Privacy Policy

Brandry ("Brandry", "we", "us") is an AI-readiness platform for car dealerships. This policy explains how we handle personal data across two things: the marketing website at brandry.ai, and the Brandry service we provide to dealerships under a subscription.

Who we are: Brandry, PO Box 100, Murrysville, PA 15668, United States, is the operator of record for the website and the service described here.

Our two roles: controller and processor

Brandry is a business-to-business product. Our customer is the dealership, which is a business. Whether we are a "controller" or a "processor" of personal data depends on whose data it is:

We are the controller for the personal data of our own business contacts: dealership staff who create or use an account, prospects who ask for a demo or run the public readiness check, partners and resellers, and visitors to brandry.ai. We decide why and how that data is used, and this policy governs it.
We are a processor (a service provider) for the personal data of car shoppers that flows through the AI concierge we run on a dealership's behalf. In that relationship the dealership is the controller: it decides why the data is collected and it owns the customer relationship. We process that data only to provide the service, under the dealership's instructions and our agreement with them. If you are a shopper and want to exercise a right over that data, the dealership is your first point of contact, and we assist them.

Information we process

Information from dealers, prospects and site visitors (we are controller)

Contact and account details: name, work email, phone, company, role, and the login and configuration details of a Brandry account.
Billing details: subscription plan, billing contact and billing history. Card payments are handled by our payment processor, Stripe. We do not store full card numbers on our own systems.
Sales and support communications: emails, demo requests and messages you send us.
Public readiness checks: when someone runs the AI-Readiness Score tool, the dealership website domain that was entered is sent to us so we can run and improve the check. The marketing form does not ask for, and does not collect, an email address.

Dealer business data (provided by the dealer)

Inventory and merchandising: vehicles, pricing, photos, status, window sticker and build data, offers, incentives and specials.
Brand knowledge: content indexed from the dealership's own website, such as hours, departments, staff listings, and service, parts, financing and warranty policies, used to keep the AI answers on-brand and accurate.

Shopper data through the AI concierge (we are processor)

Conversation content: the questions a shopper asks the AI concierge on a dealership's surfaces and the answers given.
Lead details: when a shopper chooses to submit a lead, the information they provide, which can include name, email, phone and the vehicle or deal they are interested in. Leads are passed to the dealership's systems.

How we use information

To provide, operate, secure and improve the Brandry service and website.
To make dealership inventory, offers and knowledge readable and answerable to AI assistants, and to capture and route leads to the dealership.
To set up accounts, process subscriptions and take payment through Stripe.
To respond to sales and support requests and to run the public readiness check.
To measure how AI assistants and automated agents interact with a dealership's surfaces, and to produce conversation analytics for the dealership about what shoppers asked and where an answer fell short.
To detect, prevent and address fraud, abuse, security issues and technical problems, and to comply with law.

We do not sell personal data, and we do not use shopper conversation content to advertise to shoppers.

AI processing

Brandry uses artificial intelligence to generate responses, summaries and structured data. To do this we send queries and relevant content to third-party AI service providers that run the underlying models. We contract with these providers to process data on our and the dealership's behalf and not to use it to train general-purpose models where that option is available to us. We do not publicly name the specific model vendor.

Business reviews and public business information

To help represent a dealership accurately, we process publicly available business information about it, including Google Business Profile reviews, review content and business ratings. Today this is sourced through third-party data providers. In the future a dealership will be able to authorize a direct connector, using an authorization flow the dealership controls, so that this information is drawn with the dealership's permission. We process this business information to power AI answers and analytics about the dealership, not to profile individual reviewers.

Legal bases (EEA and UK)

Where the EU General Data Protection Regulation or the UK GDPR applies to our own controller processing, we rely on these legal bases:

Contract: to set up and run accounts, subscriptions and billing.
Legitimate interests: to operate, secure, measure and improve the service and site, to run the public readiness check, and for direct business-to-business outreach, balanced against your rights.
Consent: where we ask for it, for example for certain marketing.
Legal obligation: to comply with laws that apply to us.

For shopper personal data, the dealership is the controller and determines the legal basis; we process it under our agreement with the dealership.

We do not sell personal data. We share it only with service providers that help us run Brandry, each bound to handle it only for us and only for these purposes:

Stripe, our payment processor, for subscription billing.
Cloud and edge infrastructure providers that host and serve the platform.
Third-party AI service providers that run the models used to generate responses and summaries.
Third-party data providers that supply publicly available business information, including business reviews and ratings.

We may also disclose information to comply with law, enforce our agreements, protect rights and safety, or as part of a corporate transaction such as a merger or acquisition. A current list of subprocessors is available to dealership customers on request.

Cookies and the marketing site

The brandry.ai marketing site is deliberately light. It does not set advertising cookies and does not run third-party analytics or tracking scripts. The only client storage it uses is a single local preference that remembers whether you chose light or dark mode; that stays in your browser and is not sent to us. See the Cookie Policy for detail. The Brandry service delivered to dealerships may use strictly necessary cookies or tokens to keep an authenticated session working.

Data retention

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymize it. Account and billing records are kept for the life of the relationship and for the period afterward required for tax, accounting and legal reasons. Shopper conversation and lead data is retained according to the dealership's instructions and our agreement with the dealership, since the dealership is the controller of it. As a general matter, we keep personal data for as long as your account is active and as needed to provide the service, then delete or anonymize it within a reasonable period unless a longer period is required by law (for example for tax, accounting or legal-hold reasons).

Security

We use technical and organizational measures appropriate to the data we handle, including encryption in transit, access controls, and reputable infrastructure and processing providers. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect data against loss, misuse and unauthorized access.

Your privacy rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable form, to object to or restrict certain processing, and to withdraw consent. To exercise a right over data we control, email privacy@brandry.ai and we will respond as the law requires. We will not discriminate against you for exercising a right.

If your request is about shopper data processed through a dealership's AI concierge, the dealership is the controller of that data, so please contact the dealership. We will support the dealership in honoring your request.

California privacy rights (CCPA and CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you rights over personal information we collect as a business. In the past twelve months we have collected the categories described above, which can include identifiers, contact and commercial information, and internet or device activity related to using our site and service. We collect it for the business purposes described in this policy.

You can request to know the personal information we have collected about you.
You can request that we delete it, subject to legal exceptions.
You can request that we correct inaccurate personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. Where we handle personal information to provide the Brandry service to a dealership, we act as that dealership's service provider and use the information only to perform the service. To make a request, email privacy@brandry.ai. You may use an authorized agent, and we will verify requests as the law allows.

EEA, UK and international transfers

Some dealerships may receive traffic from the European Economic Area or the United Kingdom. Where the GDPR or UK GDPR applies, the rights and legal bases above apply, and you may lodge a complaint with your local supervisory authority. Brandry operates from the United States, so personal data may be processed in the United States and other countries whose laws differ from yours. Where required, we use appropriate safeguards for international transfers, such as Standard Contractual Clauses. Dealership customers who need a data processing agreement can request one from us.

Children

Brandry is a business tool for car dealerships and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product and the law evolve. When we do, we will change the "Last updated" date at the top, and for material changes we will provide a more prominent notice where appropriate.

Contact us

For privacy questions or to exercise a right, email privacy@brandry.ai. Postal address: Brandry, PO Box 100, Murrysville, PA 15668, United States.