Privacy Policy
The short version. We collect what we need to run your card, your dashboard and our store, and to keep them safe. We do not sell personal information, and we do not share it for targeted advertising. When people share their details with one of our users through a card, form or booking, those details belong to that user, and we handle them on the user's behalf. You can ask us for a copy of your information, or to correct or delete it, at any time.
1. Who we are and who this covers
Brand Breakers LLC, doing business as Brand Breakers Card ("Brand Breakers," "we," "us"), 4517 S State St, Chicago, IL 60609, runs the websites at brandbreakerscard.com and its subdomains, the Brand Breakers mobile apps, our physical tap cards and the related services (the "Service"). This policy explains how we handle personal information about:
- Account holders: people and companies with a Brand Breakers account, including team members on company cards;
- Visitors: people who tap a card, scan a QR code, or view a card page or our websites;
- Our users' contacts: people who exchange details with a card holder, fill in a form, or book a service (see section 4);
- Shoppers: people who buy cards or plans from us;
- Affiliates: people in our affiliate or referral program.
Our Terms of Service also apply to your use of the Service.
2. Information we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and profile | Name, email, password (stored only as a secure hash), phone, job title, company, address, website, bio, photo, cover image, social links, videos, files, card look and design choices | You |
| Card information | Card numbers and the account they are linked to, card status, taps, scans and visits | You, and your use of the cards |
| Contacts and CRM data | Details people share with you, notes, tags, pipeline stages, follow-ups, form answers, bookings, campaign and automation activity | You and your contacts (section 4) |
| Purchases and billing | Plan, order, shipping address, billing history. Card numbers are handled by our payment processors, and we only see limited details such as the card brand and last four digits. | You and our payment processors |
| Affiliate information | Referral code, referrals, commissions, payout account status and the tax details our payout provider needs | You and our payout provider |
| Device and usage | IP address, browser, operating system, device type, pages viewed, approximate country from the IP address, time of visit, how you arrived (for example a QR code), and error reports | Automatically, from your device |
| Mobile app data | Device identifiers, app version, push notification token, purchases made through the app store | The app and the app stores |
| Connected services | When you connect Google, Microsoft, Zapier or a payment account: the account identifiers and the information the connection needs (section 7) | Those services, with your permission |
| Location | Only if you allow it, for example to record where you met someone (section 9) | Your device, with your permission |
| Communications | Messages you send us, support requests, survey answers, and conversations with the BB Assistant | You |
3. How we use it
- To provide the Service: create and run your account and card page, link and activate cards, deliver contact exchanges, forms, bookings, campaigns and automations, show reports, and take payments;
- To support you and to send service messages about your account, security, billing and changes to the Service;
- To keep the Service safe: prevent spam, fraud and abuse (including with Google reCAPTCHA), secure accounts, fix errors and enforce our Terms;
- To improve the Service: understand how features are used, mostly from combined or de-identified data;
- To run the affiliate program: track referrals and pay commissions;
- To market our own products to account holders and shoppers by email, and you can opt out at any time. We never use our users' contacts to market our products;
- To meet legal duties: keep tax and accounting records, respond to lawful requests, and establish or defend legal claims.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
4. Information we handle for our users
When you exchange details with a card holder, fill in their form, book their service, or scan their QR code, the information goes to that card holder, our user. The user decides how it is used, for example to follow up with you, add you to their pipeline or email you, and their own privacy notice applies. We process it on their behalf as their service provider. We do not sell it, and we do not use it for our own marketing.
- If the card belongs to a company's team member, the company that issued the card can also see it.
- To reach the person you shared with, or to ask them to delete your details, contact them directly. You can also write to us at [email protected], and we will pass your request on and help where we can.
- Every marketing email sent through the Service includes an unsubscribe link, and we stop sending emails through the Service to anyone who unsubscribes from a user.
5. How we share it
We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising. We share information only as follows.
- With the people you choose: your card page is public, and the details on it are shared with anyone who views it or saves your contact. Details you send through someone's card go to that person.
- With your company: if your card was issued by a company, it can see and manage the card, and see the leads and activity from it.
- With service providers who process information for us under contract and only on our instructions:
Purpose Providers Hosting, database and file storage DigitalOcean Payments, subscriptions and payouts Stripe; Shopify (our earlier store); Apple and Google for in-app purchases, through RevenueCat Email delivery and our newsletters Brevo, SendGrid AI for the BB Assistant Anthropic (section 8) Spam protection, maps and wallet passes Google (reCAPTCHA, Maps, Google Wallet), Apple (Apple Wallet) Error monitoring Sentry App notifications Expo - With services you connect, such as Google, Microsoft or Zapier, as the connection needs (section 7);
- For legal reasons: to comply with law or valid legal process, to protect the rights, safety and property of our users, the public or us, and to detect and prevent fraud or security problems;
- In a business transfer: as part of a merger, financing, sale of assets or similar transaction. The recipient must honor this policy for information it receives;
- With your consent or at your direction.
We may share combined or de-identified information that cannot reasonably identify anyone. We do not try to re-identify it.
6. Cookies and similar technologies
- Needed to run the Service: keeping you signed in (stored in your browser), remembering your settings, security, and a one-day cookie that remembers a QR code you scanned so that the contact you then share is credited to the right code.
- Spam protection: Google reCAPTCHA on sign-up and password pages, under Google's Privacy Policy and Terms.
- Content added by card holders: a card holder may add their own analytics code, or embed videos and music from services such as YouTube, Vimeo, SoundCloud or Deezer. Those services may set their own cookies when you view that card, under their own policies.
You can block or delete cookies in your browser settings, but some features may then not work. We honor Global Privacy Control signals as an opt-out of any sale or sharing, although we do neither.
7. Google and Microsoft account data
If you choose to connect your Google account, we use Google APIs only to provide the features you turned on, such as saving new contacts to your Google Contacts and checking your calendar availability for bookings. If you connect Microsoft, we use Microsoft Graph to save contacts to your Microsoft account. We keep only the access tokens and the information needed for those features.
Brand Breakers' use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not let people read it except with your consent, for security or as the law requires, and we do not use it to train AI models.
You can disconnect at any time in your dashboard, or from your Google or Microsoft account's security settings. When you disconnect, we delete the stored tokens.
8. The BB Assistant
When you use the BB Assistant, we send your request and the account information needed to answer it, such as the contacts or follow-ups it concerns, to our AI provider, Anthropic. Anthropic processes it to generate the response, under terms that do not allow it to use the information to train its models. It may keep it for a limited time for safety and abuse monitoring. We store your Assistant conversations encrypted, with a record of actions it took, so you can review and undo them. You can choose not to use the Assistant.
9. Location
We use your precise location only if you allow it on your device. For example, when someone exchanges details with you, they can choose to add where you met, and we look up the place with Google Maps and save it with the contact. Otherwise we only estimate your country or general area from your IP address, for security and visit reports. You can turn location access off in your device settings at any time.
10. How long we keep it
| Information | How long |
|---|---|
| Account, card page and CRM data | While your account is open. After it closes, we keep it for 30 days so you can ask for an export, then delete it within 90 days, except as listed below. |
| Contact Data held for a user | Until the user deletes it or closes their account, then as above |
| Purchase, billing, tax and affiliate payout records | 7 years, for tax and accounting law |
| Card visit and usage logs | Up to 24 months, then deleted or de-identified |
| Security and error logs | Up to 12 months |
| BB Assistant conversations | Up to 12 months, or sooner if you delete them |
| Unsubscribe and suppression lists | As long as needed to keep honoring the request |
| Backups | Overwritten in their normal cycle, up to 35 days |
We may keep information longer where the law requires it, or to resolve disputes, prevent fraud or enforce our agreements.
11. Security
We use administrative, technical and physical safeguards suited to the information we handle, including encryption in transit, hashed passwords, encrypted storage of sensitive items such as connected-service tokens and Assistant conversations, access controls and logging. No system is completely secure, so keep your password and card PIN private. If a breach affects your personal information, we will notify you and the authorities as the law requires, including under the Illinois Personal Information Protection Act.
12. Your choices and rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy, in a portable format where possible;
- correct information that is wrong;
- delete your information, subject to the exceptions in section 10;
- stop sending you marketing email. Use the unsubscribe link or your account settings. Service messages about your account still apply;
- withdraw a consent you gave, such as for location or a connected service.
You can do much of this yourself in the dashboard: edit your profile, export contacts, disconnect services, or close your account. To make a request, email [email protected] with the subject "Privacy request," or call (833) 755-2763. We will confirm your identity before acting, usually by email to the account address, and reply within 45 days. If we need more time, we will tell you. You may use an authorized agent, with written permission we can verify. If we turn down your request, you can appeal by replying to our decision, and we will answer within 60 days. We will not discriminate against you for using these rights.
If your information was shared with one of our users through their card, form or booking, see section 4.
13. US state privacy rights
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with consumer privacy laws have the rights in section 12, as their state law provides. For California residents, in the past 12 months:
- we collected the categories of personal information in section 2: identifiers, customer records, commercial information, internet and device activity, approximate geolocation, precise geolocation (only with permission), audio-visual information (photos you upload), professional information, and inferences limited to plan and feature use;
- we disclosed these for business purposes to the service providers and others listed in section 5;
- we did not sell or share personal information for cross-context behavioral advertising, including that of anyone under 16;
- we use precise geolocation, the only sensitive personal information we handle, only to provide the feature you asked for, and not to infer characteristics about you.
California's "Shine the Light" law: we do not share personal information with third parties for their direct marketing.
14. Visitors from outside the US
We are based in the United States, and we process and store information there. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use safeguards the law recognizes, such as the European Commission's Standard Contractual Clauses. Where the GDPR or the UK GDPR applies, we rely on these legal bases:
- performing our contract with you (running your account and card);
- our legitimate interests (security, fraud prevention, improving the Service, and limited marketing to customers), balanced against your rights;
- your consent (for example location and connected services);
- legal obligations.
You may also object to or restrict processing, and complain to your local data protection authority.
15. Children
The Service is not for children under 13, and accounts are for people 18 and older. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.
16. Biometric information
We do not collect biometric identifiers or biometric information, such as face geometry, fingerprints or voiceprints. Photos you upload are used only to display on your card. Cropping and resizing them does not involve facial recognition, and we do not use them to identify anyone.
17. Changes to this policy
We may update this policy. If we make material changes, we will notify you by email or in the Service before they take effect, and we will ask for your consent where the law requires it. The date at the top shows when it last changed.
18. Contact us
Brand Breakers LLC (Brand Breakers Card)
Attn: Privacy
4517 S State St, Chicago, IL 60609
[email protected] · (833) 755-2763