Privacy Policy

You can also customize your cookie preferences in our cookie banner. This can be found by clicking “customize” on your first-visit on the website or if you have already chosen an option, you can find it on the bottom left of the page.

Personal data collected in relation to Customer accounts

When you create a customer account with us in association with any Birdie product, including the use of our Platform, we will require you to submit to us certain personal data to identify you (including your users) as the holder of such customer account, but also to protect information associated with your customer account from unauthorized disclosure. Such personal data may include, but is not limited to, Customer full name, user full name, address, contact information, your Birdie account username and password, organization, department and role, as well as usage preferences and communication opt-in choices.

Personal data collected in relation to support services

When Customer contacts us, whether by phone, chat, email, through our websites or otherwise, we may keep a record of such communications to help solve issues that Customer might be dealing with, but also for training, quality assurance and statistical purposes, as well as to improve our products.

We may also maintain logs of support interactions for audit and compliance purposes. These logs may include technical data such as timestamps, IP addresses and usage metadata that help diagnose the issue.

Personal data collected via our websites

When you visit our websites (including https://birdie.ai/ and related subdomains), we may collect certain information automatically from your device. This includes IP address, device type, browser type, operating system, device identifier, and interactions such as pages visited and buttons clicked.

Some of this data is gathered through Cookies. We use both session and persistent Cookies for security, session continuity and analytics.

Who may have access to personal data

At Birdie, we recognize and respect the importance of protecting our customer’s personal data. Keeping personal data in strict confidence is a core part of our commitment to service excellence. We do not sell or rent any personal data to any third party. However, in order to provide Customer with our products, we may share Customer’s personal data with our affiliated companies, parent entities and subsidiaries, for internal business purposes, as well as with our partners acting on our behalf in relation to the provision of such products.

As many other service providers, we rely on third-party service providers, acting as subprocessors, to perform essential functions and help us deliver our products and services. These subprocessors process personal data on our behalf and according to our written instructions. The categories of third-party subprocessors we engage and the general purposes for which they process personal data include:

Before engaging any subprocessor, we enter into a written agreement that imposes substantially similar data protection obligations to those in our Data Processing Agreement (DPA) and ensures they adhere to strict security and privacy standards. For a detailed and up-to-date list of our specific subprocessors, including their jurisdictions and precise processing categories, please refer to Annex B of our DPA, which is supplemental to our main Agreement.

These measures also include protecting personal data within our organization. Such information may only be accessible by those employees, agents, representatives and contractors of Birdie who need to know such information as part of their duties. We further ensure that our employees, agents, representatives and contractors perform their duties in a way compatible with the terms and conditions described in this policy.

We may be required to disclose information that we have on Customer and its users (including its and their personal data) to governing and law enforcement authorities, including where required by law, a court order, or by other legal obligations that we may have in any jurisdiction.

‍

How we protect personal data

We use industry-standard security measures, including encryption at rest and in transit, secure credential management, role-based access controls, audit logging, and proactive monitoring.

Data is stored in secure data centers and we regularly test the effectiveness of our security program. We also follow secure development practices and conduct privacy impact assessments when required.

International data transfers

Birdie operates globally and transfers your personal data to the United States, where our primary infrastructure and service providers are located. This transfer is essential for the provision, maintenance, and security of our services. The following categories of personal data are collected and transferred:

• User Email and Name: Used to identify users within our systems, enable authentication, and support communication.
• IP Address and Access Region: Collected for security monitoring, fraud prevention and session management.
• Role and Affiliation within the Company: Used to manage platform functionality and permissions according to the user's roles, as well as to support user segmentation and reporting.
• Website Usage Data: Includes browsing behavior, page interactions, and preferences, which are processed to improve our services, personalize the user experience, and support analytical insights.

Birdie processes this data under the legal bases of the controller's legitimate interest (GDPR Art. 6(1)(f), LGPD Art. 7(IX)) and contract performance (GDPR Article 6(1)(b), LGPD Art. 7(V)) in order to operate and improve the platform, provide support, ensure security, and fulfill our clients’ expectations. These data transfers are performed in accordance with applicable data protection regulations, including the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), and the Brazilian General Data Protection Law (LGPD). Birdie ensures that such transfers are:

• Strictly necessary for the performance of a contract between you and Birdie (GDPR Art. 49(1)(b); LGPD Art. 33(IX) in conjunction with LGPD Art. 7(V));
• Based on your specific and highlighted consent, with prior information about the international nature of the transfer (GDPR Art. 49(1)(a); LGPD Art. 33(VIII));
• Protected by strict technical and organizational safeguards, including access controls, encryption in transit and at rest, audit logging, and secure data processing pipelines.

By agreeing to our Privacy Policy, you also acknowledge and accept the terms outlined in our Data Processing Agreement (DPA). The DPA specifies the subprocessors involved in international data transfers, the policies and procedures in place, and Birdie’s obligations for handling personal data in compliance with relevant data protection laws, including the GDPR and LGPD. For any inquiries regarding international data transfers, you may contact our Security team and Data Protection Officer at security@birdie.ai.

Retention of personal data

Birdie shall retain accounts data as long as the company has a need for its use, or to meet regulatory or contractual requirements. Once data is no longer needed, including Personally Identifiable Information, it shall be securely disposed of or archived. Data owners, in consultation with legal counsel, may determine retention periods for their data. Anonymized and aggregated data may be retained indefinitely for statistical or analytical purposes.

Legal basis for processing personal data

The legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it. However, we will normally collect personal data from you only where we have your consent to do so, where we need the personal data to perform a contract with you or to comply with applicable laws, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.

If we ask you to provide personal data to comply with a legal requirement or to perform a contact with you, we will make this clear at the relevant time and advise you whether the provision of your personal data is mandatory or not (as well as of the possible consequences if you do not provide your personal data).

Similarly, if we collect and use your personal data in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

In other situations, Customer (including its users) must always give us clear consent for the collection, use and processing of personal data in order for us to do so. This can be done in several ways, for example, by phone, chat, email, by click of a button, or other similar means.

Occasionally, a Customer may give us access to, or provide us with, additional personal data which may be necessary to enable us to provide our products to Customer. This may, for example, happen when Customer chooses to enable a relevant feature in a product. In such a case, we will treat such personal data in accordance with the terms of this privacy policy and the applicable laws.

When Customer procures or uses our products, Customer acknowledges and agrees that Customer has the necessary authority and all relevant consents (including those that may be required from its uses) to transfer such personal data to us, and allow us to treat such personal data in accordance with this privacy policy.

Minors

Our services are intended for users aged 18 and older. We do not knowingly collect personal data from children under 18.

Openness and accountability

Birdie’s privacy team, under the leadership of our Data Protection Officer (DPO), Rafael Libardi, is responsible for our security and privacy-related matters, including the application of this privacy policy. He and his team oversee training of our staff to ensure security compliance and to raise privacy awareness. Security, transparency and integrity are among the key values at Birdie. We will gladly answer any questions or concerns that you may have with respect to your privacy or the security of your personal data, or if they wish to request a correction of your personal data in our custody or control. Please do not hesitate to reach us via security@birdie.ai.

Your data protection rights

You have the right to request access to, and obtain a copy of, your personal data. You may also request that any personal data that is inaccurate or incomplete be rectified or completed. Note however that, in some cases, we may not be able to provide you access to your personal data. This may occur when providing such access would be likely to impact the privacy or the security of a third party, or for other valid reasons in accordance with applicable laws. In these events, we will advise you in writing of the grounds of our decision.

Under certain legal conditions (for example, where the personal data is no longer needed to achieve the purposes for which the information was initially collected) you may request that your personal data be erased. In addition, you may object to the processing of your personal data, ask us to restrict processing of your personal data or request portability of your personal data under certain legal conditions.

In situations, other than those outlined above in this section, where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Please note, however, that withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on other lawful processing grounds (such in relation to your account or use of your products under a contract).

You also have the right to opt-out of electronic marketing communications that we may send you at any time and free of charge. You may exercise this right by clicking on the “unsubscribe”, “opt-out” or other similar links in the marketing e-mails that we may send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided under the “How to contact us” heading below. However, we may still contact you using your contact information for example to share important technical or functional information relating to your account or use of our products.

You may exercise any of the rights described above at any time by doing the following: 

When you are filling the forms on the website, make sure to check if there is a box that you can leave unchecked, if you don’t want to disclose your personal information.

If you have already agreed to share your information with us, feel free to contact us  via security@birdie.ai with a Data Subject Access Request and we will be more than happy to change this for you. You are also able to contact our Data Protection Officer, Rafael Libardi, via this email. You can also send a response to our webform with your request with your Data Subject Access Request.

If we are unable to resolve an issue to your satisfaction, you may choose to request assistance from, or submit a complaint to the privacy authorities: