Privacy Policy

Bring Your Own Idea runs Bring Your Own Idea and is responsible for the personal data described here (the “controller” under GDPR and UK GDPR, and the “data fiduciary” under India’s Digital Personal Data Protection Act 2023). Contact: hello@bringyourownidea.com.

• Account data: the name, email address and profile picture from your Google account when you sign in.
• Content you create: ideas, company plans, reports, files and cycle outputs written by your agents, and your settings (autonomy levels, budgets, departments).
• Data your agents collect for you: for example CRM contacts and notes gathered while running a company. This can include personal data of third parties. You are responsible for having a lawful basis for it.
• Notification data: your notification preferences and, if you opt in, web push subscriptions.
• Billing data: your plan and subscription status. Card, UPI and bank details go straight to our payment processor, Razorpay, and are never stored by us.
• Credentials you give us: your AI API key and the credentials for any services you connect, stored encrypted.
• Usage and security records: an audit log of agent actions and approvals, spend records, and basic server logs.

This website (the landing site) collects nothing about you beyond standard server logs.

You sign in to Bring Your Own Idea with your Google account. We use Google only to sign you in.

• What we request: the basic sign-in scopes only (openid, email and profile).
• What we read: your name, email address and profile picture.
• What we use it for: to create and identify your account, show who is signed in, and send you service email about your companies.
• What we never do: access your Gmail, Google Drive, Calendar, Contacts or any other Google data; sell this information; use it for advertising; or use it to train AI models.
• Sharing: we do not share it with anyone except the service providers listed below that host and run the service, or where the law requires it.
• Removing access: you can revoke our access at any time in your Google Account settings, and ask us to delete your data as described under “Your rights”.

Bring Your Own Idea’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide the service you asked for (sign-in, running your companies, notifications, billing). Basis: contract; under the DPDP Act, your consent and legitimate uses.
• To keep the service secure and prevent abuse, including audit logs. Basis: legitimate interests.
• To meet legal obligations, such as tax and accounting records. Basis: legal obligation.
• Optional features such as push notifications and connected services. Basis: your consent, which you can withdraw at any time.

We do not sell personal data, do not use your content to train AI models, and do not use it for advertising.

We use trusted service providers (sub-processors), only as needed to run the service:

• Cloud hosting: storing your data and running the service.
• Sign-in: Google, when you sign in with your Google account.
• AI processing: Anthropic. Agent work is sent through your own API key, under your own agreement with Anthropic.
• Email delivery: sending notifications and, where you allow it, company email.
• Payments: Razorpay, for subscriptions. Card, UPI and bank details go straight to them.
• Services you connect: tools you choose to link to a company, only once you connect them.
• Push notifications: your browser vendor’s push service, if you turn them on.

Each provider is bound by data protection terms. For the current list of providers, email us.

We may also disclose data where the law requires it, or to protect rights and safety. If the business is sold or reorganised, data may transfer to the successor under the same commitments.

Data is stored with our cloud provider in the United States. If you are in the UK, the European Economic Area or India, your data is therefore transferred to the United States and handled by the providers above, which are outside your country. Where required, we rely on safeguards such as standard contractual clauses or the providers’ data protection terms. The DPDP Act permits such transfers except to countries the Indian Government restricts.

Secrets such as your Anthropic key and connection credentials are encrypted with a managed key service and stored separately from company files; only the system that runs your agents decrypts them, and they are never shown in full again. Traffic is encrypted in transit, access is restricted, and agent actions are logged. No system is perfectly secure. If a breach affects your personal data we will notify you and the regulator as the law requires.

We keep account and company data while your account is active. When you delete a company it is soft-deleted and can be restored for 30 days. A weekly cleanup then deletes it permanently, and the older file versions our storage keeps are removed automatically 30 days after that, so nothing remains. If you delete your account we remove your personal data in the same way, except records we must keep by law (such as invoices) or that are needed to resolve disputes.

You can remove your Anthropic key or any connection at any time, which deletes the stored credential.

Depending on where you live, you can ask us to: give you access to your data; correct it; delete it; export it in a portable format; restrict or object to certain uses; and withdraw consent at any time. Under the DPDP Act you can also nominate someone to exercise your rights and use our grievance process. You may complain to your data protection authority (in the UK, the ICO; in India, the Data Protection Board).

Email hello@bringyourownidea.com from the address on your account. We respond within 30 days.

If your agents have collected personal data about other people (for example CRM contacts), those people can contact you or us to exercise their rights, and you are responsible for responding as the controller of that data.

This website sets no cookies and runs no analytics or tracking scripts.

The app (app.bringyourownidea.com) uses only essential cookies: a session cookie that keeps you signed in (up to 30 days), a short-lived cookie used during Google sign-in and when connecting GitHub, and a cookie remembering your light or dark appearance choice. These are needed for the service to work, so no consent banner is shown. We currently use no analytics or advertising cookies.

The service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.

We will update this page when our practices change, adjust the date above, and tell you about material changes by email or in the app.

For privacy questions, requests or complaints: hello@bringyourownidea.com. Bring Your Own Idea.