Privacy Policy

Last updated: August 24, 2026

bruknow is a product operated by Framesoft Solutions Ltda., a company registered in Bogotá, Colombia ("we", "us", or "our"), which operates the website bruknow.com and the bruknow platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

This Policy covers two distinct relationships: the data we handle about you as a customer of bruknow, and the data we process on your behalf about your own customers when you connect a messaging channel. Section 5 describes the second relationship, in which we act only as a data processor.

1. Information We Collect

We collect information you provide directly to us, as well as information generated when you use our Service:

• Account information: Name, email address, and password when you register.
• Profile information: Timezone, language preference, and other profile details.
• Billing information: Payment details processed securely through our payment providers. We do not store full card numbers.
• Communications data: Messages and content you create, send, or receive through our platform.
• Usage data: Log data, IP address, browser type, pages visited, and interaction events.
• Third-party social data: When you connect via Google, Facebook/Meta, or Microsoft, we receive the profile information those platforms share with us (name, email, profile picture).

2. Google User Data

When you connect your Google account to bruknow, we may request access to the following Google services:

• Google Drive — To read and write files on your behalf when you use our integrations.
• Google Sheets — To read and write spreadsheet data for automation and reporting features.
• Profile and Email — To identify your account and pre-fill your user profile.

Use of data obtained from Google APIs is limited to providing and improving the features you request. We do not use Google user data for advertising, we do not sell Google user data to third parties, and we do not allow humans to read your Google data unless you explicitly grant access or as required by law.

Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Facebook / Meta User Data

When you connect your Facebook account or use our Meta integration (Instagram, Messenger), we collect:

• Your Facebook public profile (name, email, profile picture)
• Pages and Instagram accounts you have granted access to, for the purpose of managing chatflows and automated responses

We only request permissions necessary to operate the features you enable. We do not post to your Facebook or Instagram accounts without your explicit action.

You may request deletion of your Facebook-linked data at any time. See Section 11 (Your Rights & Data Deletion) below.

The messages exchanged between your business and your own customers through WhatsApp, Instagram, or Messenger are covered separately in Section 5.

4. Microsoft User Data

When you connect your Microsoft account (Outlook, Office 365), we collect:

• Your Microsoft profile (name, email)
• Calendar and email data, to the extent required by the integrations you activate

Microsoft data is used solely to provide the integration features you have enabled and is not shared with third parties.

5. Messaging Data Processed on Behalf of Our Customers

bruknow allows business customers to connect their own WhatsApp Business, Instagram, and Facebook Messenger accounts in order to communicate with their own customers ("end users").

Our role. When a business connects its messaging accounts to bruknow, that business is the data controller for its end users' data. Framesoft Solutions Ltda. acts solely as a data processor, handling that data on the business's behalf and according to its instructions. The business remains responsible for obtaining any consent required from its own customers.

What we process.

• Message content exchanged between the business and its end users: text, images, documents, audio, and shared locations
• The end user's profile name and phone number or platform identifier
• Message delivery and read status, and the date and time of each interaction

What we use it for.

• Delivering conversations to the business that owns the account, and enabling its team to reply
• Maintaining the conversation history of each contact in that business's own address book
• Producing response-time and service statistics for that business
• Generating automated replies according to the instructions configured by that business

What we do not do. We do not sell this data. We do not use it for advertising or targeting. We do not use it to train artificial intelligence models. We do not combine data across different business customers — each business can access only its own conversations.

Subprocessors. To operate the Service we share this data only with contracted subprocessors, which may process it solely to provide the Service to us and may not use it for their own purposes:

• Cloud infrastructure and hosting providers
• Artificial intelligence model providers: OpenAI and Google, used to generate automated replies. Message content sent to these providers is not retained by them for model training.

Retention and deletion. Conversations are retained for as long as the business customer's service remains active. The business that owns the account may request deletion of conversations and contacts at any time by writing to [email protected]. On termination of the contract, messaging data is securely deleted or anonymised within 90 days, unless we are legally required to retain it.

6. The bruknow Mobile App

This section describes the bruknow mobile application for Android (package name "com.bruknow.app"), which lets agents of a business customer work their conversations from a phone. It supplements, and does not replace, the rest of this Policy.

Device permissions the app requests. Each permission is requested only when you first use the feature that needs it, and every one of them can be declined without losing access to messaging:

• Notifications: to alert you to new messages and to alarm-style reminders configured by your organisation. Alarm reminders may appear as a full-screen alert so they are not missed while the phone is locked.
• Contacts (read and write): the app reads your device address book so that it can show you a list to choose from, and writes to it when you save a conversation contact to your phone. If you use the contact import feature, only the entries you explicitly select are uploaded to your workspace — their name, phone number, and email address — so that you can message them. The app never uploads your address book automatically or in the background.
• Microphone: used only while you are actively holding the record control to record a voice message. The app does not record ambient audio and does not listen in the background.
• Location (approximate and precise): used only at the moment you explicitly choose to share your current location as a pin in a conversation. The app requests foreground location only; it does not collect background location and does not track your movements.
• Biometrics (fingerprint or face): offered as an optional way to unlock the app. Biometric data is handled entirely by the Android operating system, never leaves your device, and is never transmitted to or stored by us.
• Photos, videos and documents: selected through your device system picker so that you can attach them to a conversation. The app receives only the specific files you choose and has no access to the rest of your library.

Information the app collects.

• Account and session data: your login credentials are exchanged for a session token, which is held in the device encrypted secure storage provided by the operating system.
• Message content and attachments: the conversations, files, images, voice notes and location pins you send or receive through the app. This is the customer messaging data described in Section 5, and we act as a processor for it on behalf of the business that owns the account.
• Push notification token: a device identifier issued by Google Firebase Cloud Messaging so that notifications can be routed to your device.
• App and device information: the installed app version and build number and the platform name, which the app sends when it checks whether an update is available.
• Diagnostic data: error and stability information used to identify and fix defects.

What the app does not do. The app does not display advertising, does not use advertising identifiers, and does not sell or share personal data with third parties for advertising or marketing purposes. It does not collect background location, does not record audio outside an explicit recording action, and never uploads contacts you have not selected.

Third-party services used by the app. The app uses Google Firebase Cloud Messaging to deliver push notifications. Google processes the device push token and notification payload for that purpose, under the Google Privacy Policy. Data transmitted between the app and our servers is encrypted in transit using HTTPS.

Deleting your data from the app. Signing out of the app removes the session token and locally cached conversations from the device. To request deletion of your bruknow account and its associated data, write to [email protected] as described in Section 12; we respond to all such requests within 30 days.

7. How We Use Your Information

• To provide, maintain, and improve the Service
• To process transactions and send related information (receipts, invoices)
• To send transactional and operational emails (account confirmation, password reset)
• To respond to comments, questions, and requests for support
• To monitor and analyze usage patterns and trends
• To detect, investigate, and prevent fraudulent or unauthorized activity
• To comply with legal obligations

8. Sharing of Information

We do not sell your personal information. We may share your information with:

• Service providers: Trusted vendors who process data on our behalf (hosting, payment processing, email delivery, analytics). These providers are bound by confidentiality obligations.
• Artificial intelligence providers: OpenAI and Google, which process message content solely to generate the automated replies you have configured. They may not use it for their own purposes or for model training.
• Legal requirements: When required by law, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time (see Section 11).

Messaging data processed on behalf of business customers (Section 5) is deleted or anonymised within 90 days of contract termination. Account, billing, and transaction records may be retained for legal, tax, or auditing purposes for up to 7 years after account closure; this longer period applies to those records only, not to message content.

10. Security

We implement industry-standard security measures including TLS/HTTPS encryption for all data in transit, encrypted storage for sensitive credentials, access controls and audit logging, and regular security reviews. No method of transmission over the Internet is 100% secure.

11. Cookies

We use cookies and similar tracking technologies to operate the Service, maintain sessions, and gather usage analytics. You may control cookie settings in your browser, though disabling cookies may affect Service functionality.

12. Your Rights & Data Deletion

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data. To exercise these rights or to request deletion of your account and all associated data (including data linked via Facebook/Meta login), contact us at:

13. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately.

14. International Transfers

Your data may be processed and stored on servers located outside your country of residence. By using the Service, you consent to such transfers. We take appropriate safeguards to ensure your data is protected in accordance with this Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

16. Contact Us