Privacy Policy

Breme is operated by Figurative, Inc., a Delaware corporation ("Breme", "we", "us"). We are the controller of the personal data described in this policy.

You can contact us about anything in this policy at info@breme.ai, or by mail at 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

This policy applies to breme.ai, the Breme application, and related services we operate. It covers personal data we collect when you visit our site, create an account, use the product, or communicate with us.

It does not cover third-party sites or services we link to. Those have their own privacy policies.

We collect the following categories of data:

• Account information: the email address you sign up with, and the name, profession, and how-you-found-us answer you give during onboarding.
• Google sign-in data: if you sign in with Google, we receive your name and email address from your Google profile.
• Teammate emails: if you invite people to your organization, we collect the email addresses you enter so we can send the invitations.
• Content you upload: images, video, and audio you upload, which may include faces and voices.
• Content you create: prompts, scripts, and other creative content you produce in the product.
• Generation and usage records: the operations you run, the model used, and the cost of each operation.
• Device and usage analytics: information about how you use the product, such as pages visited and general device characteristics.
• Payment records: your subscription plan, invoices, and payment status. Your card details are collected and stored by Stripe, our payment processor, and never by Breme.

Content you create on a paid plan is private and is never used to train AI models. Not by us, and not by our model providers: our API agreements with OpenAI and Anthropic prohibit training on this data.

Content created on the free plan is public and may be used to train and improve models. This training use can continue after you delete the content or your account: copies may be retained for training under the license in our Terms of Service. Where the law gives you deletion rights over your personal data, for example under the GDPR or the CCPA, those rights come first: tell us at info@breme.ai that your deletion request covers personal data in your content and we will remove it from our active systems and exclude it from future training runs.

Content you choose to make public may be shown on public pages. If it was created on the free plan, it may also be used for training as described above.

Paid-plan content is stored privately.

Free-plan content, and any content you choose to make public, is publicly accessible to anyone who has its URL and may appear on our showcase pages.

We use the data we collect to:

• Provide and operate the service, including running the AI generations you request.
• Create and manage your account and organization, including sending invitations to teammates.
• Process payments and manage your subscription.
• Send transactional email, such as invitations, receipts, and important service notices.
• Understand how the product is used so we can improve it.
• Keep the service secure, prevent fraud and abuse, and enforce our terms.
• Comply with legal obligations, such as tax and accounting requirements.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: processing needed to provide the service you signed up for.
• Legitimate interests: securing the service, analyzing how it is used, and preventing fraud.
• Consent: where required, for example for optional communications. You can withdraw consent at any time.
• Legal obligation: keeping records required by tax and accounting law.

We share data with a small set of providers who process it on our behalf, only for the purposes listed here:

• Supabase: database, authentication, and file storage.
• Vercel: hosting and product analytics.
• Stripe: payments and billing.
• OpenAI, Anthropic, and Replicate: AI model processing of your prompts and media.
• Unifically: AI model aggregation.
• Cloudflare: AI request routing.
• An email delivery provider: transactional email such as invitations and receipts.

Each provider is bound by contract to handle your data only as needed to provide its service to us.

Beyond the providers above, we may disclose personal data:

• Within your organization: teammates in your organization can see content and activity shared in the shared workspace.
• To comply with law: when required by a valid legal request, such as a subpoena or court order.
• To protect rights and safety: to enforce our terms, or to protect the rights, property, or safety of Breme, our users, or others.
• In a business transfer: if Breme is involved in a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data.

We do not sell personal data, and we do not share it for targeted advertising.

Breme is based in the United States, and your data is processed there. If you are in the EU, UK, or another region with data transfer rules, this means your data is transferred to a country that may have different data protection laws than yours.

For personal data from the EU and UK, we rely on Standard Contractual Clauses with our providers as the transfer mechanism.

• Account data: for as long as your account exists.
• Content: until you delete it or your account is deleted. After you cancel a subscription, your content is preserved for a grace period before deletion.
• Billing records: as long as tax law requires, typically 7 years.
• Logs and analytics: for a limited operational period.

If you are in the EU or UK, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Have your data erased.
• Receive a copy of your data in a portable format.
• Restrict or object to certain processing.
• Lodge a complaint with your local supervisory authority.

To exercise any of these rights, email info@breme.ai. We will respond within the legally required window.

If you live in a US state with a privacy law (such as California, Colorado, Virginia, or Texas), you have the right to:

• Know what personal data we collect and how we use it.
• Delete your personal data.
• Correct inaccurate data.
• Opt out of the sale or sharing of personal data and of targeted advertising. Breme does not sell personal data and does not use it for targeted advertising, so there is nothing to opt out of.
• Not be discriminated against for exercising these rights.
• Appeal if we refuse a request. Reply to our decision and we will have someone else review it.

We honor Global Privacy Control signals from your browser.

To exercise any of these rights, email info@breme.ai. We will respond within the legally required window.

We use only strictly necessary cookies: one for your authentication session, and one that remembers your active project.

Our analytics (Vercel Web Analytics and Speed Insights) is cookieless. We use no advertising or cross-site tracking cookies, which is why you will not see a cookie banner on our site.

We protect your data with encryption in transit, access controls, and row-level security on our database, so each account can only reach its own records.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a breach affecting your data, we will notify you as required by law.

Breme is for users 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us at info@breme.ai and we will delete it.

We do not make automated decisions about you that have legal or similarly significant effects.

Content you submit may be automatically screened for violations of our prohibited-content rules.

We may update this policy as the service or the law changes. For material changes, we will notify you by email or in the product before the changes take effect. The effective date at the top of this page always shows the current version.

Questions about this policy can go to info@breme.ai.