Privacy Policy

Effective July 15, 2026 · Drawbridge Automations LLC

This policy describes how Drawbridge Automations LLC ("we", "us") handles information in our products, including the Drawbridge Operating System. The short version: your data is yours, we collect only what the product needs to work, and we never sell it.

What we collect

Account information. A username, a password (stored only as a secure hash), and optionally an email address used for invitations and login recovery.

Your organization's content. The business information your organization chooses to enter — strategies, goals, business lines, metrics, scorecard results, people and task records, documents, and similar operating data. This content belongs to your organization.

Operational logs. Standard security and usage records (such as login timestamps and change history) used to keep accounts secure and to let organizations audit changes to their own data.

How we use it

Solely to provide, secure, and improve the service: authenticating you, storing and displaying your organization's data, sending the emails you request (invitations and login-reset links), and powering optional AI features described below. We do not sell personal information, and we do not use your content for advertising.

AI features and data disclaimer

Some features use artificial intelligence to summarize or analyze the content your organization has entered (for example, alignment scoring and report narratives). AI runs only on your request. Our AI provider (Anthropic) processes this content to return results and does not use it to train models. AI-generated output can be inaccurate or incomplete — it is provided as decision support, and you should review it before relying on it.

Service providers

We use a small set of infrastructure providers to run the service: Vercel (application hosting), Supabase (database hosting), Anthropic (AI processing), and Resend (transactional email). Each receives only what is necessary to perform its function.

Security

Data is encrypted in transit, passwords are hashed, access within an organization is controlled by role-based permissions, and login and recovery flows are rate-limited. No system is perfectly secure, but we design for least access by default.

Retention and deletion

We keep your data for as long as your organization uses the service. You may request export or deletion of your account or your organization's data at any time by emailing barrett@emberway.ai, and we will act on verified requests promptly.

Your rights

You can access and correct your account information in the app, and you may contact us to access, correct, export, or delete personal information we hold about you.

Changes and contact

If this policy changes materially, we will update the effective date above. Questions: barrett@emberway.ai.