braggy
Try the demoDemoStart for free

Privacy Policy

Last updated

braggy (“we”) is operated by House of Arqam Ventures LLC, a Texas limited liability company. This policy explains what we collect on getbraggy.com and in the braggy product, why, and your choices. Contact: hello@getbraggy.com.

Early-access list

When you join the early-access list we store your email, the optional name and business type you give us, which platforms you post on, how you heard about us, the page you came from and campaign tags (for measuring our ads), and the time you joined. To prevent spam and abuse we also record the country your request came from (as reported by our network provider, Cloudflare) and a one-way fingerprint of your network that can’t be turned back into your IP address; we don’t store your IP address with your entry. We send one confirmation email and, later, an invitation (and one reminder if you haven’t used it after a few days). You can leave at any time by replying to any email or writing to hello@getbraggy.com; we delete early-access list records within 30 days of a request, and delete the whole list 90 days after braggy launches publicly.

Your account

When you use braggy we store your email address, the name you give us, a salted hash of your password if you set one (never the password itself), and the teams you belong to. For each signed-in device we keep the browser’s identifying string (which shows the browser and system) and the country it signed in from, until you sign out or the session ends after 30 days, so you can see and sign out your devices and so we can warn you about a sign-in from somewhere new. We send only emails about the service: sign-in codes and links, email confirmation, password resets, team invitations, new-sign-in alerts, replies when you forward praise to us, and, if you own a workspace, a weekly summary of its activity, which you can turn off in your account or from the email. If you sign in with Google, Google shares your name, email address and Google account ID with us; we use them only to sign you in, and we never see your Google password or anything else in your Google account. If you send us feedback from the app, we keep your message, any screenshot you attach, and the page, app version and browser it came from, for 12 months, to reply and improve braggy. If you turn on notifications, we store the address your browser gives us for sending them to that device, and which kinds you chose. We delete it when you turn notifications off, when your browser tells us it’s no longer valid, or when you delete your account.

Praise you add

braggy processes customer feedback that you provide: reviews, messages and emails you paste or import as a CSV, and responses to the praise form you share (the customer’s words, the optional name they give and their rating). You can also upload screenshots of messages or reviews, which our AI reads to extract the text and which we don’t keep, and forward emails to your braggy address, which we read the same way and keep only the praise we find. This content may contain personal data of your customers. You are the controller of that data and responsible for having the right to share it publicly; we process it on your instructions to create images and captions for you. We replace names of other people mentioned in a quote by default and let you choose how the author is attributed. If you send praise through a business’s braggy form, that business decides how it’s used, and we store it on its behalf.

The praise form also lets a customer add a photo of themselves. We keep it only if they tick “Show my photo with my words”, and never for someone who stays anonymous. Their browser makes it a small square image before it’s sent. The business can then show it beside the customer’s name on its brags. Your team can also add a photo a customer has given you, replace or remove one, or leave it off a single brag. We use these photos only to make your brags; our AI doesn’t look at them. You are the controller of these photos too.

You can also give people on your team their own link to add praise customers tell them, without a braggy account. We keep their first name, what they add and, if they answer, whether you can use their first name when you share praise about them. They can change that answer from their link at any time. You are the controller of this data too. If you add praise through a team link, the business that gave it to you decides how it’s used, and we store it on its behalf.

Social media

You can connect your business’s Facebook Page, and the Instagram Business or Creator account linked to it, so braggy can post your brags there. Connecting is optional: you can always download a brag and post it yourself instead.

What we receive and keep. When you connect, Facebook asks you to approve braggy and choose which Pages to share. While you pick one of those Pages, we hold them encrypted for up to ten minutes. From the Page you choose, we keep:

  • its name and id;
  • the linked Instagram account’s username and id;
  • an access token that lets braggy post to them.

We don’t keep your personal Facebook login or its token, and we don’t read your name or profile picture. For each brag you post, we also keep the post’s id, its link, and who posted it and when.

How we use it. Only to post a brag when someone in your workspace presses Post and confirms, and to show you where each brag was posted. braggy never posts on its own. We check daily that the connection still works, and we check whether braggy’s posts are still up, daily and when you open a brag, so the app can tell you if something changed. We don’t read your messages, comments, followers or insights. We don’t use this information for advertising, sell it, or send it to AI providers.

How we protect it. The access token is encrypted with a key only our servers hold, and it’s never shown to anyone or sent to your browser. When you post to Instagram, Instagram fetches the image from a private, signed link that works for at most 15 minutes. We delete the image as soon as Instagram has it.

What goes to Meta. When you post, the brag’s image and caption go to Facebook or Instagram and are published on your Page or account. They include your customer’s words and how they’re credited, which you choose in braggy. From then on, the post is governed by Meta’s terms and privacy policy, and you can edit or delete it there.

Records. We keep a record that an account was connected or disconnected, and that a brag was posted, for 12 months. Our server logs briefly keep Meta’s error messages when a request is refused. Neither contains tokens or your content.

How long we keep it, and how to remove it. You can disconnect at any time from the Connections page in braggy, which deletes the access we hold straight away. Deleting the business or your workspace does the same. Either way it’s gone from our backups within 30 days. Removing braggy in Facebook › Settings › Business integrations stops our access working; disconnect in braggy too, so we delete what we hold. Records of past posts stay with the brag they belong to, and go when you delete the brag or the business is permanently deleted.

Customers from your point of sale

You can connect your business’s Square account so braggy knows who bought or visited recently and can ask them for praise. Connecting is optional.

What we receive and keep. Square asks you to approve braggy, which can read your business profile, customers, orders, payments and appointments, and never change anything in Square. When you connect, we look at the last 30 days. After that, Square tells us about new payments as they happen, and we check every hour for anything missed. Of each customer with an email address or phone number, we keep only their name, email address, phone number, when they last bought or visited, and whether they’ve asked Square not to send them marketing. We don’t keep what they bought, how much they paid, or their card details. We also keep your Square business’s name and an access token that lets braggy read these.

Asking your customers for praise. Asking is off until a workspace owner turns it on. Then braggy emails each customer once, a while after their visit, in your business’s name and with your message and praise form. If they don’t answer, we send one reminder. We don’t ask anyone who opted out of marketing in Square, and we don’t ask the same person again within 90 days unless they’ve visited again. Replies go to the workspace owner. We record when we asked, whether the form was opened and whether praise was sent from it, so you can see how asking is going.

If you were asked. Every ask has a “Stop asking me” link. Using it stops all asks from that business, for good. So that a stop is kept even if the business connects Square again, we keep a one-way code made from the email address, rather than the address itself, for as long as the business’s braggy workspace exists. The business decides how your praise is used, as described under “Praise you add”.

Who is responsible. The business is the controller of its customers’ data and responsible for having the right to contact them; we process it on its instructions. We don’t use it for anything else, sell it, or send it to AI providers.

How we protect it, and how to remove it. The access token is encrypted with a key only our servers hold, as for social media. Disconnecting Square in braggy deletes the access and the customers we brought in straight away, and so does deleting the business or your workspace. Either way it’s gone from our backups within 30 days. Removing braggy in Square stops our access working; disconnect in braggy too, so we delete what we hold.

The website demo

When you try the demo on getbraggy.com, we keep the text you paste and what the demo made from it (the quote, headline, caption and image), with the date and the country your request came from. We keep it for 90 days, then delete it. It isn’t copied into our backups, though our database provider’s restore history can hold it for up to 30 days after it’s deleted. We use it to see how the demo is used and to test and improve braggy. Only braggy’s administrators can see it; we don’t use it publicly or in marketing, and we don’t use it to train AI models. The text is usually someone else’s words, so please leave out anything sensitive. To have something you pasted deleted sooner, email hello@getbraggy.com with what you pasted and roughly when.

Your website

If you enter your website while setting up, braggy opens its home page in Cloudflare’s headless browser and reads its name, logo, colors, heading font, first lines and Instagram link. A picture of the page’s first screen and those lines go to the AI models below, which only choose among them. The picture is shown to you once and isn’t kept. We keep only what you go on with, as part of your brand, and we note in your workspace’s audit log which site was read.

AI processing

We use AI models to pick quotes, read screenshots and forwarded emails, and write headlines and captions. They run on Cloudflare Workers AI, through Cloudflare’s AI Gateway. If that model is unavailable, the same request goes to Anthropic’s Claude instead, normally also through the AI Gateway; the public demo never falls back to Claude. Neither Cloudflare nor Anthropic uses your content to train their models; neither do we. We don’t keep a log of what’s sent to the models, apart from the demo runs described above, and neither does Cloudflare; Anthropic deletes it within 30 days unless its safety systems flag it. Cloudflare doesn’t keep text pasted into the demo either; only the answers for the demo’s own samples may be cached for a day, so trying them again is quick.

Service providers

We use a small number of providers to run braggy. The current list, what each receives and where it is based, is at getbraggy.com/subprocessors. We tell business customers before we add one.

International transfers

braggy is run from the United States, and our providers process data in the United States and elsewhere. Where data from the EU, UK or Switzerland is transferred, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or standard contractual clauses.

Retention and deletion

We keep data only as long as it’s needed, then delete it automatically. When you delete your account, we delete your data from the live service immediately and from our backups within 30 days, except payment records we must keep for tax purposes. How long each kind of data is kept:

  • Your account: while it exists.
  • Signed-in devices: until you sign out, or 30 days.
  • Sign-in, confirmation and password-reset links: a day after they expire.
  • Counters that limit how often requests can be made (they include IP addresses): 2 days.
  • Team invitations: 30 days after they’re accepted or expire.
  • Praise and brags: while the brand exists, and 30 days after a brand is deleted.
  • Customers’ photos: while their praise exists. Removing a photo deletes it straight away; once its praise is deleted, the photo goes within a day.
  • Team links and the first names on them: while the brand exists, and 30 days after a brand is deleted.
  • Customers from Square, and the asks sent to them: while Square is connected to the brand.
  • “Stop asking me” choices, as one-way codes: while the workspace exists.
  • The early-access list: 90 days after launch, or sooner on request.
  • Notifications: 90 days.
  • Account activity records: 12 months.
  • Feedback you send us from the app: 12 months.
  • Text pasted into the website demo, and what it made: 90 days.
  • Notification addresses for your devices: until you turn notifications off, your browser says they’re no longer valid, or you delete your account.
  • Payment records: 7 years, for tax.
  • Backups: 30 days.

Content you post on social media is controlled by you and those platforms.

Your rights

Depending on where you live you may have rights to access, correct, delete or export your data, or object to processing. You can download your account data from Settings at any time, and delete your account there too. For anything else, email hello@getbraggy.com and we will respond within 30 days. If you are in the EU or UK, you can also complain to your local data protection authority. If you are a customer of a braggy user and your feedback was posted, contact that business first, since they post it and can take it down; we will help them remove it from braggy on request.

Site statistics

We count visits to getbraggy.com ourselves, as daily totals only: how many pages were viewed, the country each visit came from (as reported by our network provider, Cloudflare) and the site that linked to us. To count how many different people visit each day, we combine your IP address and browser type with a random value that changes every day and keep only the resulting one-way code, for that day only: it is deleted the next day, can’t be turned back into your IP address and can’t link your visits across days. Your IP address isn’t stored for statistics, and no cookie is used. To stop abuse, our systems keep it for up to two days in counters that limit how often requests can be made. So that reloading a page isn’t counted as a new visit, your browser remembers, for the open tab only, that the visit was counted; this stays on your device. If you arrive through a link with campaign tags, your browser also remembers those tags for that tab only, so we can count which campaigns bring visitors; they are sent with our daily counts and never linked to you. Cloudflare Web Analytics measures page performance on getbraggy.com and in the app.

Cookies

getbraggy.com sets no marketing cookies. Signed-in sessions use a strictly necessary cookie. Cloudflare Turnstile may set a cookie to distinguish people from bots, and Paddle’s checkout may set its own cookies when you pay.