Privacy Policy

1. About this notice

This Privacy Policy explains how Bragi collects, uses, stores, and shares personal information when you use the service.

2. Who controls your information

Bragi is the personal information controller for the information described here. For privacy questions or requests, contact [email protected].

3. Information we collect

• Account information: name, email address, sign-in credentials or provider identifiers, and account timestamps.
• Your content: Career Library Entries, Contact Details, Job Postings, Resumes, imported resume PDFs, and information you include in requests.
• Security and session information: session identifiers, IP address, browser or device user agent, and information needed to keep accounts secure.
• Payment information: the GCash sender name, sender mobile number, transaction number, payment amount shown at submission, request status, review reason, and AI Access dates.
• Usage information: product analytics about how features are used, once those analytics are introduced. We will update this notice if the provider or information collected materially changes.
• Messages: information you send when you contact Bragi.

4. How we use information

• Provide, personalize, and maintain Bragi and your account.
• Store and display your User Content at your direction.
• Process Import and Tailor requests and return AI-generated results.
• Verify GCash payments, manage AI Access, and prevent duplicate requests.
• Authenticate users, prevent abuse, secure the service, and troubleshoot issues.
• Understand feature usage and improve Bragi through product analytics.
• Communicate with you about the service and respond to support requests.
• Meet legal obligations and establish, exercise, or defend legal claims.

5. Lawful bases and privacy principles

We process information where needed to provide a service you request or perform an agreement with you, with your consent where required, for legitimate interests such as security and service improvement, and to comply with law. We aim to follow the Philippines Data Privacy Act of 2012 principles of transparency, legitimate purpose, and proportionality. This notice is information about processing; it is not a substitute for consent where consent is required.

6. AI processing

We send the resume PDF and related instructions to OpenRouter and the model provider selected for Import when you invoke Import. We send the Job Posting and related instructions to OpenRouter and the selected model provider when you invoke Tailor. We do not send those materials for AI processing merely because you have an account. For both features, we ask OpenRouter to use only providers it marks as not collecting user data and Zero Data Retention endpoints, and not to persist the Responses API result. These controls depend on OpenRouter's provider policy information and may reduce model availability. The providers may otherwise process information under their own privacy terms; review them before using an AI feature.

7. When we share information

• Infrastructure providers: hosting, database, authentication, storage, and security providers that help operate Bragi.
• AI providers: OpenRouter and the model provider you invoke for Import or Tailor.
• Sign-in providers: Google, if you choose Google sign-in and that option is enabled.
• Analytics providers: product analytics providers once enabled, for understanding feature use rather than advertising or selling personal information.
• Legal and safety recipients: advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, or handle a dispute or transaction.
• Payment reviewers: authorized Bragi administrators who verify submitted GCash payment information.

8. Cookies and similar technologies

Bragi uses essential cookies or similar storage for authentication, sessions, and security. We do not use advertising cookies or sell personal information. The site currently loads fonts from Google Fonts, and Google sign-in may share information with Google when you choose that option. Product analytics may use similar technologies once enabled.

9. Retention and deletion

We keep account information and User Content while your account is active and as needed to provide the service. Payment records are kept while the account exists for verification, disputes, and duplicate-payment auditing, and may be retained longer where required by law. If you ask us to delete your account or information, we will delete or anonymize it unless we must retain it for security, legal, dispute-resolution, or backup purposes. Backup copies may remain until their normal replacement cycle. To request deletion, email [email protected].

10. Security and international processing

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No online service is completely secure. Some providers may process information outside the Philippines; when that happens, we take steps appropriate to the service and applicable law.

11. Your rights

Subject to applicable law and reasonable verification, you may ask to be informed about processing, access or correct your information, object to certain processing, request erasure or blocking, request portability where applicable, withdraw consent where processing relies on consent, and seek damages or file a complaint where available. You can contact us first at the email above. You may also contact the National Privacy Commission.

12. Children

Bragi is intended for people aged 18 and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided information, contact us so we can review and remove it where appropriate.

13. Changes to this notice

We may update this Privacy Policy when our processing or legal obligations change. We will post the updated version with a new effective date. Material changes will be highlighted where appropriate.

14. Contact

Privacy questions and requests can be sent to [email protected].