Last updated: March 2026
BrightKeep is built for families who trust us with their most important information. This policy explains exactly what we collect, how we use it, and who else touches it. No surprises.
We collect the following categories of information:
We use your information to:
What we do NOT do with your data: We do not use your data to train AI models. We do not sell your data to anyone. We do not share your data with advertisers. We do not monetize your information in any way beyond the subscription you pay for.
We use the following third-party services to operate BrightKeep. Here’s exactly what data each service touches:
Email address, name, login sessions
Document text sent for processing. Anthropic does not retain this data per their data processing terms. Your data is not used to train their models. Documents are decrypted in memory only during processing.
Uploaded documents, encrypted with per-user AES-256 encryption keys managed by AWS KMS. Each user’s files are encrypted with their own unique key.
Manages per-user encryption keys for document and data protection. Only encrypted key material is stored; plaintext keys exist only in memory during use.
All structured data, encrypted at rest. Sensitive personal fields (Social Security numbers, document numbers, medical notes, financial account numbers) are additionally encrypted at the application level with per-user encryption keys.
Document files are converted to PDF format for processing. Files are deleted from CloudConvert servers after conversion per their data processing terms.
Email address, notification and digest content
Phone number, notification message content
Payment information handled entirely by Stripe. We never store your card numbers.
Application code and request logs
Document metadata and job status (not document content)
Page views, feature usage, and general interaction patterns to understand how users interact with BrightKeep and improve the product. No sensitive document content, personal identifiers (such as SSNs, passport numbers, or medical records), or encrypted field values are ever sent to PostHog.
When an error occurs, Sentry may receive technical context such as browser type, page URL, and error details for application performance tracking. Sentry never receives document content, personal identifiers, or encrypted field values.
We keep your data for as long as your account is active and you’re using the service.
After account deletion, your data is permanently deleted within 30 days. Database backups may persist for up to 90 days before automatic deletion.
Audit logs (which record who accessed what and when) are retained for 12 months for security purposes.
Billing records (invoices, payment history) are retained by Stripe per their data retention policies. We retain your subscription status and billing dates — but not payment card details — for as long as your account is active.
You have the right to:
To exercise any of these rights, visit Settings in the app or contact us at support@brightkeep.ai.
BrightKeep is not directed at children under 13. We do not knowingly collect personal information from children under 13.
A note on family data:BrightKeep is designed for parents and guardians to organize information about their family — including their children. Documents about minors (school records, vaccination records, etc.) are stored as the parent’s data about their children, not data collected from children directly. The account holder (parent/guardian) controls and is responsible for this data.
We protect your data with multiple layers of security:
For a full description of our security practices, see the Data Security section in our Terms of Service.
We may update this privacy policy from time to time. When we make material changes, we’ll notify you via email at least 30 days before the changes take effect.
We’ll also update the “Last updated” date at the top of this page.
Questions about this privacy policy or how we handle your data? Contact us at support@brightkeep.ai.