1. Who We Are

Controller / Operator: Kamarrr Group Technology FZE LLC

Address: 26th Floor, Amber Gem Tower, Ajman, UAE

Email: privacy@brrro.com

Support: support@brrro.com

2. Scope

This Privacy Policy applies when you use Brrro, including account registration, messaging, calls, stories, support, and subscription features.

3. Information We Collect

We collect the following categories of information:

3.1 Account and Profile Information

Phone number and/or email address.
Username, display name, and optional profile photo.
Account type and subscription status.

3.2 Contact and Address Book Data

If you grant permission, we may access your contacts to help you find people on Brrro and send invitations.
Contact data processing depends on your device permissions and settings.

3.3 Encrypted Communication Data

Encrypted message payloads.
Encrypted media payloads, including attachments and story media.
Encrypted call signaling payloads where applicable.

3.4 Metadata Needed to Operate the Service

Sender/recipient account identifiers.
Device identifiers.
Delivery status and timestamps.
Message type indicators, for example text, image, voice, or call event.
Group/thread identifiers required for routing.

3.5 Device and Technical Information

Device model, OS version, app version.
Push notification token(s).
Basic diagnostic logs and crash logs.

3.6 Location Data

We process location only when you explicitly choose location-sharing features.
Live location and location message data are optional and user-controlled.

3.7 Subscription and Payment Data

Purchase status, plan, and renewal state.
Payment processing is handled by Apple App Store / Google Play or other payment providers; we do not store full card details.

3.8 Support and Communications

Information you send to support, including emails, attachments, and troubleshooting details.

3.9 Website Analytics

When you visit the Brrro website, we may use Google Analytics to understand visits, page usage, device categories, traffic sources, and campaign performance.
Google Analytics may use cookies or similar technologies to measure website activity.

3.10 Android Launch Waitlist

When you ask to be notified about the Android launch, we collect your email address, preferred site language, consent timestamp, and limited anti-abuse data.

4. How We Use Information

We use information to:

Create and maintain your account.
Provide messaging, calls, stories, and related features.
Route encrypted data between intended participants.
Deliver notifications and prevent abuse/spam.
Support device security, key verification, and reliability.
Process subscriptions and entitlement checks.
Provide customer support and troubleshoot issues.
Send the Android launch notification you requested.
Improve performance, stability, and security.
Measure website usage and campaign performance through analytics.

5. Encryption and Security Model

Brrro is built to protect content confidentiality:

Important boundary: even with encryption, some metadata is required for routing, delivery, anti-abuse, and reliability.

Message and media content are encrypted on-device before or during transmission in supported encrypted flows.
Group and modern session flows use MLS-based secure messaging architecture.
Attachment and story media are encrypted before upload in supported encrypted media paths.
Calls use secure WebRTC transport encryption and encrypted signaling paths in modern flows.

6. What We Can and Cannot Read

In normal encrypted operation, Brrro is designed so plaintext communication content is not generally available to our backend systems.

However, we may process operational metadata required to deliver the service.

If any feature includes optional preview text behavior, for example notification preview functionality, that data may be processed as part of notification delivery logic.

7. Legal Bases (EEA/UK/Similar Jurisdictions)

Where applicable, we process personal data under one or more of these legal bases:

Contract performance, providing the Services.
Legitimate interests, including security, fraud prevention, and service reliability.
Consent, including contacts, notifications, location, and optional features.
Legal obligations, including compliance requests and lawful process.

9. International Transfers

Your data may be processed in countries other than your own.

Where legally required, we use appropriate safeguards for cross-border transfers.

10. Data Retention

We retain data only for as long as needed for the purposes in this Policy, including legal, security, and operational needs.

General approach:

Account data: retained while account is active and as required afterward.
Android launch waitlist data: retained until the launch notice is sent or you ask us to remove it.
Operational logs: retained for limited security/diagnostic periods.
Encrypted relay/service data: retained according to service delivery and expiry rules.
Support records: retained as needed to resolve issues and comply with legal obligations.

11. Security Measures

We implement technical and organizational controls including:

No system is 100% risk-free, but we continuously improve security controls.

Encryption at rest/in transit where applicable.
Access controls and least-privilege principles.
Key management and device/session verification mechanisms.
Monitoring, logging, and incident response procedures.

12. Your Rights

Depending on your jurisdiction, you may have rights to:

To exercise rights, contact: privacy@brrro.com.

Access your personal data.
Correct inaccurate data.
Delete your data.
Restrict or object to certain processing.
Data portability.
Withdraw consent where processing relies on consent.
Lodge a complaint with a supervisory authority.

13. California Privacy Rights (if applicable)

California residents may have rights under CCPA/CPRA, including:

Requests: privacy@brrro.com.

Right to know categories and specific pieces of personal information collected.
Right to delete.
Right to correct.
Right to opt out of sale/share, and we do not sell personal data.
Right to non-discrimination.

14. Children's Privacy

Brrro is not intended for children under 13 years old, or older where required by law.

We do not knowingly collect personal information from children below the applicable minimum age.

15. Third-Party Services

Our Services may integrate third-party services, for example app stores, mapping services, notification systems, and verification providers. Their processing is governed by their own terms and privacy policies.

16. Changes to This Policy

We may update this Privacy Policy from time to time.

If changes are material, we will provide appropriate notice in-app or on our website.

17. Contact Us

For privacy questions or requests:

Kamarrr Group Technology FZE LLC