Privacy policy

Garrison is operated by BRHND LLC, a California limited liability company. In this policy, “Garrison,” “we,” “our,” and “us” refer to BRHND LLC. Our contact details are at the end of this policy.

We determine how personal information is used to run our own website, manage accounts and subscriptions, provide support, maintain security, and administer our business. For those activities, we act as a controller or business where those terms apply under privacy law.

Businesses also use Garrison to manage information about their customers, employees, contractors, and other contacts. For that workspace information, the business generally determines why the information is collected and how it is used, and we process it on the business’s behalf to provide the service. If your information is held by a business using Garrison, that business’s privacy notice and instructions also matter. Using its customer Portal does not make Garrison the provider of the home services you purchase.

The information involved depends on the services you use, your role, and the information your business chooses to put into Garrison. It can include:

• Account and contact information: names, email addresses, phone numbers, business names, addresses, profile images, sign-in information, account identifiers, roles, and preferences.
• Customer and work records: contact details, service addresses, project descriptions, appointments, assignments, notes, photos, videos, documents, service history, and information entered in forms or customer messages.
• Commercial and financial records: estimates, proposals, agreements, signatures, invoices, receipts, payment status, transaction references, subscription details, usage charges, and payment instructions supplied by a business.
• Team information: employee and contractor details, work assignments, time entries, time-off requests, compensation information, emergency contacts, and employment-related records uploaded by the business or team member.
• Communications: emails, text and social messages, attachments, sender and recipient details, delivery and engagement events, phone numbers, call times and durations, voicemail, recordings, transcripts, and summaries when the relevant features are used.
• AI inputs and results: questions, prompts, conversation history, uploaded files, audio, images, selected business context, generated content, and information derived from those materials, including summaries and search indexes.
• Device and activity information: IP addresses or derived identifiers, browser and device details, approximate location, timestamps, sign-in activity, pages and features used, diagnostic events, and subscription or feature usage.
• Location information: service and business addresses, map coordinates, and precise device location for features such as location-aware timekeeping or active trip tracking, when the necessary device permission is provided.

Some of this information can be sensitive under applicable law, including account credentials, financial information, precise location, and private communications. Files and notes can contain other sensitive information that their authors choose to include. Please provide only information needed for your work and avoid placing passwords, full card details, or unrelated sensitive records into notes, messages, or AI prompts.

We receive information directly from you when you create or use an account, contact us, fill out a form, communicate through Garrison, or upload content. A business you work for or hire may create records about you, invite you to its workspace or Portal, or import your details from another system.

We also receive information from services connected by an authorized user, payment and communications providers, and the devices and browsers used to access Garrison. Connected services may supply account identifiers, authorized files or calendar information, business listings, reviews, social content, messages, and related performance data, depending on the connection and permissions granted.

You can choose what to provide, but some information is necessary for a feature. For example, an email address is needed for email-based account access, and billing details are needed for a paid subscription. Without required information, we may be unable to provide that account, transaction, or feature. A business using Garrison determines which information it needs from its own customers and team members.

We process personal information to:

• Provide the requested workspace, Portal, scheduling, communication, document, payment, marketing, and AI features, including indexing workspace content so it can be found through search and relevant context can be retrieved.
• Create and administer accounts, verify sign-ins, apply access permissions, and maintain business and customer records.
• Process subscriptions and transactions, calculate usage, maintain billing records, and handle payment questions or disputes.
• Deliver messages, invitations, requested notifications, support responses, service updates, and marketing communications where permitted.
• Diagnose errors, understand service performance, improve usability, and prevent abuse, fraud, unauthorized access, or other harmful activity.
• Respond to privacy requests, meet legal obligations, enforce agreements, and establish or defend legal claims.

For information a business places in its workspace, these activities support that business’s use of Garrison. A business may separately use its records to make employment, customer-service, financial, or operational decisions. The business is responsible for explaining those uses to the people concerned.

Your business and the people it authorizes. Workspace owners, administrators, and other authorized users can access information according to their permissions and the features used. A business can share selected records with customers, send documents and messages, invite people to its Portal, or publish content through connected services. Information deliberately published on a public page or social platform can be seen by others.

Service providers. We use providers for hosting, authentication, storage, communications, payments, diagnostics, maps, and AI processing. Depending on the feature, these include Supabase and Vercel for infrastructure, Sentry for diagnostics, SignalWire and Resend for communications, Stripe for payments, and Google, OpenRouter, Replicate, and Cartesia for AI or speech services. Information relevant to the service is processed by the provider; an AI request may also be processed by the underlying model provider.

• Infrastructure and authentication providers handle account identifiers and the workspace information they host so we can store records, verify access, and deliver the service.
• Communications providers handle contact details, message content, attachments, call audio, and delivery information to carry calls and messages and provide the related features.
• Payment providers handle billing, transaction, and payment-method information to process payments and address fraud or disputes. Map providers handle addresses and location information used for map and route functions.
• AI and speech providers process the text, audio, images, or other context involved in the relevant generation, transcription, summarization, or search function. That material can include customer, work, commercial, or team information supplied to the feature.
• Diagnostics providers receive technical events, activity information, and the diagnostic session information described below to help identify errors, investigate incidents, and improve the service.

Connected services. When an authorized user connects or uses an external service, we exchange information needed for that function. The external service also has its own privacy terms. Disconnecting a service does not automatically remove information already copied, sent, or published there.

Legal and business circumstances. Information may be disclosed to professional advisers, to respond to a lawful request or legal obligation, to investigate abuse or protect rights and safety, or in connection with a merger, financing, reorganization, or sale of the business. Such disclosure does not remove protections required by applicable law.

Connecting a Google account gives Garrison access to the information covered by the permissions shown during authorization. Google Workspace features use the connected account’s email address, Drive files made available to the connection, and calendar information for file and scheduling workflows. A Workspace administrator can also authorize access to directory information, such as team members’ names, email addresses, profile images, organizational units, and account status, to view the Workspace directory in Garrison.

A Google Business Profile connection separately supports business locations, listing information, reviews and replies, posts, and related performance information. Relevant information is displayed or stored in the business’s workspace and exchanged with Google to carry out the connected features. We retain authorization details, including access and refresh credentials, to maintain a connection without asking you to sign in again for each operation.

When an AI feature processes connected content, such as a review used to prepare a reply, the relevant content can also be processed by the AI providers described below. Information obtained through Google APIs is subject to the applicable requirements of the Google API Services User Data Policy, including its Limited Use requirements where they apply.

An authorized administrator can disconnect Google Workspace in Garrison. You can also review or remove Garrison’s access through your Google Account connections. Disconnecting in Garrison and revoking access at Google are separate actions. Neither automatically deletes information already copied into a workspace, exported, or published. Contact us or the business responsible for the records about deletion.

Using Tony or another AI feature can send your request, relevant conversation history, attachments, and business context to an external AI service. Context may include records available to you that are needed to answer the request, or brand information and reference images used to prepare content. Garrison can retain conversations, generated outputs, transcripts, and usage records as part of the workspace.

Some processing also happens in the background when content is saved. For example, customer and project notes, conversation messages, and estimate text can be sent to Google’s AI service to create numerical representations called embeddings. Garrison stores these with the relevant text to support search and retrieval of business context. This can happen without a separate AI chat request.

We use a Google Cloud project with active billing for this Gemini processing. Under Google’s paid-service terms, these inputs and responses are not used to improve Google’s products. Google can still retain them for safety, security, and legal purposes under those terms.

Speech features process microphone audio to recognize what you say and process text to produce spoken responses. Voice memos and call features can send recorded audio for transcription and the resulting text for summarization. Image and video features can transmit prompts and reference media for generation or editing.

Provider retention and use of inputs, including any use to improve models, depend on the service, model, account settings, and applicable provider arrangements. These features involve external processing rather than processing only on your device. Do not put information into Garrison that you are not authorized to share for the relevant purpose. Contact us about the providers and processing relevant to your use.

Garrison Phone and messaging features process the contents and delivery details of communications. Where recording is enabled, calls or voicemail can be stored with related call information and processed into transcripts or summaries. The business using the feature chooses its recording settings and is responsible for required notices, permissions, and consent. A recording announcement is not a substitute for every legal requirement that may apply to a particular conversation.

Communications providers and carriers process information to deliver calls and messages. Email features can report delivery, bounce, open, and click events to the sending business when those events are available. If a business contacts you through Garrison, contact that business about the message, its purpose, or your communication preferences.

You can use an unsubscribe option in a marketing email or an applicable text-message opt-out instruction. Opting out of marketing does not necessarily stop requested transaction, account, security, or service communications. You can also contact us about marketing sent by Garrison itself.

When newsletter signup is available, we use your email address to send a confirmation request and add you to the Garrison newsletter only after you confirm. We retain the invitation version, request and confirmation times, and later preference changes as consent records. Derived identifiers and request limits help prevent signup abuse. Resend handles delivery and subscription preferences. Replies to our newsletter are routed to our management inbox; they are separate from a service business’s workspace. You can unsubscribe through newsletter emails or contact us to manage your preferences.

Garrison uses service addresses and map information to support work planning. With device permission, location-aware features may use precise coordinates, accuracy, movement, and timing information for timekeeping, route or arrival functions, and active trips.

Trip sharing depends on the business’s settings and the choices presented to the person starting the trip. Sharing an arrival estimate and sharing a live map are separate choices. Authorized team members, and customers given the relevant access, may see the information shared through these features. Maps and route calculations can involve external map providers.

You can change location permission in your browser or device settings. Refusing or withdrawing permission may prevent location-dependent features from working. It does not automatically delete previously recorded work or trip information.

Cookies and similar browser storage support sign-in, account security, verified devices, preferences, and the operation of Garrison. Our website also stores your dismissal of its cookie notice in your browser so the notice does not repeatedly appear. You can manage cookies and stored site data in your browser. Blocking or clearing them can sign you out, remove preferences, or prevent parts of the service from working.

We collect technical and usage information to operate and troubleshoot the service. In the business workspace, diagnostics can include a sampled reconstruction of an on-screen session, called session replay. The implementation masks text and input fields and blocks media, and excludes designated sensitive pages. The customer Portal uses error and performance diagnostics without session replay.

Businesses using tracked links, QR codes, or link-in-bio pages can receive visit and click information, such as device or browser type, referring page, approximate city or country, and a derived IP identifier used to distinguish repeated activity. This is different from permission-based precise device location.

Garrison does not currently use advertising pixels. Our services do not currently change their processing in response to a browser’s Do Not Track signal. Browser storage controls and the privacy rights described below remain available.

Stripe processes card details entered into Stripe-powered checkout and payment forms. Garrison receives information needed to administer the transaction, such as payment status, amounts, transaction references, billing details, and limited payment-method information. The payment fields in these forms are provided by Stripe.

A business may also record payments received outside Garrison or include bank-transfer instructions and other payment details in its invoices. Those records form part of the business’s workspace. Stripe and other payment services may process information for their own fraud-prevention, regulatory, and account obligations, as explained in their privacy notices. See Stripe’s privacy policy for its processing practices.

How long information is kept depends on its purpose, the type of record, the business’s instructions, account activity, applicable legal requirements, and needs such as billing, dispute resolution, security, or fraud prevention. Different records may therefore have different retention periods.

For account and subscription records, relevant criteria include whether the account is active and whether records are needed for billing or legal obligations. For work records, communications, media, and AI content, criteria include the business’s use of the workspace and its deletion instructions. For technical, activity, and security records, criteria include troubleshooting, incident investigation, and preventing abuse. Provider copies and backups can follow separate retention arrangements.

Cancelling a paid subscription does not by itself delete an account or its workspace records. Account and organization deletion are separate actions. Some records can remain necessary for a business’s work history or legal obligations, and a team member leaving a workspace does not automatically erase those records. A self-service deletion restriction does not prevent you from making a privacy request.

Deletion from active systems may not immediately remove copies in backups, security logs, or records subject to a legal hold. Information sent to recipients, downloaded by a business, or published to connected services may also remain with those recipients or services. Contact the business responsible for your workspace records, or contact us for assistance with information we control.

Garrison uses measures such as account verification, access permissions, protected file access, and security monitoring to reduce the risk of unauthorized access or misuse. Access also depends on the permissions and sharing choices made by the business and its users.

No internet service or method of storage can guarantee complete security. Keep your sign-in details private, review access when people leave your team, and contact us if you believe an account or personal information has been accessed improperly.

Depending on the law that applies to you and the processing involved, you may have rights to access or obtain a copy of personal information, correct it, request deletion, restrict or object to certain processing, withdraw consent, or receive information in a portable format. These rights can be subject to exceptions and do not require the deletion of records that must lawfully be retained.

Send requests to hello@garrison.app or the mailing address below. Describe the request and provide enough information for us to locate the relevant account or relationship. You do not need to create an account to make a request. Please do not send passwords or full payment details. We may need to verify your identity and authority before releasing or changing information. An authorized agent may submit a request where permitted by law; we may ask for evidence of authorization.

If your request concerns information managed by a business using Garrison, that business is usually best placed to respond. You may also contact us: we can help identify the appropriate route and assist the business with requests concerning data we process for it. We respond within the periods required by applicable law and explain applicable limitations. We will not discriminate or retaliate against you for exercising a privacy right. Applicable law may also protect employees and contractors against retaliation by the business they work for. Where an appeal right applies, reply to our decision and request a privacy appeal.

California and other U.S. states

Where applicable state privacy law covers our processing, residents may have rights to know or access information, correct inaccuracies, delete information, obtain a portable copy, and opt out of certain sale, advertising, or profiling activities. California law also provides a right to limit certain uses of sensitive personal information. These rights apply subject to the law’s scope and exceptions.

Using California’s category names, the information described above includes identifiers; personal information in customer records; commercial information; internet or other electronic network activity; geolocation; audio, electronic, visual, or similar information; professional or employment-related information; and inferences, such as generated summaries or information derived from business records. Records can also contain characteristics protected by law, such as age where a business records a date of birth. Sensitive categories can include account-access credentials, precise geolocation, and the contents of communications where Garrison is not their intended recipient. Their sources, uses, and recipients are explained above.

We do not currently sell personal information or share it for cross-context behavioral advertising. We do not currently use personal information for targeted advertising. There is therefore no such current sale or advertising sharing for a Global Privacy Control signal to opt out of. This does not remove your other rights or the ability to contact us with a privacy request. The categories, sources, purposes, and recipients of information are described in the sections above.

European Economic Area, United Kingdom, and Switzerland

Garrison is offered internationally, including in Europe and the United Kingdom. Where the EU or UK GDPR applies and we act as a controller, our grounds for processing relate to the purpose involved:

• Accounts and subscriptions: performing our contract with you when you are the contracting customer. When you act for a business customer, our legitimate interests are administering that relationship and providing the service to the business and its authorized users.
• Support, security, and service performance: our legitimate interests in responding to questions, keeping the service reliable, identifying errors, preventing misuse, and protecting users, subject to your rights and interests. Where a particular diagnostic or tracking activity requires consent, legitimate interests do not replace that requirement.
• Billing, legal records, and privacy requests: performing the customer contract, meeting applicable legal obligations, and our legitimate interests in resolving disputes and establishing or defending legal claims, depending on the activity.
• Our marketing communications: consent where required, or our legitimate interests in communicating relevant information where the law permits that basis. You can object to direct marketing or withdraw marketing consent.

When consent is the basis, you can withdraw it without affecting processing that was lawful before withdrawal. Device permission to use a microphone or location is a technical choice and does not replace other notices or lawful bases required for the business’s use of that information. For workspace data controlled by a business, that business determines its lawful basis; we process the data on its behalf to provide Garrison.

In addition to access, correction, deletion, restriction, and portability rights where they apply, you may object to processing based on legitimate interests and to direct marketing. You can complain to the relevant data-protection authority without first contacting us. The EDPB lists EEA authorities, and UK concerns can be raised with the Information Commissioner’s Office. Swiss residents may contact their competent data-protection authority under applicable Swiss law.

BRHND LLC is based in the United States. Information may be processed in the United States and in other countries where the providers involved in a feature operate. Those countries may have different privacy laws from the country where you live.

Access from another country and disclosures to providers can involve international transfers. Applicable law may require an adequacy decision or another transfer safeguard, such as appropriate contractual clauses. These requirements depend on the recipient, location, and processing involved; using Garrison does not itself waive them. Contact us for the locations and transfer arrangements relevant to your information, including how to obtain information about applicable safeguards.

Garrison is a business service intended for adult users and is not directed to children under 13. If you believe a child has provided personal information to us inappropriately, contact us so we can review the circumstances and take appropriate action. Businesses should not place children’s information into Garrison without a lawful reason and any permissions required for that use.

We may update this policy as the service or our practices change. The date above identifies the latest version. For material changes, we will provide any additional notice or choice required by law. A policy update does not itself authorize a new use of information where additional consent or another legal requirement applies.

For privacy questions or requests, email hello@garrison.app.

BRHND LLC — Garrison privacy
14320 Ventura Blvd #631
Sherman Oaks, CA 91423
United States