Privacy policy
Last updated October 1, 2026
AI FIRST RESPONDER LLC operates Brutal Build and is the data controller for the personal data described here, meaning we decide how and why it is processed. This policy explains what we collect, why, and your choices.
What we collect
- Account data: email address, sign-in credentials (passwords are stored hashed) or the identity provided by Google or Apple sign-in.
- Workspace content: the clients, projects, URLs and notes you enter, and the assessment reports we generate.
- Technical data: IP address, browser and device information, and basic usage logs needed to operate and secure the service.
- Support messages: anything you send us by email.
Payments are handled by Paddle.com, which collects your card and billing details. We never see your full card number.
How we use it and our legal basis
- Providing the service (creating your account, running assessments, applying your plan and credits): necessary to perform our contract with you.
- Security and fraud prevention (logs, abuse detection): our legitimate interest in keeping the service safe.
- Improving the service (aggregate usage): our legitimate interest, balanced against your rights.
- Account and support emails (password resets, billing notices, replies): contract performance and legitimate interest.
- Marketing emails, if we ever send them: only with your consent, which you can withdraw at any time.
- Legal and tax records: to comply with legal obligations.
Who we share it with
We don't sell your data. We share it only with:
- Service providers who process data on our behalf: hosting and database, web crawling, and AI analysis providers (submitted public pages are sent to them solely to produce your reports).
- Paddle.com, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing.
- Professional advisers such as lawyers and accountants, where needed.
- Authorities, where required by law.
Some providers may process data outside your country. Where that happens we rely on appropriate safeguards such as standard contractual clauses.
How long we keep it
We keep your account data and workspace content while your account is active. When you delete your account, we delete your clients, projects, assessments and account data, and backups roll off within a limited period. Records we must keep for legal or tax reasons are kept only as long as required, then deleted or anonymized.
How we protect it
We use appropriate technical and organizational measures, including encryption in transit (HTTPS), hashed passwords, per-account access controls in our database so users can only see their own data, and restricted administrative access.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent. You can delete your account yourself from the Account page. For any other request, email us and we'll respond within one month. If you're in the UK or EEA, you can also complain to your local data protection authority.
Cookies and local storage
We use only essential browser storage to keep you signed in and to run checkout. We don't use advertising or third-party analytics cookies. You can clear this storage in your browser settings, but you'll be signed out.