Brass Monkey Labs — Privacy Policy

---

Quick Reference Summary

This summary is provided for convenience and is not a substitute for the full policy below.

---

1. Introduction and Scope

Brass Monkey Labs [LLC / Inc.] (“Brass Monkey Labs,” “we,” “us,” or “our“) provides analytics, reporting, and marketing-dashboard software, including our dashboarding platform (the “Platform“), together with our websites, mobile and desktop applications, APIs, integrations, and related professional services (collectively, the “Services“).

This Privacy Policy (“Policy“) explains how we collect, use, disclose, retain, and safeguard personal information, and describes the rights and choices available to individuals.

1.1 Who This Policy Covers

This Policy applies to:

• Website Visitors — individuals who visit brassmonkey.ai or our other web properties.
• Prospects and Contacts — individuals who contact us, request a demo, subscribe to communications, or attend our events.
• Customers and Authorized Users — organizations that subscribe to the Services and the individuals they authorize to access them.
• Applicants and Personnel — individuals who apply for roles with us, to the extent described in Section 20.
• End Users of Customer Dashboards — individuals who view reports or dashboards shared by a Customer, to the extent described in Section 5.

1.2 What This Policy Does Not Cover

• Customer Data processed on behalf of our Customers. See Section 3.
• Third-party platforms and services (e.g., Google, LinkedIn, TikTok, Meta, HubSpot). Their handling of your information is governed by their own policies.
• Customer websites and properties from which our Customers may collect data.
• Employment relationships, which are governed by our internal HR privacy notice.

---

2. Definitions

---

3. Our Role: Controller vs. Processor

Our obligations depend on the context in which we handle personal information.

3.1 We Act as a Processor / Service Provider

When we process Customer Data — including data retrieved from Connected Platforms at a Customer’s direction and displayed in dashboards and reports — we act as a Processor (GDPR), Service Provider (CCPA/CPRA), and equivalent role under other laws.

In this role:

• We process Customer Data only on the documented instructions of the Customer, as set out in our Data Processing Addendum (DPA) and the applicable agreement.
• We do not sell, rent, or share Customer Data.
• We do not retain, use, or disclose Customer Data for any purpose other than performing the Services, and specifically not for our own commercial purposes or “cross-context behavioral advertising.”
• We do not combine Customer Data with personal information received from other sources, except as permitted by CCPA §7050(a) (e.g., to detect security incidents).
• The Customer is the Controller and is responsible for the lawfulness of its instructions, for establishing a legal basis, and for responding to data subject requests. We assist as described in Section 12.4.

If you are an individual whose data appears in a Brass Monkey Labs dashboard because a company uses our Services, that company — not Brass Monkey Labs — is the Controller. Please direct your requests to them. We will refer you to the relevant Customer if you contact us directly.

3.2 We Act as a Controller / Business

We act as a Controller with respect to:

• Website visitor and marketing data
• Account registration, billing, and administration data
• Support communications
• Product telemetry and usage analytics about how the Services are used (Section 6.4)
• Security, fraud-prevention, and audit logs
• Recruiting and applicant data

3.3 Independent Controllers

Where we and another party each independently determine purposes and means (e.g., a co-hosted webinar with a partner), each party is an independent Controller for its own processing, and we will identify this at the point of collection.

---

4. Information We Collect

4.1 Information You Provide Directly

4.2 Information Collected Automatically

4.3 Information from Connected Platforms

At the direction and with the authorization of a Customer, we retrieve data from Connected Platforms. This is Customer Data and we act as a Processor. See Section 5 for platform-specific terms.

Typical categories retrieved include:

• Advertising performance data — campaign, ad group, ad, and keyword names; impressions, clicks, spend, conversions, ROAS, CPC, CPM
• Analytics data — sessions, users, pageviews, bounce rate, goal completions, channel and source/medium groupings
• Organic social data — post engagement, follower counts, reach, impressions
• CRM and pipeline data — where the Customer connects a CRM: deal stages, values, and (where present) contact-level records
• Account metadata — the connected account ID, account name, currency, and time zone
• Authorization tokens — OAuth access and refresh tokens, stored encrypted (Section 11.3)

Data minimization commitment: We request only the minimum API scopes required to deliver the reporting functionality a Customer has configured. Where a Connected Platform offers a read-only or reporting-only scope, we request that scope rather than a broader one. A current, per-platform list of the scopes we request and the reason for each is published at [https://brassmonkey.ai/scopes].

4.4 Information from Third-Party Sources

Where we obtain data from a third-party source and applicable law requires it, we provide notice at or before first use and honor any objection.

4.5 Sensitive Personal Information

We do not intentionally collect Sensitive Personal Information, and we ask that you not submit it to us.

The only categories we may process are:

• Account log-in credentials (email + password/MFA), which are treated as sensitive under the CPRA but are used solely to authenticate you and secure your account.
• Government identifiers (e.g., tax ID) where required for billing or, in the government-contracting context, where required for personnel vetting under Section 19.

We do not use or disclose Sensitive Personal Information for purposes other than those permitted by CCPA §7027(m). Accordingly, we are not required to offer, and do not offer, a separate “Limit the Use of My Sensitive Personal Information” control — but you may still exercise all rights in Section 12.

If a Customer configures the Services in a way that causes Sensitive Personal Information to be ingested, the Customer is solely responsible for the lawfulness of that processing and must first execute our DPA and notify us so appropriate controls can be applied.

4.6 Children’s Privacy

The Services are business tools intended solely for organizations and individuals aged 18 or older. They are not directed to children.

• We do not knowingly collect personal information from anyone under 18.
• We do not knowingly sell or share the personal information of consumers under 16 (we do not sell or share any personal information at all).
• We do not knowingly collect personal information from children under 13 as defined by COPPA.
• If we learn we have collected such information, we will delete it promptly. Contact privacy@brassmonkey.ai to report a concern.

Customers are contractually prohibited from using the Services to process data knowingly collected from children under 13, or from students in a K–12 context, without a separate written agreement.

---

5. Third-Party Platform Data — Specific Disclosures

This section contains disclosures required by specific Connected Platforms. It applies in addition to, and does not limit, the rest of this Policy.

5.1 Google API Services — Limited Use Disclosure

Brass Monkey Labs’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, with respect to data obtained through Google APIs (including Google Ads API, Google Analytics Data API, Google Search Console API, Google Business Profile API, and Google Sheets/Drive APIs where connected):

1. Limited purpose. We use Google user data only to provide and improve user-facing features that are prominent in the Services — namely, retrieving advertising and analytics metrics to populate the dashboards and reports a Customer has configured.
2. No transfer. We do not transfer Google user data to others except (a) as necessary to provide or improve those user-facing features, (b) for security purposes, (c) to comply with applicable law, or (d) as part of a merger, acquisition, or sale of assets with prior notice and consent as required.
3. No advertising. We do not use or transfer Google user data for serving advertising, including retargeting, personalized advertising, or interest-based advertising.
4. No sale. We do not sell Google user data.
5. No AI/ML training. We do not use Google user data to develop, train, retrain, or fine-tune generative AI or machine learning models.
6. No human reading. We do not allow humans to read Google user data except: (a) with the affirmative agreement of the Customer for specific messages or data; (b) where necessary for security purposes such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and de-identified for internal operations in accordance with applicable privacy requirements.
7. Google Ads API. Our use of the Google Ads API is additionally governed by the Google Ads API Terms and Conditions and Required Minimum Functionality standards.
8. Google Analytics. Where a Customer connects Google Analytics, our processing is subject to the Google Analytics Terms of Service and the Google Measurement Controller-Controller / Processor Terms as applicable.
9. Revocation. A Customer may revoke our access at any time via https://myaccount.google.com/permissions or by disconnecting the integration in the Platform. Revocation stops future retrieval; previously retrieved data is deleted per Section 10.

5.2 LinkedIn Marketing API

Where a Customer connects LinkedIn:

• We access LinkedIn data solely through the LinkedIn Marketing Developer Platform under the applicable LinkedIn API Terms of Use and Marketing Developer Platform program terms.
• We request only reporting-related scopes (e.g., r_ads_reporting, r_organization_social, r_basicprofile for authentication) required to populate the Customer’s configured reports. [ADJUST TO ACTUAL SCOPES]
• We use LinkedIn data only to display metrics to the authorizing Customer. We do not use it to build or enrich independent profiles of LinkedIn members, to create or supplement a marketing database, to sell or license it, to train AI models, or for advertising targeting.
• We do not scrape LinkedIn or access LinkedIn data by any means other than the official API.
• We store LinkedIn data only for the retention periods in Section 10 and delete it upon disconnection or termination.
• Access may be revoked at any time by disconnecting the integration or via the member’s LinkedIn account settings.

5.3 TikTok Marketing API

Where a Customer connects TikTok:

• We access TikTok data solely through the TikTok Marketing API / TikTok for Business platform under the applicable TikTok Developer Terms of Service and Business Products Terms.
• We access advertising performance and account metadata only, at the direction of the authorizing advertiser.
• We do not use TikTok data for advertising targeting, model training, resale, or any purpose other than displaying metrics to the authorizing Customer.
• We do not attempt to identify individual TikTok users from advertising data.
• Access may be revoked at any time by disconnecting the integration or via TikTok Business Center settings.

5.4 Meta (Facebook / Instagram) Marketing API

Where a Customer connects Meta, we comply with the Meta Platform Terms and Developer Policies, access only Ads Insights and Page Insights data required for reporting, use it only to display metrics to the authorizing Customer, and delete it upon disconnection or per Section 10.

5.5 Other Integrations

A current list of all available integrations, the scopes requested, and the data retrieved is maintained at [https://brassmonkey.ai/integrations].

5.6 Cross-Platform Commitments

For all Connected Platforms, Brass Monkey Labs commits that we will not:

• Sell, license, or lease platform data
• Use platform data for advertising or ad targeting
• Use platform data to train or improve AI/ML models
• Build standalone profiles of individuals from platform data
• Combine platform data across Customers, except to produce aggregated and de-identified statistics that cannot reasonably be re-identified and from which no individual Customer or individual is identifiable
• Transfer platform data to any data broker
• Retain platform data after the Customer disconnects the integration, beyond the windows in Section 10

---

6. How We Use Information and Our Legal Bases

For individuals in the EEA, UK, Switzerland, and other jurisdictions requiring a legal basis, the table below identifies our basis under GDPR Article 6.

6.1 Providing the Services

6.2 Security, Fraud Prevention, and Compliance

6.3 Marketing and Communications

6.4 Product Improvement and Analytics

Important limitation: Product improvement uses telemetry about how the Services are used, not the contents of Customer Data or Connected Platform data. We do not mine Customer Data for our own product or commercial purposes.

6.5 De-Identified and Aggregated Data

Where we create de-identified or aggregated data, we commit to:

1. Take reasonable measures to ensure the information cannot be associated with an individual, household, or Customer;
2. Publicly commit to maintain and use it in de-identified form and not attempt re-identification (except to test the de-identification, as permitted by law); and
3. Contractually obligate any recipient to the same commitments.

6.6 Artificial Intelligence

We do not use Customer Data or Connected Platform data to train, retrain, or fine-tune any generative AI or machine-learning model, whether ours or a third party’s.

Where the Services include AI-assisted features (e.g., [natural-language report summaries]):

• Processing is performed [in-region / by the subprocessor identified in our subprocessor list] under a zero-retention configuration where offered by the provider.
• Inputs and outputs are not used by the provider to train its models.
• The feature is [opt-in at the Customer level / configurable by the Customer’s administrator].
• Outputs are advisory and are not used for automated decisions with legal or similarly significant effects (Section 15).

6.7 New Purposes

If we intend to process personal information for a purpose not described here, we will update this Policy and, where required, provide notice and obtain consent before doing so.

---

7. Cookies and Similar Technologies

7.1 Categories

We do not deploy advertising or analytics cookies inside the authenticated Platform application — only strictly necessary and functional cookies operate there. Advertising and analytics technologies are limited to our public marketing website.

7.2 Managing Cookies

• Consent Manager: Adjust preferences at any time via the “Cookie Settings” link in our website footer, powered by [CMP NAME]. In the EEA/UK, non-essential cookies are set only after opt-in consent, and rejecting is as easy as accepting.
• Browser controls: Most browsers allow you to block or delete cookies. Blocking strictly necessary cookies may break the Services.
• Global Privacy Control (GPC): We honor GPC and similar opt-out preference signals as a valid opt-out of sale/sharing and targeted advertising in jurisdictions where required, and we honor it globally as a matter of practice.
• Do Not Track: There is no industry consensus on DNT; we do not respond to DNT headers, but we do honor GPC.

7.3 Cookie Inventory

A complete, current inventory of cookies and similar technologies — including name, provider, purpose, type, and duration — is maintained in our Cookie Policy, which is incorporated into this Policy by reference and updated automatically by our consent management platform.

---

8. How We Disclose Information

We do not sell or rent personal information. We have not sold or shared personal information in the preceding 12 months, and we do not sell or share the personal information of consumers we know to be under 16.

8.1 Subprocessors and Service Providers

We disclose personal information to vendors who process it on our behalf, under written contracts that (a) limit them to our documented instructions, (b) prohibit use for their own purposes, (c) impose confidentiality obligations, (d) require appropriate technical and organizational measures, and (e) include the terms required by CCPA §7051, GDPR Art. 28, and applicable transfer mechanisms.

Representative categories:

A current, itemized list of Subprocessors — including entity name, function, and processing location — is published at [https://brassmonkey.ai/subprocessors]. Customers may subscribe there to receive at least [30] days’ advance notice of any new or replacement Subprocessor and may object on reasonable data-protection grounds as set out in the DPA.

8.2 Within Brass Monkey Labs

We disclose personal information to our personnel and affiliates only on a need-to-know basis, under role-based access controls, confidentiality obligations, and background screening where permitted by law.

8.3 Business Transfers

In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred, subject to (a) confidentiality protections during diligence, (b) the successor being bound by commitments no less protective than this Policy, and (c) notice to affected individuals where required. Where the transfer would materially change how data is used, we will provide notice and, where required, obtain consent. Google user data will be transferred only with prior notice and consent where required by the Google API Services User Data Policy.

8.4 Legal, Safety, and Government Disclosures

We may disclose information where we have a good-faith belief it is reasonably necessary to:

• Comply with a valid, binding, and lawful subpoena, warrant, court order, or other legal process;
• Comply with an applicable law, regulation, or government contract requirement;
• Enforce our agreements or investigate violations;
• Detect, prevent, or address fraud, security, or technical issues;
• Protect the rights, property, or safety of Brass Monkey Labs, our users, or the public, including in an emergency involving danger of death or serious physical injury.

Government Request Commitments. Consistent with the standards expected under GDPR Article 48, the EU–U.S. Data Privacy Framework, and Schrems II:

1. We carefully review the legality and scope of every government request and reject those that are overbroad, procedurally defective, or unlawful.
2. Unless legally prohibited or where there is a risk to life, we notify the affected Customer before disclosure and give them a reasonable opportunity to seek protective relief.
3. We challenge requests we believe are unlawful, including gag orders, and seek to narrow overbroad demands.
4. We do not provide any government with direct, back-door, or bulk access to our systems, Customer Data, or encryption keys.
5. We redirect requests for Customer Data to the Customer wherever legally permissible.
6. We publish a Transparency Report at least annually, including aggregate counts of requests received, complied with, and challenged, to the extent permitted by law.

8.5 Publicly Shared Dashboards

If a Customer configures a dashboard as publicly accessible (e.g., via a public share link), the contents of that dashboard become available to anyone with the link. The Customer controls this setting and is responsible for the consequences of enabling it. We provide password protection, link expiration, and IP allowlisting as optional controls but do not enable them by default.

8.6 What We Never Do

We do not disclose personal information to data brokers, advertising networks (beyond the marketing-site cookies described in Section 7), or AI model developers for training purposes.

---

9. International Data Transfers

9.1 Where Data Is Processed

Our primary infrastructure is located in [the United States, in AWS region us-east-1]. Subprocessors may process data in [list: United States, European Union, Canada, …]. The processing location of each Subprocessor is identified at [https://brassmonkey.ai/subprocessors].

Regional data residency: [Eligible Customers may elect EU-region data residency, under which Customer Data is stored and processed within the EEA. / Regional residency is available on [PLAN] plans. Contact sales@brassmonkey.ai.] For U.S. government engagements, see Section 19.

9.2 Transfer Mechanisms

Where we transfer personal data out of the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on one or more of:

• EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Modules as applicable, incorporated into our DPA;
• UK International Data Transfer Addendum to the EU SCCs, or the UK IDTA;
• Swiss addendum to the SCCs, recognizing the FDPIC;
• Adequacy decisions, where applicable;
• [EU–U.S. Data Privacy Framework, UK Extension, and Swiss–U.S. DPF] — [Brass Monkey Labs [is / is not] currently self-certified. If self-certified, add: Our certification is viewable at https://www.dataprivacyframework.gov/list. We commit to the DPF Principles, are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission, and provide the independent recourse mechanism and binding arbitration described in Section 16.3.]

9.3 Transfer Impact Assessments

We conduct and document Transfer Impact Assessments evaluating the legal regime of each destination country, the sensitivity and volume of data, and the likelihood of government access, and we apply supplementary measures including encryption in transit and at rest, key management under our sole control, data minimization, and the government-request commitments in Section 8.4. TIAs are available to Customers on request under NDA.

9.4 Copies

Customers may request a copy of the SCCs (with commercially sensitive terms redacted) by contacting privacy@brassmonkey.ai.

---

10. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law. Retention is governed by our internal Records Retention Schedule; the table below reflects current defaults.

Deletion method: Deletion is performed via cryptographic erasure and/or secure overwrite consistent with NIST SP 800-88 Rev. 1 media sanitization guidelines. Certificates of destruction are available on request for government and enterprise Customers.

---

11. Information Security

We maintain a written Information Security Program with administrative, technical, and physical safeguards appropriate to the nature, scope, context, and purposes of processing and the risks to individuals, aligned to [ISO/IEC 27001 / NIST Cybersecurity Framework 2.0 / NIST SP 800-53 Rev. 5 / SOC 2 Trust Services Criteria].

11.1 Certifications and Assessments

Current attestations and our security whitepaper are available at [https://brassmonkey.ai/security]

11.2 Technical Measures

• Encryption in transit: TLS 1.2+ (TLS 1.3 preferred) for all external connections; HSTS enforced.
• Encryption at rest: AES-256 for databases, object storage, and backups.
• Key management: Keys managed in [AWS KMS / HSM] with documented rotation; keys are not accessible to Subprocessors.
• Network: Segmentation, private subnets, WAF, DDoS protection, IDS/IPS, default-deny egress.
• Application: Secure SDLC, mandatory peer code review, SAST/DAST, dependency and container scanning, secrets scanning.
• Vulnerability management: Continuous scanning; remediation SLAs of [Critical: 7 days / High: 30 days / Medium: 90 days].
• Logging: Centralized, tamper-resistant audit logging with time synchronization.
• Backups: Encrypted, tested via periodic restore exercises.
• Multi-tenancy: Logical isolation of Customer Data with tenant-scoped access enforcement at the data layer.

11.3 Credential and Token Handling

• Passwords are stored as salted hashes using [bcrypt / Argon2id]; we never store plaintext passwords.
• OAuth access and refresh tokens for Connected Platforms are encrypted at rest with envelope encryption, stored separately from application data, accessible only to the service processes that require them, and never logged.
• MFA is available to all users and [required / strongly recommended] for administrators.
• SSO/SAML and SCIM provisioning are available on [PLAN] plans.

11.4 Administrative Measures

• Role-based access control on a least-privilege, need-to-know basis; access reviewed at least [quarterly] and revoked within [24 hours] of role change or termination.
• Background checks on personnel with access to production, where permitted by law.
• Mandatory security and privacy training at onboarding and annually.
• Confidentiality agreements for all personnel and contractors.
• Vendor risk assessment before onboarding any Subprocessor and periodically thereafter.
• Documented change management, business continuity, and disaster recovery plans, tested at least annually. Target [RTO: X hours / RPO: Y hours].

11.5 Physical Measures

Production infrastructure is hosted in [AWS] data centers with 24/7 physical security, biometric access controls, and environmental protections, audited under SOC 2 / ISO 27001. Brass Monkey Labs personnel have no physical access to these facilities.

11.6 Incident Response and Breach Notification

We maintain a documented Incident Response Plan that is tested at least annually. In the event of a personal data breach:

Notifications will describe the nature of the incident, categories and approximate numbers of records affected, likely consequences, measures taken and proposed, and a point of contact. We will cooperate with Customers’ own notification obligations and preserve forensic evidence.

11.7 Limitations

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. Please use a strong, unique password, enable MFA, and notify us immediately at security@brassmonkey.ai if you suspect unauthorized access.

11.8 Responsible Disclosure

We welcome security research. Report vulnerabilities to security@brassmonkey.ai. Our policy and safe-harbor terms are at [https://brassmonkey.ai/security/disclosure] or /.well-known/security.txt. We commit not to pursue legal action against researchers acting in good faith within that policy.

---

12. Your Privacy Rights

12.1 Rights Available

Subject to applicable law and verification, you may have the right to:

12.2 How to Exercise

• Email: privacy@brassmonkey.ai
• Web form: [https://brassmonkey.ai/privacy-request]
• Toll-free: (877) 527-2823
• Mail: Brass Monkey Labs, Attn: Privacy, 3350 Riverwood Pkwy, Suite 1900, Atlanta, Georgia 30339, United States
• In-product: Account Settings → Privacy

12.3 Verification and Response

• We verify requests by matching identifying information you provide against our records. For account holders, we may require you to authenticate to your account. For sensitive requests, we may require additional verification proportionate to the risk.
• We respond within 45 days (CCPA and most U.S. state laws), extendable by an additional 45 days with notice; one month under GDPR, extendable by two months for complex requests with notice.
• Requests are free, unless manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline, with an explanation.
• Authorized agents may submit requests on your behalf with valid written authorization or a power of attorney; we may still require you to verify your identity directly and confirm the authorization.

12.4 Requests Concerning Customer Data

If your request concerns data we process as a Processor on behalf of a Customer, we will promptly forward the request to the relevant Customer and assist them in responding, but we will not act on it directly without the Customer’s instruction. Please contact the Customer (the organization whose dashboard or report contains your data) directly.

12.5 Appeals

If we deny your request, you may appeal by emailing privacy@brassmonkey.ai with the subject line “Privacy Request Appeal” and your original request reference. We will respond within 45 days (or 60 days in Colorado and Virginia) with a written explanation. If your appeal is denied, we will provide a method to contact your state Attorney General.

---

13. U.S. State Privacy Disclosures

13.1 California (CCPA/CPRA)

Notice at Collection. In the preceding 12 months, we have collected the following categories of personal information as defined by Cal. Civ. Code §1798.140(v):

Retention: See Section 10.

Statements required by the CCPA:

• We do not sell personal information and have not done so in the preceding 12 months.
• We do not share personal information for cross-context behavioral advertising as defined by the CPRA.
• We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.
• We use and disclose Sensitive Personal Information only for the purposes permitted by CCPA Regulation §7027(m).
• We have not offered any financial incentive or price/service difference in exchange for personal information.
• We honor Global Privacy Control signals.

Shine the Light (Cal. Civ. Code §1798.83): We do not disclose personal information to third parties for their own direct marketing purposes.

California minors (Cal. Bus. & Prof. Code §22581): The Services are not directed to minors; nonetheless, a registered user under 18 may request removal of content they posted by contacting privacy@brassmonkey.ai.

13.2 Other U.S. States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws as they take effect, have the rights described in Section 12.

Additional statements:

• We do not sell personal data as defined under these laws, do not process personal data for targeted advertising, and do not engage in profiling in furtherance of decisions producing legal or similarly significant effects. Accordingly, no opt-out is required for these activities, but we honor opt-out preference signals including GPC.
• Consent for sensitive data: We do not process sensitive data as defined by these laws without consent. See Section 4.5.
• Data Protection Assessments: We conduct and document assessments for processing activities that present a heightened risk of harm, as required by CO, CT, VA, TX, OR, MN, and others, and make them available to regulators on request.
• Universal opt-out mechanisms: Recognized in Colorado, Connecticut, Texas, Montana, Oregon, New Jersey, Delaware, Nebraska, New Hampshire, and Minnesota — we honor them.
• Minnesota residents additionally have the right to obtain a list of the specific third parties to which we have disclosed their personal data, and to question the result of profiling.
• Oregon residents additionally have the right to obtain a list of specific third parties to which we have disclosed personal data.

13.3 Nevada

Nevada residents may submit a verified request to opt out of the future sale of covered information under NRS 603A. We do not sell covered information. To submit a request regardless, email privacy@brassmonkey.ai.

13.4 Washington My Health My Data / Nevada SB 370

We do not collect, process, or share “consumer health data” as defined by the Washington My Health My Data Act, the Nevada health data law, or the Connecticut health-data amendments. If you believe we have, contact privacy@brassmonkey.ai.

13.5 Illinois BIPA

We do not collect, capture, or store biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act.

---

14. International Privacy Disclosures

14.1 EEA / United Kingdom / Switzerland

• Controller identity: Brass Monkey Labs [entity], 3350 Riverwood Pkwy, Suite 1900, Atlanta, Georgia 30339, United States.
• Data Protection Officer: Bill Hall — privacy@brassmonkey.ai.
• EU Representative (GDPR Art. 27): [Name, address, email] — [REQUIRED if you have no EU establishment and offer services to EU individuals].
• UK Representative (UK GDPR Art. 27): [Name, address, email] — [REQUIRED if you have no UK establishment and offer services to UK individuals].
• Legal bases: Section 6.
• Transfers: Section 9.
• Right to complain: Section 16.
• Legitimate interests balancing tests are documented and available on request.

14.2 Canada (PIPEDA / Law 25)

• We obtain consent as required and identify purposes at or before collection.
• Quebec Law 25: Our Privacy Officer is Bill Hall, reachable at privacy@brassmonkey.ai. We conduct Privacy Impact Assessments for projects involving personal information and before transferring personal information outside Quebec. Quebec residents have rights of access, correction, de-indexing, and data portability, and the right to be informed when a decision is based exclusively on automated processing.
• CASL: Commercial electronic messages are sent only with express or implied consent and include an unsubscribe mechanism and our identity and contact information.

14.3 Brazil (LGPD)

Individuals in Brazil have rights of confirmation, access, correction, anonymization/blocking/deletion of unnecessary or unlawfully processed data, portability, information about sharing, information about the consequences of refusing consent, revocation of consent, and review of automated decisions. Our LGPD contact (“Encarregado”) is Bill Hall at privacy@brassmonkey.ai. Transfers out of Brazil rely on standard contractual clauses or the individual’s consent, as applicable.

14.4 Australia (Privacy Act / APPs)

We handle personal information in accordance with the Australian Privacy Principles. You may complain to us at privacy@brassmonkey.ai and, if unsatisfied, to the Office of the Australian Information Commissioner (oaic.gov.au). Notifiable data breaches are reported to the OAIC as required.

14.5 Japan (APPI), South Korea (PIPA), and Other Jurisdictions

We comply with applicable local requirements, including notice, consent, and cross-border transfer obligations. Contact privacy@brassmonkey.ai for jurisdiction-specific information.

---

15. Automated Decision-Making and Profiling

We do not engage in automated decision-making that produces legal or similarly significant effects concerning individuals, and we do not conduct profiling in furtherance of such decisions.

We do use automated processing for:

• Security and fraud detection — e.g., flagging anomalous log-ins or abusive API usage. Adverse outcomes (such as account suspension) are subject to human review and appeal at security@brassmonkey.ai.
• Rate limiting and abuse prevention — technical measures not directed at individuals.
• Marketing segmentation — grouping business contacts by industry or company size, with no legal or significant effect; you may opt out of marketing at any time.
• [AI-assisted report summaries] — advisory outputs only; a human always decides what to do with them.

Where a Customer uses our dashboards to inform its own decisions, the Customer is responsible for those decisions and for any resulting obligations.

---

16. Complaints, Recourse, and Dispute Resolution

16.1 Contact Us First

We prefer to resolve concerns directly. Contact privacy@brassmonkey.ai and we will acknowledge within [5] business days and respond substantively within [30] days.

16.2 Supervisory Authorities

• EEA: You may lodge a complaint with the supervisory authority in your Member State of habitual residence, place of work, or place of the alleged infringement. A list is available at edpb.europa.eu. Our lead supervisory authority is [AUTHORITY, if applicable].
• UK: Information Commissioner’s Office — ico.org.uk — 0303 123 1113.
• Switzerland: Federal Data Protection and Information Commissioner — edoeb.admin.ch.
• Canada: Office of the Privacy Commissioner — priv.gc.ca. Quebec: Commission d’accès à l’information.
• U.S.: Your State Attorney General; the California Privacy Protection Agency (cppa.ca.gov); the Federal Trade Commission (ftc.gov).
• Brazil: Autoridade Nacional de Proteção de Dados — gov.br/anpd.
• Australia: OAIC — oaic.gov.au.

16.3 Data Privacy Framework Recourse

In compliance with the EU–U.S. DPF, the UK Extension, and the Swiss–U.S. DPF, Brass Monkey Labs commits to resolve DPF Principles-related complaints. EU, UK, and Swiss individuals with inquiries or complaints should first contact privacy@brassmonkey.ai.

---

17. Accessibility

We are committed to making this Policy accessible. This Policy is designed to conform to WCAG 2.1 Level AA and, for U.S. federal engagements, Section 508 of the Rehabilitation Act (29 U.S.C. §794d). Our Accessibility Conformance Report (VPAT® 2.5) for the Services is available at [https://brassmonkey.ai/accessibility]. If you need this Policy in an alternative format — large print, plain text, or screen-reader-optimized — contact privacy@brassmonkey.ai and we will provide it at no charge.

---

18. Data Processing Addendum

Customers subject to the GDPR, UK GDPR, CCPA, or comparable laws may execute our Data Processing Addendum, which is incorporated into the Terms of Service by reference and includes:

• Art. 28 processing terms, subject matter, duration, nature, purpose, and categories of data and data subjects
• Standard Contractual Clauses and the UK Addendum
• Subprocessor terms and objection rights
• Security measures (Annex II)
• Audit and information rights, including third-party audit reports
• Breach notification commitments
• Data subject request assistance
• Return and deletion on termination
• CCPA Service Provider certifications

To execute, contact legal@brassmonkey.ai. [Or: Our DPA is pre-signed and self-executing at the link above.]

---

19. U.S. Government and Public-Sector Customers

This section applies where Brass Monkey Labs provides Services to a U.S. federal, state, local, tribal, or territorial government entity, or to a contractor supporting one.

19.1 Relationship to This Policy

Where a government contract, task order, or written agreement imposes requirements that conflict with this Policy, the contract controls for that engagement. This Policy sets a floor, not a ceiling.

19.2 Privacy Act of 1974

Where we operate or maintain a system of records on behalf of a federal agency within the meaning of 5 U.S.C. §552a(m):

• We are subject to the criminal penalties of the Privacy Act.
• We will comply with the applicable System of Records Notice (SORN) and the agency’s routine uses.
• We will not disclose records except as permitted by the Privacy Act and the contract.
• We will support the agency’s Privacy Impact Assessment (PIA) obligations under Section 208 of the E-Government Act of 2002.
• We will comply with FAR 52.224-1 (Privacy Act Notification), FAR 52.224-2 (Privacy Act), and FAR 52.224-3 (Privacy Training) where incorporated.

19.3 Controlled Unclassified Information (CUI)

Where the engagement involves CUI:

• We handle CUI in accordance with 32 CFR Part 2002 and the NARA CUI Registry.
• We implement the security requirements of NIST SP 800-171 [Rev. 2 / Rev. 3] in a nonfederal system, supported by a System Security Plan (SSP) and Plan of Action & Milestones (POA&M).
• Current status: Not applicable
• CMMC: Not currently applicable
• DFARS 252.204-7012 safeguarding and 72-hour cyber incident reporting via DIBNet apply where incorporated. DFARS 252.204-7019/7020/7021 apply as flowed down.
• FAR 52.204-21 basic safeguarding applies to all Federal Contract Information.

19.4 FedRAMP

Current status: In process

Contact gov@brassmonkey.ai.

19.5 Data Residency, Personnel, and Supply Chain

For qualifying federal engagements, we can provide:

• U.S.-only data residency — all data stored and processed within the continental United States [in AWS GovCloud (US) / a U.S. commercial region].
• U.S. persons–only support — access to government data restricted to U.S. citizens or lawful permanent residents located in the United States, where required.
• Personnel screening consistent with HSPD-12 / agency requirements.
• Supply chain assurances — we comply with Section 889 of the FY2019 NDAA (no covered telecommunications equipment or services), and we can provide a Software Bill of Materials (SBOM) and secure software development attestation consistent with EO 14028, OMB M-22-18/M-23-16, and the NIST Secure Software Development Framework (SP 800-218).
• Section 508 / VPAT — see Section 17.

19.6 Foreign Adversary and Bulk Data Considerations

• We comply with the DOJ Bulk Sensitive Personal Data rule (28 CFR Part 202) implementing Executive Order 14117. We do not engage in covered data transactions involving bulk U.S. sensitive personal data or government-related data with countries of concern or covered persons. Our data flows and vendor relationships are assessed against this rule.
• Government Customers should note that TikTok, and certain other Connected Platforms, may be restricted on government devices and networks under the No TikTok on Government Devices Act and agency policy. Integrations available to a government Customer are configured accordingly; the TikTok integration is [disabled by default / unavailable] in government tenants.
• We can provide beneficial ownership and foreign-influence disclosures on request. [Brass Monkey Labs is a [Georgia]-organized entity, headquartered in Atlanta, Georgia, with no foreign ownership, control, or influence (FOCI) / with the following FOCI disclosures: [].

19.7 Records, FOIA, and Litigation Holds

We will preserve and produce records as required by the contract, the Federal Records Act, and applicable litigation holds. We will assist agency Customers in responding to FOIA requests and will identify information we believe is exempt (e.g., trade secrets under Exemption 4), while recognizing that the agency makes the final release determination.

19.8 Government Point of Contact

gov@brassmonkey.ai | (877) 527-2823 UEI: VFJ4DS218ZJ3 | CAGE Code: Pending | NAICS: [541511 / 541512 / 541611 / 518210] | SAM.gov registration: [ACTIVE] | Contract vehicles: [GSA MAS SIN 54151S / None currently]

---

20. Job Applicants

If you apply for a role with us, we collect the information in your application (contact details, résumé, work history, education, references, and where permitted, background-check results and voluntary EEO/diversity data). We use it to evaluate your candidacy, communicate with you, and comply with employment and equal-opportunity law. Legal bases: steps prior to entering a contract, legitimate interests, legal obligation, and consent for retention in our talent pool. We retain applicant data for [12] months after a decision unless you consent to longer. We use [ATS VENDOR] as a processor. Voluntary diversity data is stored separately and never used in hiring decisions.

---

21. Third-Party Links and Services

The Services may link to or interoperate with third-party websites and services we do not control. This Policy does not apply to them. Review their privacy policies before providing information. Notably:

• Google Privacy Policy
• LinkedIn Privacy Policy
• TikTok Privacy Policy
• Meta Privacy Policy

---

22. Changes to This Policy

We may update this Policy to reflect changes in our practices, technology, legal requirements, or other factors.

• The “Last Updated” date at the top will always reflect the most recent revision.
• For material changes — such as new categories of personal information, new purposes, or new categories of recipients — we will provide at least [30] days’ advance notice by email to account holders and/or a prominent in-product notice before the change takes effect, and where required by law we will obtain your consent.
• Archived versions are available at [https://brassmonkey.ai/privacy/archive], and a summary of changes is maintained there.
• Continued use of the Services after the effective date of a change constitutes acceptance, except where consent is required.

---

23. Contact Us

Brass Monkey Labs [LLC / Inc.] 3350 Riverwood Pkwy, Suite 1900 Atlanta, Georgia 30339 United States

---