Privacy Policy

1. Scope

This policy applies to information we collect through our website, communications, and any related services we offer. Where we operate as a regulated financial service provider in your jurisdiction, additional jurisdiction-specific notices may apply and will take precedence over this policy where required.

2. Information we collect

• Account information: name, email, phone number (when provided via sign-in), username, country, currency preference, and profile details you choose to add.
• Financial information: payment and transaction history on Bruce, wallet addresses linked to your account, invoices, payment links, and escrow activity.
• Optional identity verification: if we introduce Know Your Customer (KYC) or partner screening, we may collect date of birth, government-issued identification, or similar data required by law. We do not collect these documents today unless a verification flow is enabled for your account.
• Technical and usage information: IP address, browser type, device identifiers, operating system, pages viewed, referral sources, timestamps, and first-party analytics events.
• Device permissions you grant: contacts (for invites), precise location (optional profile city), camera (QR / attachments), photos (avatar), and push notification tokens.
• Waitlist signups: name, email, country, and any optional message you provide when joining the Bruce waitlist on our homepage.
• Communications: messages sent through our contact forms, email, or support channels.
• Ask Bruce chats: the messages you send to Ask Bruce, its replies, and the payment drafts it shows. See Section 14 (Ask Bruce) for what Ask Bruce reads, how chats are processed, and how long they are kept.
• Third-party information: data from authentication and wallet providers (e.g. Privy), fiat onramps, and publicly available sources used to operate the service and comply with applicable law.

3. How we use information

• Provide, operate, and maintain our services.
• Verify your identity and comply with legal and regulatory obligations when KYC, AML, sanctions screening, or tax reporting applies to your use of the service.
• Process and settle transactions.
• Detect, prevent, and investigate fraud, security incidents, and prohibited activities.
• Communicate with you about your account, our services, and changes to our policies.
• Improve, personalize, and develop our products.
• Conduct analytics, research, and risk modelling.
• Enforce our Terms of Service and protect the rights, property, and safety of Bruce, our users, and others.

4. Legal bases for processing (GDPR / UK GDPR)

Where applicable, we rely on the following legal bases:

• Performance of a contract - to provide services you request.
• Legal obligation - to comply with applicable laws including financial services, tax, and anti-money laundering regulations.
• Legitimate interests - to operate, secure, and improve our services in a manner balanced against your rights.
• Consent - for activities that require it, such as certain marketing communications, where you may withdraw consent at any time.

5. Sharing and disclosure

We share information only as necessary to deliver our services and meet our legal obligations. Recipients may include:

• Service providers and processors that support payments, hosting, identity verification, fraud prevention, customer support, and analytics, all bound by contractual confidentiality and data protection obligations.
• Cloudflare, which hosts our services and runs Ask Bruce through Cloudflare Workers AI. Ask Bruce chats are processed there and are not shared with OpenAI or other model providers.
• Banking, payment, and stablecoin partners that facilitate the movement and custody of funds.
• Regulators, law enforcement, courts, and government authorities where required by law, valid legal process, or as part of our regulatory cooperation obligations.
• Professional advisors including auditors, accountants, and counsel.
• Acquirers or successors in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to confidentiality protections.

We do not sell your personal information.

6. International transfers

Bruce operates internationally and your information may be transferred to, stored, or processed in countries other than the one in which you reside. Where such transfers occur from the European Economic Area, United Kingdom, or other regulated jurisdictions, we implement appropriate safeguards including Standard Contractual Clauses or equivalent legal mechanisms.

7. Data retention

We retain personal information for as long as your account is active and thereafter for the period required to satisfy our legal, regulatory, accounting, audit, dispute resolution, and tax obligations. Records relating to KYC, transactions, and regulatory matters are typically retained for a minimum of five to seven years from the end of the relevant relationship, in line with applicable financial services regulations. Ask Bruce chats are kept until you delete them or your account, as described in Section 14; payments you confirm from a chat remain part of your transaction records.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, hardened infrastructure, segregation of duties, monitoring, and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion via in-app Settings → Delete account, or at bruce.money/account-deletion, subject to applicable retention obligations.
• Restrict or object to certain processing.
• Receive your information in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

We will respond to legitimate requests within the timeframes required by law. Some rights may be limited where overriding regulatory or legal obligations apply.

10. Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember preferences, measure performance, and improve user experience. You may control cookies through your browser settings. Where required, we will request your consent for non-essential cookies.

11. Children

Our services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children.

12. Third-party sites and services

Our website may contain links to third-party sites and integrate with third-party services. We are not responsible for the privacy practices of those third parties.

13. Regulatory cooperation

As a financial technology platform, we cooperate fully with regulators, financial intelligence units, and law enforcement in accordance with our legal obligations. This may include reporting suspicious activity, responding to lawful information requests, and disclosing information necessary to prevent or investigate financial crime.

14. Ask Bruce

Ask Bruce is an optional AI assistant in the Bruce app and website. It answers questions about your own account (for example "what did I spend this month?") and drafts payments, requests, splits, scheduled payments, escrows, and invoice payments for you to review. This section explains how Ask Bruce handles your information. The rest of this policy also applies.

14.1 What we collect when you use Ask Bruce

• The messages you type or tap (including suggested replies you choose).
• Ask Bruce's replies, and any payment drafts it shows: the recipient, amount, currency, and note.
• What happened to each draft: whether you confirmed it, it failed, or it expired without being confirmed.
• Chat details: a title (taken from your first message, or a name you give the chat) and the date and time of each message.

14.2 Account data Ask Bruce reads to answer you

To understand requests such as "pay Ravi what I paid him last time", Ask Bruce reads only your own account data, at the moment you ask, and only what it needs for that request. This can include:

• Your display name and preferred currency.
• Your favourites and the people you have recently paid or been paid by.
• Your balance.
• Your transactions, including amounts, dates, the other person, and payment notes. Notes written by other people are treated as information only; Ask Bruce does not follow instructions contained in them.
• Money requests waiting for you and invoices you have not paid.
• Public Bruce profiles (name and username) that match a person you mention, so Ask Bruce can find the right recipient.

Ask Bruce cannot read other users' private account data, and it cannot see your PIN, passkeys, or wallet private key.

14.3 How chats are processed

• Ask Bruce runs on Cloudflare Workers AI. Your messages, together with the account data described in Section 14.2, are processed by open-weight AI models (such as OpenAI's gpt-oss and Meta's Llama) that run on Cloudflare's infrastructure. Cloudflare acts as our service provider.
• Your chats are not sent to OpenAI, Meta, or any other model developer, and they are not used to train AI models.
• We do not sell your chats or use them for advertising.
• Bruce staff do not routinely read chats. We may look at a specific chat when you ask us for support with it, to investigate fraud, abuse, or a security incident, or where the law requires it.

14.4 Why we process this information

• Performance of a contract: to answer your questions and prepare the drafts you ask for, and to save your chats so you can reopen them.
• Legitimate interests: to keep Ask Bruce secure, prevent misuse (for example through rate limits), and fix problems.

14.5 How long chats are kept, and deleting them

• Chats are saved to your account until you delete them. You can delete a single chat, or use "Delete all history" in Ask Bruce to remove every chat. Deleting your account also deletes all of your chats.
• Deleted chats are removed from our live systems straight away. Copies may remain in encrypted backups for up to 30 days before they are overwritten.
• Deleting a chat does not undo or delete any payment you confirmed from it. Confirmed payments are part of your transaction records and are kept as described in Section 7.

14.6 Your choices

• Ask Bruce is optional. You can use every Bruce feature without it, and you can stop using it at any time.
• Please do not share passwords, your PIN, recovery phrases, private keys, or card numbers in a chat. Bruce will never ask for them in Ask Bruce.
• The rights in Section 9 (including access, correction, and deletion) apply to your Ask Bruce chats.

15. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects when changes were made. Material changes will be communicated through our website or directly to account holders.

16. Contact

Browills Limited (trading as Bruce) is the data controller for personal data described in this policy. Registered office: Office 2287, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom.

For privacy questions, requests to exercise your rights, or to contact our Data Protection Officer, write to privacy@bruce.money. For company contact: info@browills.com or call +44 7360 498963. Account deletion instructions: bruce.money/account-deletion.