Privacy Policy

LumaNavi LLC operates Brinley Insight, an operator-provisioned closed beta. This policy explains what data we collect through the platform, how we use it, who we share it with, and how long we keep it. Last updated August 5, 2026.

1. Who We Are

LumaNavi LLC (“Brinley,” “we,” “us,” or “our”) operates Brinley Insight. For the purposes of applicable data protection laws, LumaNavi LLC is the data controller for the personal data described in this policy.

2. What Data We Collect

We collect the following categories of personal data through your use of Brinley Insight:

• Account data. Name, email address, and password (stored as a secure hash) for your account.
• Connected-account tokens. When your organization connects a data source, we store an authorization token that lets us retrieve data on your behalf. Connected sources are: Google Business Profile, Google Business Profile Performance, Google Reviews, Google Local Services Ads, Google Analytics (GA4), Google Search Console, Yelp, and Microsoft Clarity.
• Lead and review data. Leads and customer reviews pulled from your connected sources, or submitted to us directly through an inbound Zapier connection you configure.
• Marketing and performance metrics. Impressions, clicks, visits, conversions, ratings, and similar metrics retrieved from your connected sources.
• Derived intelligence. Insights and recommendations we generate from the data above.
• Audit records. A record of account and data-governance actions (such as sign-ins, connection changes, and data-rights request activity), kept as immutable evidence.

3. How We Use Your Data

We use your data to:

• Operate and deliver the Brinley Insight platform and its features
• Generate the insights, dashboards, and recommendations the platform provides
• Monitor the security and integrity of the platform
• Respond to identity-verified data-rights requests
• Respond to support requests from your account administrator

We do not use your data to train AI models, build advertising profiles, or sell it to any third party.

4. Who We Share Your Data With

We do not sell your data, and we do not share it with third parties for behavioral advertising. We share data only with the service providers necessary to operate the platform:

• Supabase — database hosting.
• Vercel — application hosting.
• Google — account sign-in, and the Google Business Profile, GA4, Search Console, Local Services Ads, and Google Reviews connectors, when you connect them.
• Yelp — when you connect a Yelp source.
• Microsoft Clarity — when you connect a Clarity source.
• Zapier — only if your organization configures an inbound connection to send lead data to us; we do not send data to Zapier.

We are formalizing data processing terms with each of these providers; this list will be updated as that work completes.

5. We Do Not Sell Your Data

Brinley does not sell, rent, or otherwise make your personal data available to any third party for monetary or other valuable consideration.

6. No Behavioral Advertising or Third-Party Analytics

Brinley does not embed third-party advertising, analytics, or tracking SDKs in the Brinley Insight application, and does not use your data for cross-context behavioral advertising.

7. Your Rights

Depending on your location, you may have rights regarding your personal data, including access, deletion, correction, and portability. To exercise any of these rights, contact your account administrator, who can submit and track a request through the platform's data-rights workflow. Every request is identity-verified and reviewed before any data is deleted, and an active legal hold takes precedence over any deletion request. Account and audit records are deliberately kept so that we can evidence what was deleted and meet our legal-hold and record-keeping obligations.

7A. California Consumer Privacy Rights

If you are a California resident, the CCPA (as amended by the CPRA) gives you the right to know what personal information we collect, the right to delete it (subject to legal retention requirements), the right to correct it, the right to data portability, and the right to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, the opt-out right is honored automatically — no action is required. We do not discriminate against anyone for exercising these rights.

8. Data Retention

If your organization ends its subscription to Brinley Insight or its account is closed, our policy is that your data remains available for export for 30 days after that cancellation or closure, and is deleted after that window. This 30-day rule applies specifically to subscription cancellation or account closure — it is not a general or standing deletion schedule for data while your account remains active. We are still building automated enforcement of this window; until that is complete, cancellation-related deletion is carried out through our reviewed data-rights process (see “Your Rights” above), and you may contact your account administrator to confirm status at any time. Separately, you may submit an identity-verified data-rights request at any time, which is reviewed and, once approved, results in deletion or export of the relevant data (see “Your Rights” above). Certain records may be retained longer where required by law (for example, billing records for tax compliance), and records preserved under an active legal hold are retained until that hold is released, regardless of any other timeline in this section.

9. Changes to This Policy

We will provide reasonable advance notice of material changes to this policy through your account administrator. The “Last updated” date above reflects the most recent revision.

10. Contact

Invited participants can contact their account administrator with privacy questions or to submit a data-rights request about their beta account.

Last updated: August 5, 2026