Privacy policy

1. Who we are

The controller for the hosted Birch service is Birch AI. Registered address: Available on request via support@birch.so. Contact: support@birch.so.

2. What we collect

• Account data: name, email, password hash (or Google account identifiers if you use Google sign-in), organization and team membership.
• Billing data: subscription status and customer identifiers handled by Polar. We do not store full payment card numbers.
• Project and site data: URLs you submit, crawled site content used for Foundation and agents, strategy docs, drafts, audits, keyword and rank data, activity and feed items, credit usage.
• Integrations: OAuth tokens and account metadata when you connect Google Search Console, Google Analytics, or GitHub. Tokens are encrypted at rest.
• Support and email: messages you send us; delivery metadata for transactional mail.
• Usage and device data: logs needed to operate the service; analytics events if PostHog is enabled (see Cookie policy).

3. Why we process data

• Provide and improve the Birch product
• Authenticate users and secure accounts
• Run Foundation, agents, digests, and the approval feed
• Process subscriptions and credit metering
• Respond to support requests
• Comply with law and enforce our Terms

4. Legal bases (where GDPR/UK GDPR apply)

We process data to perform our contract with you, based on legitimate interests in operating a secure SaaS product, and where required by law. Optional analytics (PostHog) may load when a project key is configured. You can block analytics cookies and similar storage in your browser. See the Cookie policy.

5. AI and third-party processing

To generate strategy docs, drafts, fix-prompts, and related outputs, we send relevant project content and prompts to model providers via OpenRouter. SEO research may use DataForSEO. We do not sell your personal data. See Subprocessors for the current vendor list.

6. Sharing

We share data with subprocessors that help us run the service, with Polar for billing, and when required by law or to protect rights and safety. If you connect Google or GitHub, those providers process data under their terms and your connection settings.

7. Retention

We keep account and project data while your account is active. After deletion requests, we erase or anonymize personal data we control within a reasonable period, except records we must keep for legal, tax, or fraud prevention reasons (including some billing records held by Polar).

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. Contact support@birch.so. You may also lodge a complaint with your local supervisory authority.

9. International transfers

We and our vendors may process data in the United States and other countries. Where required, we use appropriate transfer mechanisms (such as standard contractual clauses) with processors.

10. Children

Birch is for business users. The service is not directed to children under 16, and we do not knowingly collect their personal data.

11. Changes

We may update this policy. The effective date at the top will change when we do. Material changes may also be noted in-product or by email.

12. Contact

Birch AI
Available on request via support@birch.so
support@birch.so
Marketing: trybirch.ai · App: app.trybirch.ai