Plain-language draft — not legal advice; review by counsel before launch. Effective 2026-07-14.

Privacy Policy

1. What we collect

• Owners: email address and profile (name, timezone) via account signup.
• Reviewers: a self-asserted email address (to gate access and attribute feedback), stored in a signed HttpOnly cookie and as a lightweight record.
• Content: uploaded prototype HTML, annotations, comments, and basic capture context (viewport, user-agent) submitted with feedback.

2. How we use it

To operate the review loop: serve gated prototypes, attribute feedback, and produce the owner-facing synthesis. We do not sell personal data.

3. Cookies

A signed session cookie for owners, a CSRF cookie, and a signed reviewer-identity cookie (~90 days). No third-party advertising cookies.

4. Retention

Prototype content and feedback persist until an owner deletes the prototype or the account. Expired links stop serving content but records may remain until deletion.

5. Subprocessors

Hosting and database (the operating infrastructure), and Postmark for transactional email. A current list is available on request.

6. Your rights & contact

Requests to access or delete your data: privacy@brightwingsystems.com.