply, and we state them precisely because the differences matter:
- Inference routing is pinned. We restrict which hosts may serve our requests to a named allowlist rather than letting the gateway choose freely, disable fallback to unlisted hosts, instruct the gateway not to collect our request data, and require Zero Data Retention on inference routing - so the providers serving those requests do not store the material.
- Zero Data Retention does not extend to web search. Where an investigation searches the web, the query goes through OpenRouter's search plugin to Exa, and the retention guarantee above does not cover plugins. That leg is protected by redaction instead: every outbound search query is stripped of personal data before it leaves us, so what reaches the search provider is a technical query, never a requester's details.
- Embeddings are redacted before they are sent. Our memory layer converts text to numerical embeddings using Google's embedding API, reached directly rather than through OpenRouter. Both paths - storing a distilled memory, and matching an incoming ticket against it - strip personal data before the text leaves us.
A limitation we would rather state than omit: text already transmitted to these providers for an investigation is governed by their terms, not by our deletion jobs. A later erasure request removes the data from Brocklore; it cannot reach back into a completed inference call.
7. Who else receives data
We use service providers in these categories:
- Cloud infrastructure and data storage - Amazon Web Services
- Website hosting, DNS, and bot protection - Cloudflare
- Payments - Stripe
- LLM inference - OpenRouter, and the model providers named in section 6
- Embeddings - Google
- Web search - Exa
- Email delivery - Amazon SES for product email, Resend for our website contact form
We do not sell personal data, and we do not share it for advertising.
8. Other disclosures
Beyond the providers in section 7, there are two situations in which personal data could leave Brocklore. Neither is routine, and we would rather name them here than have you learn of them the first time one happens.
When the law compels it. We may disclose personal data where we are legally required to: a binding court order, a valid demand from a law-enforcement agency or regulator, or where disclosure is necessary to establish or defend a legal claim or to protect someone's safety. We assess whether a request is valid and disclose only what it actually covers. Where we act as processor - the second column of section 2 - and the request concerns an organisation's data, we will tell that organisation so it can respond itself, unless we are legally prohibited from telling it.
If the business changes hands. If Brocklore is acquired or merged, or its assets are sold, personal data may transfer to the acquirer as part of the business. It stays subject to this policy until a replacement policy is published, and we will tell customer organisations before that happens.
9. How we protect it
- Organisations are isolated from each other at the database layer. Every query runs under row-level security policies scoped to a single organisation - a second, independent wall behind the application's own permission checks.
- Data is encrypted in transit (TLS) and at rest, and credentials for connected services are additionally encrypted at the application layer.
- There are no passwords to steal. Our sign-in methods (section 4) mean we never store one.
- Card details never touch our systems - they go directly to Stripe.
- Sensitive actions leave a trail. They are recorded in the append-only audit log described in section 4, which is tamper-evident by construction.
If a breach affects your personal data, we will notify the affected organisations and, where the law requires it, individuals and regulators, without undue delay.
10. Where data is processed
Our own infrastructure runs in the United States, in a single AWS region (us-east-1). There is no
EU-hosted option today.
The inference providers described in section 6 are reached through a gateway and pinned to a named allowlist of hosts. We are documenting the specific processing locations of each of those hosts, and will state them here once established. We would rather leave this incomplete than describe a transfer arrangement we have not verified.
11. How long we keep it
We retain data for the life of the account and delete on an event, not on a timer. We do not apply age-based deletion windows to support content.
| Data | Retention |
|---|---|
| Tickets, messages, attachments, contact and company records | Life of the account |
| Staff and organisation account records | Life of the account |
| Derived knowledge (personal data stripped before it is created) | Life of the account |
| Raw engagement activity records | 90 days, then only company-level aggregates remain |
| Audit log | 2 years, then purged with a record of its disposal |
| Database backups | 7 days, disaster recovery only |
Deletion is triggered by a specific event: an erasure request, a customer being offboarded, or an account being closed. When an organisation closes its account, we generate a full export, hold the data read-only for a 30-day grace period during which the closure can be undone, and then purge it - object storage is torn down wholesale, and organisation-scoped records are deleted.
Where a record retains legitimate technical value, erasure works by anonymising in place: we strip the personal data and tombstone the identity rather than deleting the surrounding ticket. Attachments cannot be scrubbed in place, so they are purged outright.
A limitation, stated plainly: structured identifiers - email addresses, IP addresses, phone and card numbers - are removed reliably. Detection of names and places written into free-form prose is best-effort, and we do not represent scrubbed prose as guaranteed free of personal data. Records that have been through this process carry a visible marker in the product so nobody mistakes residual text for live data.
Our full retention and erasure policy, including the mechanisms behind each of the above, is available on request.
12. Your rights
You have the right to access your data, to receive a copy in a portable form, to have inaccurate data corrected, to have data erased, to object to processing based on legitimate interests, and to restrict processing. You also have the right to complain to your data protection supervisory authority.
If we are the controller - you use our website, or you are staff at a customer organisation - write to [email protected] and we will respond within one month. Organisation owners can also generate a complete machine-readable export of the organisation's data at account closure.
If we are the processor - you contacted a support desk that runs on Brocklore - your rights are exercised through that organisation, which has controls to erase an individual or an entire company record. If you are not sure who to contact, write to us and we will point you to the right place.
Before we act on a request, we check who is making it. A rights request is an obvious route to someone else's data, so we confirm it comes from the person it concerns before we action it, asking only for what we need to be sure. Where we are the processor, that check belongs to the organisation you contacted, not to us.
Every erasure we perform is recorded in a tamper-evident audit trail: who requested it, what was removed, and when.
13. Cookies
We use no tracking cookies, no advertising cookies, and no third-party analytics cookies. That is why this site has no cookie banner. The only cookies in play are:
| Cookie | Where | Purpose |
|---|---|---|
| Session cookie | Application | Keeps you signed in. Essential |
sidebar_state | Application | Remembers whether you collapsed the sidebar. Functional |
| Cloudflare Turnstile | Marketing site, contact form only | Bot protection. Essential to the form |
If we ever introduce a non-essential cookie or client-side tracking, this section changes first and the consent question is reopened.
14. Children
Brocklore is a business tool, sold to organisations and used by their staff and customers. It is not directed at children, and we do not knowingly collect data from them. If you believe a child has provided us personal data, contact us and we will remove it.
15. Automated decision-making
Our AI investigates tickets and proposes answers, root causes, and sometimes code changes. It does not decide anything about you. Every output is a suggestion to a human support agent, who decides what to do with it. We do not carry out automated decision-making that produces legal effects or similarly significant effects.
16. Changes to this policy
We will update this page when the product changes in a way that affects it, and record every change below. Material changes will be communicated to customer organisations directly rather than left for you to notice.
| Version | Date | Change |
|---|---|---|
| 0.1 | 2026-08-10 | Initial Privacy Policy. |
Last updated .