DRAFT, pending legal review

Privacy Policy

Version 2026-10-17 · Effective October 17, 2026

This Privacy Policy explains what personal data Spectonomous LLC ("Brookwake", "we", "us") collects when you use https://brookwake.com, why, who we share it with, how long we keep it, and the rights you have. We are the controller of this data. Contact: {{SUPPORT_EMAIL}}, Spectonomous LLC, {{LEGAL_ADDRESS}}.

We don't train on your content. We don't use your prompts, uploads or outputs to train AI models, and we don't sell your personal data.

1. Data we collect

Account data: from your Google sign-in, your email address, name and profile picture. We also store your theme preference.
Age and terms: your 18+ confirmation, year of birth, the date you confirmed it, and which version of the Terms and Acceptable Use Policy you accepted and when.
Billing data: your plan, subscription status, renewal dates, invoices and refunds. Card details are collected and held by Stripe; we never see or store your full card number. Stripe tells us your billing country to check the US-only restriction.
Credits: your credit balance and the full credit history (grants, reservations, spends, refunds and expiries).
Your content: prompts, enhanced prompts, settings, preset choices, uploaded images, video and audio, voice samples and cloned voices, and the images, video and audio generated for you, with their folders, favourites and share links.
Consent records: when you confirm face, voice, IP or Lipsync consent, we record the statement and its version, the time, a one-way hash of your IP address and your browser's user agent.
The AI label on outputs: every file we make carries an AI label in its metadata: our name, the model and its version, the date and time, whether the file was created or altered, and a job ID. The label holds no personal information (no name, email, prompt or account ID). Only our own records link its job ID to the job and the account that made it.
Safety records: the results of safety checks on your prompts, uploads and outputs, strikes, reports you make or that are made about your content, and DMCA notices.
Connections: MCP clients you connect (client name, dates, last use).
Technical data: your IP address and the country derived from it (used for security, rate limits and because some models aren't available in some countries), browser type, and error reports.
Messages: emails you send us and the emails we send you (receipts, reminders, account notices).

2. Why we use it (and the legal basis)

To provide the Service you signed up for (contract): your account, generations, library, share links, billing, credits, exports and support.
To keep the Service safe (legitimate interests and legal obligations): age checks, safety checks on every prompt, upload and output, preventing fraud and abuse, enforcing our policies, and reporting child sexual abuse material to NCMEC as US law requires.
To meet legal obligations: tax, accounting, responding to lawful requests and DMCA notices, and keeping records of consent.
To communicate with you (contract and legitimate interests): receipts, renewal and expiry reminders, account and security notices. We don't send marketing emails without your consent.

We share personal data only with the service providers that run Brookwake for us, under contracts that limit their use of it, and when the law requires it. Our subprocessors:

Vercel: hosting of the website and app.
Supabase: database and Google sign-in.
Cloudflare: storage of uploads and outputs (R2), and our background worker.
Google Cloud: AI models (Vertex AI) for generation and safety checks, media processing (Cloud Run) and database backups.
DeepInfra: AI models for generation and safety checks.
Alibaba Cloud (Model Studio, Singapore region): AI models for generation, voices and safety checks.
Modal: GPU hosting for sound-effect, Foley and lip-sync models.
Stripe: payments, subscriptions, tax and fraud prevention.
Upstash: rate limiting.
Resend: sending email.
Sentry: error monitoring. Prompts are not sent to Sentry.

AI providers receive the prompts, uploads and settings needed to create or check each generation. Some providers process data outside the United States. Where we transfer data internationally, we rely on appropriate safeguards such as standard contractual clauses.

We may also disclose data to comply with the law, to respond to valid legal process, to report child sexual abuse material to NCMEC, or to protect the rights and safety of people and the Service.

4. How long we keep it

While you have a plan: we keep your account, library and history for as long as your account is open.
After your paid period ends: your library stays readable and downloadable for 30 days. We email you 7 days and 1 day before it is deleted. Then your generated media and uploads are permanently deleted. Your account, billing history and credit history remain, so you can subscribe again. Subscribing again before the deletion date cancels it.
When you delete your account: see section 5. After the 30-day restore window, everything is permanently deleted except what the law requires us to keep.
Data exports: the download link stops working after 7 days. The archive itself is deleted with the rest of your account data.
Legal holds: material connected with suspected child sexual abuse is preserved for at least one year for law enforcement, and other data may be kept if we receive a legal preservation request.
Financial records held by Stripe are kept as tax and accounting law requires.

5. Deleting your account

You can delete your account from Account → Privacy. You type DELETE and confirm with Google. When you do:

any subscription is cancelled at once (without a refund, unless the Refund Policy applies), and your MCP connections are revoked;
your account is scheduled for deletion in 30 days. You can restore it by signing in during that window;
after 30 days, all your uploads and outputs, all your account data and your sign-in are permanently deleted, and the customer details we hold in Stripe are anonymised. We keep only financial records in Stripe and any legal preservation hold.

6. Exporting your data

From Account → Privacy you can export your data once every 24 hours. The export is a JSON archive with your profile, subscriptions, credit history, jobs with their prompts and settings, asset details, folders, presets used, share links and consent records. We email you a download link valid for 7 days. Your media files aren't copied into the export; download them from your library.

7. Your rights

Depending on where you live, including under the EU and UK GDPR and the California Consumer Privacy Act (CCPA/CPRA), you may have the right to:

access your personal data and get a copy (use the export, or ask us);
correct inaccurate data;
delete your data (use account deletion, or ask us);
port your data to another service (the JSON export);
object to or restrict some processing, and withdraw consent where we rely on it;
know what categories of personal data we collect, use and disclose (this policy), and not be discriminated against for exercising your rights.

We don't sell or share personal data for cross-context behavioural advertising, so there is nothing to opt out of. To exercise a right, email {{SUPPORT_EMAIL}} from your account's email address. We may need to verify your identity, and we answer within the time the law sets (usually 30 or 45 days). You can authorise an agent to make a request for you. You may also complain to your local data protection authority.

8. Cookies and local storage

We use only essential cookies and browser storage that the Service needs to work:

Sign-in cookies (set by Supabase) keep you signed in.
Local storage remembers your theme, the studio's unsent prompt drafts, and that you've seen the cookie notice.
Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.

We don't use advertising or analytics cookies, and we don't record your sessions. If we ever add analytics, we will ask for your consent first.

9. Security

We encrypt data in transit, keep uploads and outputs in private storage served through short-lived signed links, restrict database access by account, and limit staff access. No system is perfectly secure; if a breach affects you, we'll notify you as the law requires.

10. Children

Brookwake is for adults only. We don't knowingly collect data from anyone under 18. If you tell us you're under 18 at sign-up, the account is blocked. If you believe a minor is using the Service, email {{SUPPORT_EMAIL}}.

11. Changes

We'll post changes to this policy here, with a new version and effective date. If a change is significant, we'll tell you by email or in the app.

12. Contact

Brookwake is a brand of Spectonomous LLC.

Spectonomous LLC, {{LEGAL_ADDRESS}}. Email: {{SUPPORT_EMAIL}}.