Legal

Privacy Policy

Version 1.0 · Effective August 4, 2026

The short version

This is a plain-language summary for the people who go through a Product Experience. It answers the questions that matter most before you begin. The full policy below is the complete statement and governs in the event of any conflict.

  • What you say in a session is private to you. Your employer never receives your session content or your individual report, even when they paid.
  • We never use your session to train AI models.
  • Your session is processed by AI to create your report. We currently use OpenAI for this.
  • We share broad patterns, never you. Group and public insights have names removed and nothing attributed to you by name. In a small team, people who know the group may still infer a source, so we only share externally when the group is large enough that no one can be singled out.
  • You control your data. You can ask to see it, correct it, or delete it at any time.
  • You can opt out of our emails whenever you want.

Questions or requests: privacy@brilliantwith.ai.

1. Who we are

Brilliant with AI Inc. ("Brilliant with AI," "we," "us," "our") is a corporation incorporated in Ontario, Canada. We operate the Brilliant with AI platform (the "Platform") and the Product Experiences delivered through it.

For the purposes of applicable privacy law, we are the controller of the personal information described in this policy, except where we act as a processor on behalf of an Organization (see Section 12).

Privacy Officer
Nish Patel
Brilliant with AI Inc.
116 Coolspring Crescent
Ottawa, Ontario, K2E 7M8, Canada
privacy@brilliantwith.ai

This policy uses several terms defined in our Terms of Service, including Platform, Product Experience, Session Content, Output, Participant, Organization, Group Reporting, and Anonymized Data.

2. The laws this policy is built around

Our participants are in different places, so more than one privacy law can apply:

  • PIPEDA (Canada's federal private-sector privacy law).
  • Quebec's Law 25, which applies to the personal information of individuals in Quebec.
  • The GDPR (European Union) and UK GDPR, which apply to participants in the EU and UK.
  • CASL (Canada's anti-spam legislation), which governs our commercial email.

Where a specific right or rule applies only to people in a particular place, we say so.

3. What we collect

Information you give us

  • Account information: your name and email address, and the record of your agreement to our Terms and this policy.
  • Session Content: everything you contribute during a Product Experience, including your responses and the record of your conversation with the Platform.
  • Communications: messages you send us, such as support requests.

Information created when you use the Platform

  • Outputs: the reports and other materials the Platform generates for you from your Session Content.
  • Usage and device information: basic technical information such as IP address, browser and device type, and how you interact with the Platform, collected through logs and analytics (see Section 13).

Information from others

  • Payment information: when you purchase, our payment processor collects and processes your card details. We do not receive or store your full card number. We receive confirmation of payment and limited details such as the last four digits and billing country.
  • Organization-provided information: where an Organization enrolls you, it may give us your name and email to provision your access.

Personal reflections. Product Experiences are reflective conversations about your work and leadership, and can be candid. We treat what you share as confidential and use it only as described in this policy. Section 7 has more.

4. Why we use your information, and our legal basis

We use personal information to:

  • Deliver the Product Experience you purchased or were enrolled in, including generating your Output.
  • Maintain continuity across your sessions where that feature applies, so later sessions can build on earlier ones.
  • Provide support, security, and troubleshooting.
  • Process payments and keep required financial records.
  • Improve and develop the Platform and our Product Experiences.
  • Produce Group Reporting for an Organization about its own group (see Section 12).
  • Produce Anonymized Data and synthesized patterns (see Section 8).
  • Send you service messages and, where permitted, marketing (see Section 14).
  • Meet legal and regulatory obligations.

For participants in the EU and UK, our legal bases under the GDPR are:

  • Performance of a contract with you, to deliver the Product Experience and support it.
  • Consent, for marketing where required and for non-essential cookies. You may withdraw consent at any time.
  • Legitimate interests, to secure and improve the Platform and to understand how it is used, balanced against your rights.
  • Legal obligation, to keep records the law requires.

5. AI processing and model training

Your Session Content is processed by third-party AI models to deliver the Product Experience and generate your Output. We currently use OpenAI, accessed through our Vercel AI Gateway. Our Platform and data are hosted on Google Cloud.

We do not use your Session Content to train AI models, and we do not permit our providers to train their models on it. OpenAI's published API terms state that data submitted through their API is not used to train their models, and we rely on those terms. We are pursuing a data addendum with OpenAI to put that commitment on a contractual footing.

AI outputs are probabilistic and may be inaccurate or incomplete. Our Terms of Service explain the limits of what an Output is.

6. Who we share it with

We do not sell your personal information. We share it only as follows:

  • Sub-processors who help us run the Platform and deliver Product Experiences, under confidentiality and data-protection obligations, and only for the purposes we set. Our current sub-processors include OpenAI (AI processing), Vercel (application delivery and AI gateway), Google Cloud (hosting and storage), Stytch (authentication), and Stripe (payment processing), together with the development tools our team uses to prepare Organization deliverables. We keep this list current and will provide the up-to-date version on request.
  • An Organization, where you took part through one, limited to Group Reporting as described in Section 12. Never your Session Content or your individual Output.
  • Professional advisors and authorities, where we are legally required to disclose, or to establish or defend legal claims. Where we are compelled to disclose your information, we will notify you unless the law prevents us.
  • A successor, if we are involved in a merger, acquisition, or sale of assets, subject to this policy.

7. Your Session Content is personal to you

Session Content is often candid and personal. We treat it as confidential and use it only as described in this policy: to deliver your Product Experience, to support and improve it, and to produce the synthesis described in Section 8. We do not ask you for special or sensitive categories of information, and we do not use your Session Content for any purpose beyond those described here.

8. Anonymized synthesis

We synthesize patterns from Session Content and Outputs across Participants. This is central to how our Product Experiences work and improve.

We remove direct identifiers and never attribute what you said to you by name. Where we combine information across a large enough number of Participants that it forms aggregate patterns which cannot reasonably be traced to any individual, that aggregate is Anonymized Data. Anonymized Data is no longer personal information, is not subject to the rights in Section 11, and is not affected by your deletion, because it can no longer be connected to you.

Group Reporting for an Organization has names removed and nothing attributed by name, but in a small group a person who knows the team may still be able to infer a source. Section 12 of our Terms of Service explains this in full.

9. International transfers

We are based in Canada, and some of our sub-processors are in the United States and elsewhere. Delivering a Product Experience involves transferring your information across borders, including to the United States.

  • For EU and UK participants, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses and the UK addendum, or a provider's certification under an approved framework, to protect your information when it leaves the EU or UK.
  • For Quebec participants, before transferring personal information outside Quebec we assess the protection it will receive, as Law 25 requires.

You can contact us at privacy@brilliantwith.ai for more detail on the safeguards that apply.

10. How long we keep it

  • Session Content and Outputs: for as long as your account is active, so that Product Experiences can build on each other over time, until you ask us to delete them.
  • Account information: for as long as your account is active, and for a reasonable period afterward.
  • Payment and transaction records: for as long as tax, accounting, and legal rules require.
  • Anonymized Data: indefinitely, because it is no longer personal information.

When you ask us to delete your content, we remove it from the Platform. Residual copies may persist for a limited time in routine encrypted backups, which are overwritten on their normal cycle, and in any work product already derived before your request. We remove your content from our active systems; we do not represent that deletion is instantaneous or that we can reach every copy everywhere.

11. Your rights

Depending on where you live, you have some or all of these rights:

  • Access the personal information we hold about you.
  • Correct information that is inaccurate or incomplete.
  • Delete your information (see Section 10 for how deletion works in practice).
  • Port your information, receiving it in a usable format.
  • Withdraw consent you have given, including for marketing and non-essential cookies.
  • Object to or restrict certain processing.
  • Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our Product Experiences do not make such decisions about you, and our Terms prohibit using them for selection or evaluation decisions.

To exercise any of these, email privacy@brilliantwith.ai. We will respond within the time the applicable law requires. We may need to verify your identity first. These rights have limits, and where an exception applies we will explain it.

If you are unhappy with how we have handled your information, you may complain to your regulator:

  • Canada: the Office of the Privacy Commissioner of Canada.
  • Quebec: the Commission d'accès à l'information du Québec.
  • UK: the Information Commissioner's Office.
  • EU: your local data protection authority.

We would appreciate the chance to address your concern first.

12. When an Organization is involved

Where an Organization enrolls you in a Product Experience, two relationships exist.

Your relationship with us is governed by our Terms and this policy. For your Session Content and your Output, and for delivering the experience to you, we act as controller and you deal with us directly. The Organization does not receive your Session Content or your individual Output, ever.

Our relationship with the Organization is governed by a separate agreement. For the Group Reporting we prepare for the Organization about its group, we act as the Organization's processor, handling that information on its instructions and for its purposes. Questions about the Organization's own handling of that reporting should go to the Organization.

Nothing an Organization agrees with us reduces the protections you have under this policy.

13. Cookies and analytics

We use cookies and similar technologies to run the Platform and to understand how it is used.

  • Essential cookies keep you logged in and keep the Platform secure. These are necessary for the service to work.
  • Analytics cookies help us understand usage so we can improve. We may use analytics tools, including those provided by our infrastructure providers, for this purpose.

For visitors in the EU and UK, we ask for your consent before setting non-essential cookies, through a banner when you first visit. You can change your choice at any time. For other visitors, you can control cookies through your browser settings.

14. Marketing communications

We send product updates and marketing emails only to people we have interacted with, consistent with CASL and other applicable law. Every marketing email includes an unsubscribe link, and you can opt out at any time by using it or by emailing privacy@brilliantwith.ai. We will still send you service messages you need, such as receipts, security notices, and changes to our Terms or this policy.

15. Security

We take reasonable measures to protect personal information, including encryption in transit and at rest, access controls, and authentication through magic links rather than stored passwords. Our Platform and data are hosted on Google Cloud.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator as the law requires.

16. Children

The Platform is for adults. You must be at least 18 to use it, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has used the Platform, contact us and we will delete the information.

17. Changes to this policy

We will update this policy as our product and our obligations evolve.

This is version 1.0. As we release new versions, we maintain a dated, public archive and a changelog describing what changed and when. The version in force when you use the Platform is the one that applies.

If we make a change that materially affects how we handle your personal information, we will notify you by email at your account address before it takes effect. Minor changes take effect on posting and are recorded in the changelog.

18. Contact

Questions, requests, or complaints about this policy or your personal information:

Nish Patel, Privacy Officer
Brilliant with AI Inc.
116 Coolspring Crescent
Ottawa, Ontario, K2E 7M8, Canada
privacy@brilliantwith.ai

Version 1.0 — Effective August 4, 2026. Previous versions: none.