Privacy Policy

Brocket ("Brocket", "we", "us") provides an AI analyst for finance teams: the web application at app.brocket.xyz, the Google Sheets add-on "Brocket for Sheets" and the website brocket.xyz (together, the "Service"). This policy explains what information we process, why, who we share it with and the choices you have. It applies to visitors of brocket.xyz and to the people who use Brocket through a customer organization.

Questions about this policy, or requests about your information, go to privacy@brocket.xyz.

Brocket is a business-to-business service. Your organization decides which data sources to connect and who may access them. We process that business data on your organization's behalf and under its instructions; your organization remains responsible for that data and for having the right to share it with us.

Information we process

Account information

Name, work email address, job title, role and organization. Sign-in is handled by AWS Cognito; we never see your password. Verification and multi-factor codes are sent to your email address.

Business data your organization connects

Files (CSV), Google Sheets shared with Brocket's service account (we download periodic snapshots) and databases (PostgreSQL, SQL Server, BigQuery), which Brocket accesses in read-only mode. We run queries on those sources to answer questions and keep the copies, snapshots and query results needed to do so. Connection credentials are stored encrypted and are never displayed again once saved.

Conversations and results

Your messages, the files you attach (CSV, PDF, images), the analyst's answers, and the tables, charts, exports, dashboards and presentations you create. We also keep the analyst's working record for each conversation (which tools it ran and what they returned) so it can continue where it left off.

Knowledge documents

Descriptions of each connected data source (what it contains, its structure, business rules) written by your organization's administrators with the help of Brocket's editor.

Product usage

Inside the application we use PostHog to record which screens you open and which actions you take, linked to your user, and to replay how you move through the screens with all text and inputs masked. This tells us which features are used and where people get stuck. On this website we use Vercel Analytics, which reports aggregate visits without cookies.

Contact form

If you book a demo we receive your name, email, company and message by email. Your IP address is used only to limit abuse of the form.

Google Sheets add-on

See the dedicated section below.

How we use it

• To provide the Service: answer your questions, run analyses and write to your spreadsheets when you ask.
• To keep your history and results available to you and to the people you share them with.
• To secure the Service, verify permissions and prevent abuse.
• To diagnose and fix errors.
• To understand how the product is used and improve it.
• To communicate with you: invitations, alerts (for example when a data source stops syncing) and support.

We do not sell personal information and we do not use it for advertising.

Who we share it with

We rely on service providers that process information on our behalf, under agreements that limit them to providing their service to us:

We may also disclose information when the law requires it, to protect the rights and safety of Brocket, our customers or others, and to a successor if Brocket is acquired or merged, in which case we will tell you beforehand.

Google user data and the Sheets add-on

Brocket for Sheets connects a Google Sheets spreadsheet with your Brocket account. When you connect it, we link your Google account (identifier and email) to your Brocket user and organization, and we check that the Google account authorizing the spreadsheet is the one using the panel.

The add-on reads the identifier and name of the spreadsheet that is open and your current selection. To answer your requests it can read the ranges you authorize (values, formulas, formats) and write tables, formulas, formats and native charts. Brocket's access is limited to the spreadsheets you explicitly authorize through the Google file picker; we do not request access to your whole Drive.

We keep a record of the changes the add-on makes (range, content written and previous values) to verify that a change was applied, detect conflicts with simultaneous edits and avoid repeating a change after an interruption. The Google credentials for your connection are stored encrypted on Brocket's servers; they are never written to cells or given to the AI model.

We use the data we receive from Google only to provide and improve the add-on features you see and ask for. We do not use it for advertising, we do not sell it, and we do not use it to train AI models. Transfers to the providers listed above are limited to what is necessary to provide those features. Our staff do not read your Google user data except with your permission (for example, when you ask us for support), for security purposes, or where the law requires it.

Brocket's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnect Brocket(More options in the panel) revokes the add-on's authorization for your Google account and deletes the credentials of that connection. It does not delete results already written to your spreadsheet or your conversation history. You can also review or revoke access from your Google account connections.

How long we keep it

• Account and business data: while your organization's account is active, plus 30 days for recovery after it ends, unless the law requires a longer period or you ask us to delete it sooner.
• Deleting a conversation removes it from the product and its working files immediately.
• Monitoring traces and application logs: 30 days.
• Backups are encrypted and expire within 30 days.

You can ask us to delete your personal data, or your organization can ask us to delete all of its data, at any time by writing to privacy@brocket.xyz. We verify the request, complete it within 30 days and confirm when it is done.

Security

• All traffic between your browser, the add-on, Brocket and Google is encrypted in transit (TLS).
• Databases, file storage and backups are encrypted at rest with keys managed in AWS.
• Credentials for your data sources and for Google are stored encrypted and are never exposed again.
• Access is limited by user, role and organization. Internal systems require multi-factor authentication.
• Brocket staff access customer data only when needed to operate the Service or resolve an issue.
• We maintain an incident response process and will notify affected customers without undue delay if their data is compromised.

Where your information is stored

Brocket runs on Amazon Web Services in the United States (Ohio region). The providers listed above may also process information in the United States. If you use the Service from another country, your information is transferred there and protected as described in this policy.

Cookies and local storage

The application stores your session and preferences in your browser and uses PostHog cookies and local storage for usage analytics. This website does not use tracking cookies.

Your rights

You can ask to access, correct, delete or restrict the use of your personal data by writing to privacy@brocket.xyz. We answer within 30 days. If your information was provided through your organization, we may refer your request to it. The Agencia de Acceso a la Información Pública (Argentina), as the supervisory authority under Law No. 25,326, receives complaints about breaches of personal data protection rules.

Children

Brocket is a business tool and is not directed to anyone under 18.

Changes to this policy

We will post any changes on this page and update the date above. If we materially change how we use data received from Google, we will update this policy and ask for your consent where required before applying the change.