Privacy Policy Draft

1. Scope

This Privacy Policy describes how BranchWise ("we," "us," "our") collects, uses, stores, and protects information when users access the BranchWise web application and related services.

BranchWise is a decision-support product designed for founders, operators, and teams. Because users may input sensitive business information, confidentiality and data isolation are core service requirements.

2. Information We Collect

A. Account and authentication data

• Email address and basic profile metadata provided by authentication providers (including Google OAuth).
• Internal user ID and account settings.

B. User-provided content

• Session titles, prompts, answers, decision-tree nodes/edges, tags, rewinds, branch labels, and export artifacts.
• Optional notes/metadata entered in the UI.

C. Technical and usage data

• Event logs (e.g., session_started, answer_submitted, branch_created, export_completed).
• Device/browser metadata, IP-derived geolocation (coarse), timestamps, and error logs.

3. How We Use Information

We use data to:

• Authenticate users and manage sessions.
• Provide and maintain decision-tree functionality.
• Generate question-only interactions in strict mode.
• Measure reliability, usability, and performance.
• Detect abuse, fraud, and unauthorized access.
• Comply with legal obligations.

4. Data Isolation and Access Controls

BranchWise enforces account-level isolation:

• Row-level security (RLS) in the database — users access only records associated with their user_id (or authorized team_id).
• Query-level scoping for all decision trees, session history, and exports.
• No cross-account retrieval based on semantic similarity, embeddings, or shared prompt context.
• LLM prompt isolation: one user/team context is never mixed with another.

5. Model Use and Training Commitment

BranchWise decision content is not used by BranchWise to train foundation models.

We do not sell decision content to data brokers. We do not share user decision content with third parties except service providers required to operate the product (hosting, database, auth, observability), under contractual confidentiality obligations, and in response to legal compliance requests where required by law.

6. Google OAuth and Third-Party Authentication

Google OAuth is used for identity verification and sign-in convenience. Google OAuth does not secure or manage BranchWise application data storage. BranchWise remains responsible for protecting app data in our systems.

If a user revokes Google access: existing BranchWise sessions expire gracefully; the user must re-authenticate to continue; revocation does not automatically delete BranchWise-stored data unless a deletion request is separately submitted.

7. Security Measures

We implement administrative, technical, and organizational safeguards including encryption at rest, encryption in transit (HTTPS/TLS), least-privilege access controls, audit logging for privileged actions, secrets management, and environment segregation. No system is 100% secure; BranchWise is designed to minimize unauthorized access and cross-account leakage risk.

8. Data Retention

We retain data for as long as needed to provide service, meet contractual commitments, resolve disputes, and comply with legal requirements.

9. User Rights and Choices

Depending on your jurisdiction, you may request access, correction, deletion, portability, or restriction of processing for your personal data. Contact us using the information in Section 13 to submit a request.

10. Children's Privacy

BranchWise is not intended for children under 13 (or the minimum age required by local law). Do not use the service if prohibited by age-related laws in your jurisdiction.

11. International Transfers

If data is transferred across borders, BranchWise implements appropriate safeguards (e.g., contractual clauses and vendor controls) as required by applicable law.

12. Changes to This Policy

We may update this policy periodically. Material changes will be communicated through reasonable notice in-app or by email.

13. Contact

For privacy inquiries, contact us at tailwindresearch@agentmail.to.