This Privacy Policy explains how Brae Company Limited ("BRAE") collects, uses, shares, stores and protects Personal Data when you use the BRAE self-serve platform, and the rights you have over your Personal Data. Capitalised terms not defined here have the meaning given in the Terms of Service.
1. About this Policy
1.1. Data controller
The controller of your Account, billing and usage data is Brae Company Limited (Công ty TNHH Brae), a limited liability company established under the laws of Vietnam, enterprise and tax code 0318864812, with its registered office at 402/56A Lê Văn Sỹ, Nhiêu Lộc Ward, Ho Chi Minh City, Vietnam.
1.2. Scope
This Policy applies to the BRAE self-serve platform at withbrae.com and its subdomains (the "Service"). It does not apply to BRAE's managed advisory service, which is governed by separate written agreements, or to third-party websites linked from the Service.
1.3. Legal framework
BRAE processes Personal Data in accordance with Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15, the "PDPL"), Decree No. 356/2025/ND-CP guiding it, and other applicable Vietnamese law, as well as the requirements of Google and Polar for the services BRAE uses from them.
1.4. Data protection contact
Questions about this Policy and requests about your Personal Data can be sent to BRAE's data protection contact, who can be reached at [email protected].
1.5. Summary
- BRAE collects only the Personal Data needed to operate your Account and provide the Service.
- BRAE does not sell Personal Data and does not use Customer Data to train artificial intelligence models.
- Customer Data is processed by the Providers listed in section 9.1, some of which are located outside your country.
- You may access, correct, obtain a copy of, or delete your Personal Data by writing to [email protected].
2. Definitions
| Term | Meaning |
|---|---|
| Personal Data | Information that identifies, or can be used to identify, a living individual, such as a name, email address or IP address |
| Sensitive Personal Data | Personal Data that the PDPL classifies as sensitive, such as health, biometric or precise location data |
| Data Subject | The individual to whom Personal Data relates |
| Customer Data | All content you upload, enter or connect to the Service, and all Output generated for you, as defined in the Terms of Service |
| Controller | The party that decides the purposes and means of processing Personal Data |
| Processor | The party that processes Personal Data on behalf of, and on the instructions of, a Controller |
| Provider | A third-party company that processes Personal Data for BRAE to help deliver the Service |
| Processing | Any operation performed on Personal Data, including collection, storage, use, disclosure and deletion |
3. Principles BRAE follows
In processing Personal Data, BRAE commits to:
- Lawfulness and transparency: processing only on a lawful basis and informing you clearly of how your data is used;
- Purpose limitation: using Personal Data only for the purposes set out in section 5;
- Data minimisation: collecting only what is necessary for those purposes;
- Accuracy: keeping Personal Data accurate and correcting it on request;
- Storage limitation: keeping Personal Data only for the periods in section 11; and
- Security and accountability: protecting Personal Data under section 12 and keeping records that show compliance.
4. Personal Data BRAE collects
4.1. Data you provide
- Account details: name, email address and company name.
- Customer Data: messages, uploaded files, deal notes and Output generated for you.
- Support communications: emails, and requests you submit through the Service, including your email address, company name and the content of your request.
4.2. Data collected automatically
- Sign-in records: time of sign-in, device and browser type, and IP address.
- Usage information: features used, frequency of use, job counts and error reports.
- Consent records: where BRAE asks for your consent, the time of your consent and the version of the document you consented to.
4.3. Data from third parties
- Google, only if you choose to add files from Google Drive: the files you pick in Google's file picker, and their names, types and versions (see section 16.2).
- Polar, BRAE's reseller and merchant of record: Plan, subscription status, invoices and country. BRAE does not receive or store your payment card details.
5. Purposes and legal bases
| # | Purpose | Personal Data used | Legal basis |
|---|---|---|---|
| 1 | Create, secure and authenticate your Account | Account details, sign-in records | Your consent; performance of the contract with you |
| 2 | Provide the Service, including answering requests, conducting research and generating documents and slides | Customer Data, Account details | Performance of the contract; your consent to processing by Providers |
| 3 | Bill you and apply Usage Limits | Billing details, usage information | Performance of the contract; legal obligations on tax and accounting |
| 4 | Maintain security, prevent abuse, fix errors and measure operating costs | Sign-in records, usage information | BRAE's legitimate interest in operating a secure and reliable service |
| 5 | Respond to support requests | Support communications, Account details | Performance of the contract |
| 6 | Send product news and offers | Email address | Your separate, optional consent (see section 15) |
| 7 | Comply with legal obligations and lawful requests from authorities | As lawfully required | Legal obligation |
BRAE will not process Personal Data for a new purpose without informing you and, where required, obtaining your consent.
6. Consent
6.1. When BRAE relies on consent
BRAE relies on your consent where required by the PDPL, including for creating your Account, processing Customer Data through Providers, transferring data outside Vietnam, and sending marketing communications.
6.2. How consent is collected and recorded
Before you can use the Service, BRAE shows you a consent screen with three boxes:
- a required box to accept the Terms of Service and the Privacy Policy, and to confirm that you are 18 or older and not located in the European Union, the European Economic Area or the United Kingdom;
- a required box to confirm that you understand your messages and files are sent to AI providers, some of them outside Vietnam, to provide the Service; and
- an optional box to receive product news and updates.
The Service cannot be used until both required boxes are ticked. BRAE records the date and time of your choices and the version of the documents you accepted. Consent to marketing communications is optional and is not required to use the Service.
6.3. Withdrawing consent
You may withdraw consent at any time by writing to [email protected]. Withdrawal does not affect processing carried out before it. Because consent to core processing is necessary to provide the Service, withdrawing it will require your Account to be closed.
7. Artificial intelligence
7.1. AI processing
The Service uses artificial intelligence to analyse Customer Data and generate Output. The Service identifies itself as an artificial intelligence system, not a person, and images it generates are marked as AI-generated. Output may contain errors and should be checked before it is relied on.
7.2. No model training
BRAE does not use Customer Data to train or improve artificial intelligence models. BRAE sends Customer Data to the AI Providers in section 9.1 only to provide the Service to you. Each AI Provider handles the data it receives under its own terms and privacy policy, which govern whether it may use that data to improve its own services.
7.3. No solely automated decisions
BRAE does not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
8. Personal Data in Customer Data
8.1. Roles
Customer Data frequently contains Personal Data of other individuals, such as company owners, employees and business contacts. For that Personal Data, you decide what is uploaded and for what purpose, and BRAE processes it only on your instructions, given through your use of the Service.
8.2. Your responsibilities
You are responsible for ensuring that you have a lawful basis to share such Personal Data with BRAE, including providing any notice or obtaining any consent required by law.
8.3. Data processing agreements
If your organisation requires a written data processing agreement, please contact [email protected].
9. Disclosure of Personal Data
9.1. Providers
BRAE discloses Personal Data only to the Providers listed below, and only to the extent each needs to perform its service. Each Provider handles Personal Data under its own terms of service and privacy policy. BRAE will update this list before engaging a new Provider.
| Provider | Service provided to BRAE | Location of processing |
|---|---|---|
| Supabase, Inc. | Sign-in only | Singapore |
| Polar Software, Inc. | Payments, tax and invoicing, as reseller and merchant of record | United States and global |
| Amazon Web Services | Server hosting, the account database and document search index (run by BRAE), file storage, and hosting of BRAE's own AI routing layer | Singapore |
| Cloudflare, Inc. | Delivery and security of the website and web app | Global |
| Google Cloud | Access to the Google Drive files you choose to connect, and AI processing | Global |
| OpenAI | AI processing and image generation, through BRAE's routing layer | United States |
| Anthropic | AI processing, through BRAE's routing layer | United States |
| xAI | AI processing, through BRAE's routing layer | United States |
| Upstage | Reading uploaded documents | South Korea |
| Deepgram, Inc. | Turning your voice recordings into text | United States |
| Voyage AI | Search within your documents | United States |
| Perplexity | Web search and search within your documents | United States |
| Exa | Web search | United States |
| Sentry | Error monitoring, to find and fix faults in the Service | United States |
| Brevo (Sendinblue SAS) | Emailing requests you send to the BRAE team to the staff who handle them | European Union |
9.2. Competent authorities
BRAE discloses Personal Data to competent state authorities only where required by law and on receipt of a lawful request. Where the law permits, BRAE will notify you before responding.
9.3. Business transfers
If BRAE is involved in a merger, acquisition, reorganisation or sale of assets, Personal Data may be transferred to the successor entity. BRAE will notify you before the transfer, and the successor must continue to protect Personal Data in accordance with this Policy.
9.4. No sale of Personal Data
BRAE does not sell Personal Data and does not share it for advertising purposes.
10. Cross-border transfers
10.1. Countries of processing
BRAE is established in Vietnam. Its Providers process Personal Data in the countries listed in section 9.1, so your Personal Data will be processed outside your country. These transfers are necessary to provide the Service. You consent to them by ticking the required box on the consent screen described in section 6.2, and the Service cannot be used until you do.
10.2. Safeguards
BRAE protects transferred Personal Data by sending it only to the Providers listed in section 9.1, by encrypting it in transit, and by limiting what each Provider receives to what it needs. Where required by Vietnamese law, BRAE prepares and files a cross-border transfer impact assessment with the competent authority.
11. Retention and deletion
11.1. Retention periods
| Personal Data | Retention period |
|---|---|
| Account details and Customer Data | For as long as your Account is open, then deleted within 30 days after closure |
| Backups | BRAE does not currently keep separate backups of Customer Data. This Policy will be updated if that changes |
| Invoices and accounting records | At least 10 years, as required by Vietnamese accounting law (Polar holds the primary payment records) |
| Consent records and records of Data Subject requests | 5 years after Account closure, as evidence of compliance |
| Server and security logs | Rotated automatically by size, so the oldest entries are overwritten as new ones are written; kept only on BRAE's servers |
| Error reports | 90 days |
| Marketing contact details | Until you unsubscribe or withdraw consent |
11.2. Deletion process
When you delete an item in the Service, it is removed from your workspace. When you close your Account, BRAE deletes your Account and Customer Data from its own systems within the periods in section 11.1. Copies held by Providers are subject to their own retention terms.
12. Security
12.1. Security measures
BRAE applies technical and organisational measures appropriate to the risk, including:
- encryption of Personal Data in transit (HTTPS) and at rest;
- separation of each Account's data from that of other Accounts;
- operation of the self-serve Service separately from BRAE's managed advisory service;
- authenticated access to all data, restricted to BRAE personnel who need it to operate the Service or respond to support requests; and
- confidentiality obligations for all personnel and Providers with access to Personal Data.
12.2. Personal Data breaches
If a breach of Personal Data occurs, BRAE will:
- act immediately to contain the breach and limit its effects;
- notify the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security, within 72 hours of becoming aware of it, as required by law; and
- notify affected Data Subjects without undue delay where the breach is likely to affect their rights.
12.3. Residual risk
No method of transmission or storage is completely secure. While BRAE works to protect Personal Data, it cannot guarantee that unauthorised access will never occur.
13. Sensitive Personal Data and children
13.1. Sensitive Personal Data
BRAE does not request Sensitive Personal Data. You must not upload Sensitive Personal Data of other individuals unless you have a lawful basis to do so. You are responsible for any such data you choose to upload.
13.2. Children
The Service is intended for individuals aged 18 or over. It is not designed to process Personal Data of children under 16. If BRAE becomes aware that it holds such data, it will delete it promptly.
14. Your rights
14.1. Rights of Data Subjects
Under the PDPL, you have the following rights:
| # | Right | Description |
|---|---|---|
| 1 | Right to be informed | To be informed of how your Personal Data is processed |
| 2 | Right to consent | To give or refuse consent to processing |
| 3 | Right of access | To access your Personal Data and request its correction |
| 4 | Right to withdraw consent | To withdraw consent at any time (see section 6.3) |
| 5 | Right to deletion | To request deletion of your Personal Data |
| 6 | Right to restrict processing | To request that processing be limited |
| 7 | Right to data provision | To receive a copy of your Personal Data in a portable format |
| 8 | Right to object | To object to processing |
| 9 | Right to complain | To lodge a complaint with BRAE or the competent authority |
| 10 | Right to compensation | To claim compensation for damage caused by unlawful processing |
| 11 | Right to self-protection | To protect your rights by the means permitted by law |
14.2. How to submit a request
Send your request to [email protected] from the email address registered to your Account, stating which right you wish to exercise.
14.3. How BRAE handles a request
- Acknowledgement: BRAE confirms receipt within 2 working days.
- Verification: BRAE verifies your identity, and may ask for further information if needed.
- Processing: BRAE carries out the request, including with Providers where necessary.
- Response: BRAE informs you of the outcome, or explains why the request cannot be fulfilled in whole or in part.
- Record: BRAE keeps a record of the request as described in section 11.1.
14.4. Response times
| Request | Completed within |
|---|---|
| Access, copy or correction | 10 days |
| Withdrawal of consent or restriction of processing | 15 days |
| Deletion | 20 days, or 30 days where a Provider must also delete |
If BRAE needs more time, it will tell you why and when it expects to respond.
14.5. Requests about Customer Data
If your Personal Data appears in Customer Data uploaded by another user, BRAE will forward your request to that user and assist them in responding.
14.6. Your obligations
You must provide accurate Personal Data, keep your sign-in credentials secure, and notify BRAE promptly at [email protected] of any suspected unauthorised access to your Account.
14.7. Complaints
You may lodge a complaint with the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security, or, if you are outside Vietnam, with the data protection authority in your country.
15. Marketing communications
15.1. BRAE sends marketing emails only if you gave separate, optional consent. Every marketing email includes a link to unsubscribe, and BRAE will stop sending them promptly after you unsubscribe.
15.2. Service messages, such as invoices, security alerts and password resets, are not marketing and are sent to all users as needed to provide the Service.
16. Cookies and Google user data
16.1. Cookies
BRAE uses only strictly necessary cookies and browser storage, for sign-in, keeping your work on screen, and payment, plus a few settings you chose, such as which workspace you last opened, that are kept only in your browser. BRAE does not use advertising, analytics or tracking cookies. See the Cookie Policy.
16.2. Google user data
Signing in to BRAE does not use your Google account. BRAE receives no Google user data unless you choose to add files from Google Drive.
How it works. When you connect Google Drive, Google asks you to let BRAE "see, edit, create and delete only the specific Google Drive files you use with this app". This permission lasts until you disconnect Google Drive in the Service or remove it in your Google Account. You then choose files in Google's own file picker. BRAE can open only the files you pick there; it cannot list or open anything else in your Drive, including other files in the same folder. BRAE only reads these files; it never changes, deletes or shares them.
What BRAE accesses. The files you pick, and their names, types and versions. Nothing else in your Google Drive or your Google account.
How BRAE uses it. BRAE copies the files you pick into the knowledge base of the workspace you are in, and uses the content only to provide the Service to you, for example when you search your documents or ask questions about them. When you press Check for updates, and automatically when you come back to a workspace after being away for a while, BRAE reads the same files again, replaces any that changed, and removes any you deleted or that BRAE can no longer open. The content is sent to the Providers in section 9.1 only as needed to read the documents, build the search index and answer your requests.
What BRAE stores. Copies of the files you picked with the text and search index made from them, the Drive identifier and version of each file, and a record that you accepted these terms. BRAE also stores the email address and identifier of the Google account you connected, to show which account is connected and to stop a different account being used by mistake, and an encrypted token that Google gives BRAE so that it can read the files you picked without asking you to sign in each time. The token is encrypted before it is stored, is never shown to you or to anyone else, and is used only to read the files you picked. BRAE stores no Google password.
What BRAE does not do. BRAE does not use Google user data for advertising, does not sell it, does not transfer it to anyone except as described in this section, and does not use it to develop, improve or train artificial intelligence or machine learning models. BRAE does not allow people to read it unless you ask BRAE to for support, it is necessary for security, or the law requires it.
Removing access. You can disconnect Google Drive in the Service at any time; BRAE then asks Google to revoke its access and deletes the stored token and account details. You can remove the imported files in the Service at any time, or at the moment you disconnect; BRAE then deletes its copies. You can also remove BRAE's access in your Google Account under Security → Third-party connections; files already copied stay in your knowledge base until you remove them in the Service or delete your account (section 11.1).
Limited Use. BRAE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
17. Changes to this Policy
BRAE may update this Policy. For material changes, BRAE will notify you by email at least 30 days before they take effect and ask you to review the updated Policy at your next sign-in. The version number and date at the top of this Policy show when it was last updated. Previous versions are available on request.
18. Governing law
This Policy is governed by the laws of the Socialist Republic of Vietnam. Disputes are resolved as set out in section 20.3 of the Terms of Service.
19. Contact
- Company: Brae Company Limited (Công ty TNHH Brae)
- Enterprise code: 0318864812
- Registered office: 402/56A Lê Văn Sỹ, Nhiêu Lộc Ward, Ho Chi Minh City, Vietnam
- Data protection contact: [email protected]
- Phone: +84 90 381 22 92