Privacy Policy

Braid LLC (“Braid,” “we”) builds websites, web applications, and AI agents for organizations. This policy covers information collected on wearebraid.com and client data we handle in our work.

1. This website

• Contact form: your name, email, services of interest, and message, delivered to our team by email.
• Newsletter: your email address, managed by Mailchimp. Unsubscribe anytime.
• Organization lookup: we match your IP address against public address ranges to see if you’re visiting from a known organization, such as a university. Our team gets a notification with only the organization’s name. It doesn’t include your IP address or identify you.
• Technical data: Cloudflare, our host, processes IP addresses and browser details to serve and secure the site. Adobe Fonts, Google Maps (only when opened), and YouTube (only when played) receive similar data when they load.

We don’t use advertising or analytics tracking cookies, and we don’t sell or share personal information for advertising.

2. Client data

• Client data belongs to the client. We access it only as needed to deliver contracted services.
• Form submissions on client sites go to the client’s systems, such as Slate, a CRM, or HubSpot. Apart from site backups, we don’t keep them.
• Payments go through Stripe or the client’s processor. We never handle card numbers.
• We don’t request, store, or process student education records (FERPA) or health records. If a project ever required access to education records, we would agree on handling terms with the client in writing first.
• Work product, such as designs we create, contains no personal data. We keep it and may show it in our portfolio unless the client’s contract restricts that or the client asks us not to.

If you use a site we built for a client, that client’s privacy policy applies.

3. AI

We never use client data to train AI models. Any AI service that processes client data, including agents we build into client sites, uses zero data retention and US-based providers.

4. Vendors

Depending on the project, client data may be handled by hosting and infrastructure providers (WP Engine, Kinsta, Cloudways, Acquia, Laravel Forge, Vercel, Netlify, AWS, DigitalOcean, Cloudflare), content platforms (Contentful), backup services (ManageWP, Ottomatik), email delivery (Postmark, Mailgun), payments (Stripe), and our business tools (Google Workspace, GitHub, 1Password, ClickUp, Slack, Zoom). We review vendors annually, provide our current subprocessor list on request, and notify clients of new subprocessors as their contracts require.

5. Security

We maintain a written information security program. We require multi-factor authentication and least-privilege access, use encrypted company laptops and hosting, back up sites we maintain daily, apply critical security patches within one week, train our team annually, and follow a written incident response plan. If a breach affects a client’s data, we notify the client within 72 hours, or sooner where a contract or law requires.

6. Retention

Inquiries are kept as long as needed to do business with you, and newsletter subscriptions until you unsubscribe. When an engagement ends, we remove our access to client systems and keep one final site backup for one year, unless the client asks us to delete it sooner. Other client data is returned or deleted unless the contract says otherwise.

7. Your rights

You can ask us to access, correct, or delete your personal information. We honor these requests wherever you live, including rights under the Virginia Consumer Data Protection Act, the CCPA, and the GDPR. If your information is part of a client’s data, please contact that client directly.

8. Other details

This site is for organizations and isn’t directed to children under 13. Information is processed in the United States. We review this policy annually and will update the date above when it changes.

9. Contact