SunnyLoop
Privacy Policy
BrightJoy.AI LLC (“BrightJoy,” “we,” “us”) provides the merchant console and related support services. This policy covers our United States merchant-console service, including information about business owners, staff and the customers whose records merchants store with us.
Effective date: 2026-09-27
1. Who handles your information
BrightJoy.AI LLC provides the software. A participating merchant decides which customer records to create, what to record and how to serve its customers. For those records, we process information on the merchant’s instructions. The merchant is responsible for its own privacy notices and lawful collection.
We also handle account, authentication, subscription, security and support information for our own service purposes. Contact hello@brightjoyai.com about this policy or to identify the merchant responsible for a record. A merchant’s independent practices are covered by its own notices.
2. Information and its sources
Account and contact details — phone numbers, names and optional email addresses supplied by you, your merchant or your employer; merchant and staff account roles; business names, categories, addresses, business telephone numbers, hours and time zones. Customer records — merchant-entered notes, birthday month and day (no birth year), how you found the business, and a link to another customer if identified as your referrer. Cards and activity — package terms, purchase or import dates, expiry dates, remaining money, visits or time, usage, top-ups, corrections, reversals, transaction timestamps and the staff member who recorded an action. Historical cards may be entered from paper or another system. Subscription and payment records — the merchant’s plan, billing interval, payment status, invoice and subscription identifiers, renewal and cancellation dates and payment-provider events. Stripe collects payment details directly in its hosted pages. Service and security information — IP addresses, browser/device and app information, requests, errors, sign-in attempts, session identifiers and records of SMS consent. Support information — messages and information you choose to send us. Please do not send passwords, verification codes or full payment-card numbers.
3. How we use information
We use this information to authenticate users, provide customer and card records, display balances and history, support authorized corrections, administer staff access, operate billing and provide support. We use records within a business to show that business its activity, such as sales, repeat visits, expiring cards and low balances. These summaries are based on recorded activity and may be incomplete.
We use service and security information to investigate failures, detect abuse and protect accounts. We use contact details for requested verification messages, authorized transaction notices and necessary service communications. An email address on file does not by itself subscribe you to marketing or guarantee that an email notification service is available.
4. Access to merchant records
A merchant’s authorized users can see that business’s customer records, including notes and referral details. Other businesses do not receive access to those records through their console. Your merchant controls access by its team and is responsible for keeping contact details accurate.
A shared or reassigned phone number can cause a message to reach someone other than the intended recipient. Tell the merchant and us promptly about an incorrect number or an unexpected message. Customers can ask their merchant for their card records or contact us about privacy requests; no account is needed to make a privacy request.
5. Google Calendar, if a business connects it
An owner can connect a Google account’s primary calendar using read-only event access. We receive the account email, authorization tokens and event data from Google. The console uses event titles and start/end times to display the calendar to the business’s authorized users, including staff. Google’s event response can contain other event fields, but the app does not use those fields for its calendar display. We do not create or edit Google events.
We store the connection email and encrypted access/refresh tokens. We retrieve events as needed for display rather than maintaining a separate event-history archive. Disconnecting in Settings deletes the stored connection and tokens; it does not delete events at Google. You can also revoke access in your Google account.
Google data is used only to provide the connected calendar and permitted security/support functions. It is not sold, used for advertising or used to train general-purpose AI models. Our use and transfer of Google API information follows the Google API Services User Data Policy, including its Limited Use requirements.
6. Providers and other disclosures
We use providers to operate the service: Amazon Web Services for hosting, databases, backups and logs; Twilio for SMS delivery and, when configured, code verification; Stripe for merchant subscription payments, billing pages and related payment records; and Sentry for error diagnostics when enabled. These providers receive the information needed for their role. Error reports can include technical context and request or app activity.
Google receives requests when an owner uses Calendar or business-address lookup features. Hosted payment pages, Google services and links you choose to open are also subject to their providers’ own privacy notices. Our support inbox is hosted by Google’s email service.
We may disclose information when legally required, to protect people and the service, or to professional advisers under confidentiality obligations. A merger, acquisition or asset transfer may involve information subject to continued protection and applicable notice or consent requirements. Google data remains subject to the stricter limits described above.
7. No sale or advertising use
We do not sell personal information or share it for cross-context behavioral advertising. We do not sell, rent or transfer mobile numbers or SMS opt-in/consent records to third parties for their marketing. Necessary disclosures to message-delivery providers do not authorize their marketing use.
We do not use customer records or calendar data to train general-purpose AI models. The merchant console does not include advertising pixels or session-replay recording. A merchant’s own outreach outside our service is governed by that merchant’s practices and applicable law.
8. Browser storage and tracking choices
The console uses local browser storage for sign-in sessions and preferences such as language. Clearing storage or signing out can remove locally stored sessions; blocking storage may prevent some features from working.
We do not track you across unrelated websites for advertising. We do not currently change essential service behavior in response to a Do Not Track signal. We do not sell or share personal information for targeted advertising, including when we receive a Global Privacy Control signal. Providers’ own pages may use their own cookies and storage.
9. Retention, deletion and security
We keep information for the purposes described here, considering active accounts, outstanding card balances, merchant instructions, accounting and legal obligations, security needs and disputes. Ending a subscription or closing a shop does not automatically delete its customer records. Card history uses an append-only ledger: corrections add entries rather than overwrite the original transaction. This design is not a blanket exemption from privacy rights.
Deletion and access requests are currently handled through support. We assess what can be deleted or de-identified, what the merchant must instruct us to do, and what must be retained for a permitted purpose. Retained information remains protected. Backups and provider records may remain until their retention cycle ends or a legal hold is released. We do not promise immediate removal from every backup.
We use safeguards appropriate to the service, including access controls, encrypted transport, encrypted production database storage and encrypted Calendar tokens. No system can guarantee absolute security. Keep verification codes private and report suspected misuse promptly.
10. Your choices and privacy requests
You may ask to access or obtain a copy of your information, correct inaccuracies, or request deletion by emailing hello@brightjoyai.com. Describe your request, the relevant phone number and, if known, the merchant. Do not send a verification code. We may ask for proportionate identity verification; an authorized agent may need to show authority. You do not need to create an account to make a request.
For merchant-controlled records, we may coordinate with or direct you to that merchant, while handling our own account data separately. We respond within applicable legal deadlines and explain a denial and any applicable appeal process. Depending on where you live and which law applies, rights may include portability, objection or restriction, withdrawal of consent and a complaint to a regulator. Exercising a privacy right will not result in unlawful discrimination.
You can ask a merchant to correct its records and opt out of texts by replying STOP to the sender. For help, contact our support email. Opting out can prevent SMS sign-in. Stopping texts does not cancel a merchant purchase or a business’s subscription.
11. Location and children
The service’s primary hosting is in the United States. Providers and authorized support personnel may process information in other countries, whose laws can differ from yours. We use protections required by applicable law; this policy does not itself establish that a particular international transfer mechanism is in place.
The console is intended for adult business users and is not directed to children under 13. If you believe we collected a child’s information without required authorization, contact us. Merchants offering services to children should use an authorized adult’s contact details and must not submit information requiring a child-directed service or parental-consent workflow that we do not provide.
12. Changes and contact
We will update the date on this policy when it changes and provide additional notice, or obtain consent, when required for a material change. New uses of Google data require the disclosures and consent described above.
For privacy requests, security concerns or questions, contact hello@brightjoyai.com.