Privacy Policy

1. Scope and Controller

Brook Giving LLC is the data controller for personal information processed through the Services, except where a payment processor or other service provider processes information solely on our instructions as a processor. This Privacy Policy applies to information we collect through the Platform, support channels, and related communications. It does not apply to third-party websites, payment processors' standalone privacy practices, or group content that other users choose to make visible within the Platform.

2. Information We Collect

We collect information in the categories below, depending on how you use the Services:

• Account and profile information: name, email address, authentication identifiers, profile photo, notification preferences, and similar information you provide when registering or updating your account.
• Group and fund information: group or fund names, descriptions, images, membership and roles, invitations, contribution and spending activity, fund settings, visibility preferences, notes, and other content you or other members submit in connection with a group or fund.
• Financial and transaction information: contribution amounts, fund balances, spending activity, card metadata (such as last four digits and card status), and related records. Payment card numbers and bank credentials are collected and processed by our payment processors, not stored directly by Brook in full form.
• Identity and verification information: information required for fraud prevention, sanctions screening, or account verification, which may be collected by us or our processors.
• Shipping and fulfillment information: mailing address and related details if you request a physical card or similar fulfillment.
• Device, usage, and analytics information: session identifiers, pages or screens viewed, buttons clicked, referring URLs, timestamps, and similar product-usage data collected through our first-party analytics when you use the application.
• Communications: messages you send to us (including support form submissions and emails) and transactional emails we send regarding account activity, invitations, deposits, spending, and security.
• Public or shared content: information you or your group choose to display to other users, followers, or invitees according to your visibility settings.

3. Sources of Information

We collect information from:

• You directly, when you register, create or join groups or funds, contribute, spend, update settings, upload content, or contact us.
• Your use of the Services, including through cookies or similar technologies on the application and automated logging of product events.
• Payment and financial infrastructure providers (such as payment processors and card program providers) for transaction status, fraud signals, and compliance-related data.
• Service providers that host, authenticate, email, or support our operations.
• Other users, when they invite you, contribute to your fund, or interact with content you publish on the Platform.

4. How We Use Information

We use personal information to:

• Provide, operate, maintain, and improve the Services, including group and fund functionality, contributions, spending controls, notifications, and customer support.
• Authenticate users, secure accounts, detect and prevent fraud, abuse, and unauthorized access, and enforce our Terms of Service.
• Comply with legal, regulatory, tax, anti-money-laundering, sanctions, and law-enforcement obligations.
• Process transactions through third-party processors and card program providers.
• Communicate with you about the Services, including transactional messages and responses to inquiries.
• Analyze usage trends and product performance using first-party analytics to improve reliability and user experience.
• Protect the rights, property, and safety of Brook, our users, and others.

We may use aggregated or de-identified information for any lawful purpose. We do not use automated decision-making that produces legal or similarly significant effects without appropriate notice where required by law.

5. How We Share and Disclose Information

We may disclose personal information as follows:

• Service providers and processors under contract, including payment processors (e.g., Stripe), card and spend program providers (e.g., Ramp), cloud hosting and authentication providers (e.g., Amazon Web Services / AWS Cognito), email delivery providers, and vendors that help us operate, secure, and support the Platform.
• Banking and program partners involved in holding or moving funds in connection with the Services, as necessary to provide financial features you request.
• Other users, according to your and your group's visibility, sharing, and invitation settings.
• Affiliates or successors in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to customary confidentiality obligations.
• Law enforcement, regulators, courts, or other parties when we believe disclosure is required by law, subpoena, or legal process, or necessary to protect rights, safety, and security.
• With your direction or consent.

We do not "sell" personal information as that term is defined under the California Consumer Privacy Act (CCPA/CPRA). We do not share personal information for cross-context behavioral advertising.

6. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of certain personal information, and to opt out of certain processing. California residents may have additional rights under the CCPA/CPRA. Texas residents may have rights under applicable Texas privacy laws, including the Texas Data Privacy and Security Act (TDPSA), where applicable.

You may also:

• Update account and notification preferences in the application where available.
• Adjust certain fund or group visibility settings within the Platform.
• Unsubscribe from non-essential marketing emails using the link in those messages, if any.
• Contact us to submit a privacy request using the contact information below.

We may need to verify your identity before fulfilling a request. We may deny or limit requests where permitted by law, including where information must be retained for legal, security, or financial-recordkeeping obligations.

7. Security

We use technical and organizational measures designed to protect personal information appropriate to a financial services platform, including access controls, encryption in transit, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your email account and device access used to authenticate to Brook.

8. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Services, and for additional periods required or permitted by law. Financial, transaction, and compliance-related records may be retained for longer periods to meet regulatory, tax, audit, fraud-prevention, and dispute-resolution requirements. When retention is no longer necessary, we may delete or de-identify information.

9. Cookies, Tracking, and Analytics

The Brook application uses first-party analytics to understand product usage (such as page views, feature interactions, and session identifiers stored in your browser). Our public marketing website is largely static and does not use the same in-app analytics system. Third-party services linked from the Platform (such as support forms or payment flows) may use their own cookies or tracking technologies under their separate policies.

10. Children's Privacy

The Services are not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete it. If you believe a minor has provided us information, contact us using the information below.

11. International Users

Brook is based in the United States and intended primarily for U.S. users. If you access the Services from outside the United States, you understand that your information may be processed and stored in the United States and other countries where we or our service providers operate, which may have different data protection laws than your jurisdiction.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Services, by email, or by other reasonable means. The "Effective Date" at the top indicates when this Privacy Policy was last revised. Continued use of the Services after changes become effective constitutes acceptance of the updated Privacy Policy, to the extent permitted by law.