Privacy Policy

BrytIO is a product of Gulf Stream Tech Group, LLC (“BrytIO,” “we,” or “us”). This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It covers information for which we act as the controller: visitors to brytio.com, people who contact us, and the people who sign up for and administer a BrytIO workspace.

A note on your CRM data. The customer, deal, invoice, and shipping records you put into BrytIO (“Customer Content”) are different. You are the controller of the customer data in your workspace, and BrytIO is the processor. We handle it only on your instructions and to provide the service. How we store, secure, and delete that data is described in our Data Processing & Security Policy.

Information we collect

• Account and profile: name, work email, password (managed by our authentication provider), workspace name, role, and settings.
• Billing: billing contact, plan, and subscription status. Card and bank details are collected and stored by Stripe; we do not store full payment card numbers.
• Support and communications: messages and support requests you send us.
• Integrations you connect: if you connect Microsoft 365 or another integration, we receive the access tokens and the data those connections are scoped to. These are optional and can be disconnected anytime.
• Usage and diagnostics: pages viewed, features used, IP address, device and browser type, timestamps, and error/performance data to keep the product reliable.
• Cookies: essential cookies for sign-in and security. We do not use third-party advertising trackers.

How we use information

We use your information only to run the product and support you: to provide, secure, and maintain BrytIO; authenticate you and prevent fraud; process billing; provide support; send service messages; debug and improve the product; and comply with law. We do not sell your personal information, and we do not use your data, or your Customer Content, to train AI models.

How we share information with subprocessors

We share personal information with the service providers below, only to provide these services. We do not sell personal information.

To show company logos, BrytIO fetches the public website of a company you add (domain only) and, as a fallback, Google's favicon service. When a logo loads in your browser, such as the preview while you type your website during setup, Google also receives your IP address and browser details.

We may also disclose information to comply with law, respond to lawful requests, protect our rights and users’ safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

AI features and your data

Some BrytIO features use AI (our assistant, drafting help, and quote suggestions), powered by Anthropic (Claude). When you use an AI feature, we send the content and context that request needs to Anthropic (Claude) to generate the result. One AI task runs without anyone asking: on plans that include AI, unless a workspace owner or admin has turned AI off, the Monday weekly digest email to the workspace owner carries a short AI-written note on where to focus that week. To write it, we send Anthropic a summary of that workspace: its name; its open deal, overdue invoice, expiring quote, and task counts and totals; the title and value of the largest open deal; and the number, customer name, amount, and date of the oldest overdue invoice and of the quote closest to expiry.

Your data is not used to train AI models, and inputs and outputs are not retained by the model provider for training. AI features are available only on plans that include them.

A workspace owner or admin can turn AI off for the whole workspace, and choose whether it may read the text of logged emails and the files you upload. On plans with AI, all three start on: AI itself, reading the text of logged emails, and reading uploaded files. Nothing AI suggests changes your records until a person approves it.

Security

We protect information with these measures:

• Connections are encrypted with TLS, from your browser to Cloudflare and from Cloudflare to our servers. Plain HTTP is redirected to HTTPS.
• The database is stored on disks that Azure encrypts at rest (server-side encryption with platform-managed keys).
• Access tokens for connected integrations, such as Microsoft 365, and 2FA secrets are encrypted a second time by BrytIO, with AES-256-GCM, under a key kept outside the database.
• Each record belongs to one workspace, and the application scopes its reads and writes to your workspace. That scoping is covered by automated tests.
• Owner, admin, and member roles decide who can see financial data, manage the team, and change workspace settings.
• Two-factor authentication (TOTP) is available on every account, and workspace owners and admins can require it for all members.
• The database is backed up nightly. Each backup is encrypted before it leaves the server and is stored off-site.
• Application errors are reported to Sentry. Request bodies, cookies, and auth headers are removed before a report is sent, and session replay is off.
• Code changes run through automated type checks, unit tests, and a full build in CI.

No method of transmission or storage is completely secure, but we work to protect your information and keep improving our safeguards.

Retention

We keep personal information for as long as your account is active and as needed to provide the service, then delete or de-identify it within a reasonable period after account closure, except where we must retain it to meet legal, tax, accounting, or security obligations.

Your rights and choices

Your data is yours. You can:

• Access and correct most information in your account settings.
• Export your data. You can download your contacts, companies, deals, quotes, invoices, expenses, and shipments as CSV files at any time (invoices and expenses by owners and admins). On Team and Enterprise plans, the REST API also returns your contacts, companies, deals, quotes, invoices, and shipments.
• Delete your data. Deleting a record removes it from the app. Deleting a workspace removes its records from our production database. Encrypted database backups that still contain them expire after 60 days.
• Unsubscribe from non-essential email from BrytIO. Every non-essential email we send includes an unsubscribe link, and you can turn these emails off or back on in Settings > Notifications.

We do not sell or share your personal information for targeted advertising. To make a request, contact us and choose “Privacy & data requests.”

Data location

BrytIO is operated from and processes information in the United States.

Children

BrytIO is a business product not directed to children, and we do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you and update the date above.

Contact us

For questions or requests about this policy or your information, use our contact form and choose “Privacy & data requests.”