Privacy Policy

1. Introduction

brblly (developed by devlog) ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the brblly platform at brblly.com and related services (the "Service"). By using brblly, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using our Service:

• Account information: Name, email address, password, and organization details when you register or are invited to a team
• Profile and business information: Organization name, website names, branding settings, and contact details you enter in the dashboard
• Website content: Theme settings, collection entries (services, trips, team members, FAQs, and similar content), media uploads, and form definitions
• Scheduling and booking data: Availability, appointment or consultation requests, and related metadata submitted through your themed websites
• Support inbox data: Messages you send and receive through connected channels, conversation notes, and agent replies
• Payment information: Billing details are collected and processed by our payment provider (Polar). We do not store full payment card numbers on our servers
• Communication data: Messages you send to us for support or account assistance

2.2 Information Automatically Collected

When you use our Service, we automatically collect certain information:

• Usage data: Features used, dashboard pages visited, and interaction patterns within the platform
• Device and log data: IP address, browser type, operating system, access times, error logs, and API requests
• Authentication data: Session identifiers and security logs related to sign-in (including email/password and Google sign-in)
• Cookies: Essential session cookies for the dashboard and, where enabled, analytics cookies on hosted customer websites (see Section 10)

2.3 Information from Third-Party Platforms

When you connect messaging channels (Facebook Messenger, Instagram Direct, and similar):

• Platform account data: Page or account IDs, access tokens, and basic profile or page information authorized during OAuth
• Conversation data: Messages exchanged with your customers through connected platforms, including timestamps and delivery metadata
• Customer identifiers: Names, profile identifiers, and profile pictures supplied by the messaging platform
• Media: Images, files, or attachments shared in conversations where supported by the channel

2.4 End-Visitor Data on Your Websites

When visitors browse websites you publish with brblly, we may collect data on your behalf, depending on your plan and configuration:

• Analytics (Growth and Pro plans): Page paths viewed, referrer URL, anonymized visitor identifier (via an HttpOnly cookie), user agent, and approximate traffic counts
• Form and widget submissions: Information visitors submit through theme forms or the embedded web chat widget (such as name, email, and message content)
• Booking requests: Scheduling selections and contact details submitted through your site

You are responsible for providing appropriate notice to your website visitors and obtaining any consents required under applicable law for this processing.

3. How We Use Your Information

3.1 Service Delivery

• Provide, maintain, and improve the brblly platform
• Host and render your theme-powered websites on brblly subdomains or custom domains
• Store and deliver your media, collections, and theme content
• Operate the multi-channel agent console and web chat widget
• Process scheduling, form submissions, and inbox conversations
• Provide website analytics where included in your subscription plan
• Manage your account, organization, team members, and subscriptions

3.2 Communication

• Send account verification, security, and service-related emails
• Respond to your inquiries and support requests
• Send billing receipts and subscription notifications through our payment provider
• Notify you about material changes to the Service or these policies

3.3 Analytics and Improvement

• Analyze platform usage to improve reliability, performance, and features
• Monitor errors and security events
• Develop new functionality for websites, themes, and the agent console

3.4 Security and Compliance

• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service
• Protect the rights and safety of our users and the public

4. How We Share Your Information

4.1 Third-Party Service Providers

We share information with service providers who help us operate the Service:

• Polar: Subscription billing and payment processing (subject to Polar's privacy policy)
• Resend: Transactional email delivery such as verification and account messages (subject to Resend's privacy policy)
• Google: Optional Google sign-in for authentication (subject to Google's privacy policy)
• Meta (Facebook and Instagram): When you connect Messenger or Instagram channels, data is exchanged according to Meta's platform policies
• Cloud infrastructure and storage: Hosting, databases, and media storage for website assets and uploads

4.2 Messaging Platform Providers

When you connect Facebook Messenger, Instagram Direct, or other channels, message content and related metadata are processed by those platforms according to their respective privacy policies and terms. We access this data only as authorized by you to provide the inbox features you enable.

4.3 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations, court orders, or lawful government requests
• Enforce our Terms of Service or other agreements
• Protect the rights, property, or safety of brblly (developed by devlog), our users, or others
• Investigate potential violations, fraud, or security issues

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy commitments.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Data Retention

We retain your information for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal, tax, or regulatory requirements
• Resolve disputes and enforce our agreements
• Maintain backups for business continuity

Inbox conversations, form submissions, and website analytics are retained for the duration of your active subscription and for a reasonable period afterward, unless you request deletion sooner or a longer retention period is required by law. You may request deletion of specific data subject to legal retention requirements.

6. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption of data in transit using TLS/SSL
• Access controls and authentication for dashboard accounts
• Secure storage of credentials and channel access tokens
• Regular security updates and monitoring
• Restricted employee access on a need-to-know basis

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. Your Rights and Choices

7.1 Access and Portability

You have the right to access your personal information and, where applicable, request a copy of your data in a structured, commonly used format.

7.2 Correction and Updates

You can update much of your account and organization information in the dashboard. You may also contact us to correct inaccurate information.

7.3 Deletion

You may request deletion of your account and associated data. Some information may be retained as required by law or for legitimate business purposes (such as billing records).

7.4 Opt-Out

• Marketing communications: Unsubscribe from promotional emails using the link in the message, if you receive any
• Cookies: Manage cookie preferences through your browser settings
• Channel connections: Disconnect Facebook, Instagram, or other integrations at any time from your website settings

7.5 Data Processing Objection

You may object to certain types of data processing where applicable law provides this right. Objecting may limit your ability to use some features of the Service.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including countries where our infrastructure or service providers operate. We take steps to ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

9. Children's Privacy

The Service is not intended for children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Cookies and Tracking Technologies

10.1 Platform (brblly.com dashboard)

• Essential cookies: Required for authentication and session management
• Preference cookies: Remember settings such as theme appearance where applicable

10.2 Hosted customer websites

• Analytics cookie (Growth and Pro): An HttpOnly cookie (brblly_vid) may be set to count unique visitors to your published site. It does not identify visitors by name or email
• Web chat widget: May use session identifiers to maintain a conversation thread when the widget is enabled

10.3 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may prevent you from signing in or using certain features.

11. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services (including Meta, Google, and payment providers). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), including:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt out of the sale of personal information
• Right to deletion of personal information
• Right to non-discrimination for exercising CCPA rights

We do not sell personal information to third parties. To exercise your rights, contact us using the details in Section 16.

13. European Union and UK Rights

If you are located in the EU or UK, you have additional rights under GDPR, including:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a prominent notice on the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: nermin@brblly.com
• Phone: +387 60 305 2862
• Address: Mekiš 176, Tešanj, Bosnia and Herzegovina

16. Data Controller Information

For the purposes of data protection law, the data controller is:

brblly
devlog
Mekiš 176, Tešanj, Bosnia and Herzegovina
Contact: nermin@brblly.com