Privacy Policy

1. Introduction

This Privacy Policy describes how Borak Solutions LLC (“we”, “us”, or “our”), operating the BorakDesk AI Marketing Suite (“BorakDesk” or the “Platform”), collects, uses, stores, and protects your personal information when you use our services.

BorakDesk is a B2B marketing automation platform that provides email marketing, CRM, AI-powered campaign management, crypto marketing tools, and analytics services. This policy applies to all users of the Platform, including free trial users, paying subscribers, and visitors to our website.

By accessing or using BorakDesk, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Platform.

2. Information We Collect

2.1 Account Information

When you create a BorakDesk account, we collect your name, email address, company name, job title, and password. If you sign up through a third-party authentication provider (such as Azure AD B2C), we receive your name and email address from that provider.

2.2 Billing Information

Payment processing is handled entirely by Stripe, our PCI-DSS Level 1 compliant payment processor. We never store, process, or have access to your full credit card number, CVV, or bank account details. We receive only a tokenised reference, the last four digits of your card, your billing address, and transaction confirmation from Stripe.

2.3 Usage Data

We automatically collect information about how you interact with the Platform, including pages visited, features used, campaign performance metrics, login times, IP addresses, browser type, device information, and referring URLs. This data is collected to improve the Platform and provide you with a better experience.

2.4 Customer Data

In the course of using BorakDesk, you may upload or create contact lists, email content, campaign configurations, analytics data, and other business information (“Customer Data”). You retain full ownership of all Customer Data. We process this data solely on your behalf as described in our Data Processing Agreement.

2.5 Cookies and Tracking Technologies

We use cookies and similar technologies to maintain your session, remember your preferences, and analyse Platform usage. For full details, please see our Cookie Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve the BorakDesk Platform, including processing your campaigns, managing your contacts, and delivering analytics.
• AI Model Improvement: We may use anonymised and aggregated usage patterns to improve our AI features, including the Campaign Agent, MRI Engine, and Brand Voice DNA. You may opt out of AI training at any time through Settings → Privacy → AI Data Usage. Opting out does not affect your access to AI features.
• Analytics: To understand how the Platform is used, identify trends, and improve user experience.
• Customer Support: To respond to your support requests, troubleshoot issues, and provide technical assistance.
• Communication: To send you transactional emails (password resets, billing confirmations), product updates, and security alerts. You can unsubscribe from non-essential communications at any time.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes, including responding to lawful requests from public authorities.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.

4. Data Storage and Regional Residency

When you create your BorakDesk account, you select one of three data regions:

Your account data, contact lists, campaign content, analytics, and all associated metadata are stored exclusively in your selected region. Cross-region data transfer does not occur during normal platform operations. Each region operates an independent PostgreSQL database with Row-Level Security (RLS) ensuring complete tenant isolation.

Your region selection is permanent and cannot be changed after account creation. If you need to change regions, you must export your data, create a new account in the desired region, and re-import. This design ensures that no accidental data migration can occur.

5. Third-Party Services

We share limited information with the following third-party service providers, each of which has been vetted for compliance with applicable data protection regulations:

• Stripe — Payment processing. Receives billing information to process subscription payments. PCI-DSS Level 1 certified.
• Apollo.io — Lead enrichment and prospecting. Used when customers opt into the Apollo prospecting feature. Data processed under Apollo's privacy policy.
• Hunter.io — Email verification. Used to validate email addresses in contact lists. Only email addresses are shared.
• Anthropic (Claude) — AI features including campaign content generation, subject line optimisation, and the Campaign Agent. Prompts and responses are not used to train Anthropic's models.
• OpenAI (GPT) — Additional AI capabilities. Same data handling principles as Anthropic.
• Microsoft Azure — Cloud infrastructure. All data is hosted on Azure. Microsoft acts as a sub-processor under our DPA.
• DEXscreener — Cryptocurrency market data for the crypto marketing suite. No personal data is shared with DEXscreener.
• Push Protocol — Web3 wallet notifications. Used for wallet-targeted campaigns. Only wallet addresses (public blockchain data) are processed.

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

6. Data Retention

Active accounts: We retain your account information and Customer Data for as long as your account is active and your subscription is current. Usage data and analytics are retained for the duration of your subscription to provide historical reporting.

Cancelled accounts: When you cancel your subscription, your account enters a 90-day grace period during which all data is preserved and accessible. You may export your data at any time during this period. After 90 days, all Customer Data, account information, and associated metadata are permanently and irreversibly deleted from our systems, including all backups within 30 additional days.

Legal holds: We may retain certain information beyond the standard retention period if required by law, regulation, or legal proceedings. We will notify you if such a hold applies to your data, unless prohibited from doing so by law.

7. Your Rights

7.1 GDPR Rights (EU/EEA Users)

If you are located in the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access (Article 15): You may request a copy of all personal data we hold about you.
• Right to Rectification (Article 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): You may request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction (Article 18): You may request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability (Article 20): You may request your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Article 21): You may object to processing of your personal data for certain purposes, including AI model improvement.
• Right Not to be Subject to Automated Decision-Making (Article 22): BorakDesk does not make decisions with legal effects based solely on automated processing.

To exercise any of these rights, contact us at legal@borakdesk.com. We will respond within 30 days.

7.2 CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use, and disclose about you.
• The right to request deletion of your personal information.
• The right to opt out of the sale of your personal information. We do not sell personal information.
• The right to non-discrimination for exercising your CCPA rights.

7.3 PDPA Rights (Asia-Pacific Users)

If you are located in the Asia-Pacific region, you have rights under the applicable Personal Data Protection Act (PDPA) of your jurisdiction, including the right to access, correct, and withdraw consent for the processing of your personal data.

8. Cookies

BorakDesk uses essential, analytics, and preference cookies. EU users are presented with a cookie consent banner on their first visit. You may modify your cookie preferences at any time. For complete details, please see our Cookie Policy.

9. Children

BorakDesk is a business-to-business platform intended for use by professionals and organisations. The Platform is not directed at, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as promptly as possible.

10. Contact

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal information, please contact us:

• Email: legal@borakdesk.com
• Company: Borak Solutions LLC
• Address: Milwaukee, WI, USA

For EU users, if you are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this policy, we will:

• Send an email notification to the address associated with your account at least 30 days before the changes take effect.
• Display a prominent notice within the Platform.
• Update the “Last updated” date at the top of this page.

Your continued use of BorakDesk after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you may cancel your subscription and delete your account before the changes take effect.