The Ace Fixer (“we,” “our,” or “us”) operates BrokerAI (the “Service”) at https://broker-ai.app. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit the website, create an account, or use the app.

BrokerAI is a private AI broker. You describe what you need in conversation. The broker looks for a compatible counterpart, shows you a screened brief, and introduces you only when both sides accept. This policy covers that Service, including when you sign in with Google.

Account information

When you create an account we collect the identity we need to run the Service and to introduce you later:

• Email address — from Google Sign-In or from the magic-link address you enter.
• Name — from Google account profile data, or from the name you type on the create-profile form after a magic link.
• Gender — from Google (when you grant that permission) or from the choice you make on the create-profile form (Woman, Man, or Other).
• Date of birth — from Google (when you grant that permission) or from the date you enter on the create-profile form.
• Email-me-when-I’m-away preference — a toggle in the app that defaults to on. You can turn it off at any time.

We do not currently collect a password for the product itself (sign-in is Google or an email magic link). We do not currently collect billing information, company name, job title, phone number, or home address in the product UI. Optional phone and location columns exist in our profile store for later use and stay empty unless we add those fields and tell you.

User-generated content

We store content you create in the Service, including:

• Messages you send to the broker, and messages the broker sends you.
• The living brief of your request (what you are looking for), plus titles and summaries the broker writes from that conversation.
• Your Interested / Skip choices on candidate cards, match-lane chat, and any 1:1 messages after both sides connect.
• Files and links you attach (photos, documents, URLs), plus any caption you type with an upload. The broker may write a short description of a file from the conversation and the file type so it can share the right item later. We do not run vision or OCR on file bytes today.

Usage and technical data

We automatically collect:

• Application logs needed to operate and debug the Service (including request times, error traces, and typical web server data such as IP address and user agent).
• Session and authentication cookies so you stay signed in.
• If you enable browser notifications: a Web Push subscription (endpoint and encryption keys for that browser). Push is used for 1:1 connection messages when that window is not focused.

We do not currently use a third-party product-analytics tracker (for example Google Analytics) on the public site or in the app.

If you choose Continue with Google, Google authenticates you and (with your consent) shares account data with our sign-in provider. We request these Google scopes:

• openid, email, profile — Google user id, email address, name, and profile picture URL.
• user.gender.read and user.birthday.read — gender and date of birth from the Google People API, used only to complete the same profile fields magic-link users type themselves.

Name and email. We copy your Google display name and email into your BrokerAI profile so we can sign you in and later introduce you by name.

Profile picture. Google’s profile scope includes your account photo. That URL is received by our authentication provider (Supabase) as part of the Google user record. The BrokerAI app currently shows initials from your name in the sidebar, not that photo. We do not copy the picture into our application profile table, and we do not show it to other users.

Gender and date of birth. Standard Google Sign-In does not include these. We ask for them so introductions can use the same identity fields for every account. If Google does not return them (missing year, declined permission, or People API unavailable), we still create your profile from name and email. We do not invent empty form fields to replace a declined Google permission.

We use the Google access token once at sign-in to read name, gender, and birthday. We do not store that Google token in our application profile database. We do not read your Gmail, Drive, Calendar, Contacts list, or other Google products. We do not post to Google on your behalf.

We do not use your Google data or your chats to send marketing newsletters. We do not sell personal information. We do not run ads on the Service.

To find a counterpart, the broker builds a living brief from your conversation and indexes a semantic representation of that brief. Identity details such as email, phone, and handles are redacted from text that would otherwise cross to the other party before an accepted introduction.

Candidate cards on Your request show a short brief. They do not show the other person’s name, email, photo, gender, or date of birth. A match lane exists only after you tap Interested. The other person is not shown your private screening of them.

After both of you accept an introduction, we may share a contact card that can include name, email, gender, and date of birth from the profile. The in-app card currently displays name and the request title; the underlying payload may still carry those extra fields for the broker. Files classified as personal are shared only after you allow it. Files classified as shareable (for example a resume or listing photos) can be delivered into an open match by the broker.

Message content, briefs, and file metadata are sent to large language model providers so the broker can understand you and choose tools. File image bytes are not sent to a vision model today. Model providers process that content to return a reply; they are not a public audience.

Account and product data live in PostgreSQL hosted by Supabase (currently AWS ap-northeast-1, Tokyo). Authentication is handled by Supabase Auth. Uploaded files live in a private Supabase Storage bucket and are reached only through our API after authorization, using short-lived signed URLs. The web app is hosted on Vercel. The API runs on Fly.io in Tokyo (nrt). Vector index data for briefs is stored with the API.

We encrypt data in transit (HTTPS / TLS). Access to production systems is limited to operators of the Service. We do not claim SOC 2 certification or a public penetration-test program at this time.

If a breach of personal information occurs, we will notify affected users and, where required, supervisory authorities without undue delay (including within 72 hours where GDPR requires it), with the nature of the incident and the steps we are taking.

We use the following processors. Each has its own privacy policy.

We do not use a payment processor. There is no subscription billing in the current Service.

We do not sell your personal information. We share data:

• With a counterpart you match — only under the introduction and file-sharing rules above, after you act in the product (Interested, accept introduction, allow a personal file).
• With service providers — the processors listed above, strictly to operate the Service.
• For legal compliance — when required by law, subpoena, or court order, or to protect the Service and its users.
• During a business transfer — in connection with a merger, acquisition, or asset sale. We will notify you if that happens.

There are no team or organization admin plans. Nobody else gets a dashboard over your chats.

The current product does not include a self-serve “delete my account” button. Email privacy@broker-ai.app to request deletion of your account and associated data. We will remove or anonymize personal data we control, except where we must keep a record (for example a legal hold or a security log).

All users

• Access — request a copy of the personal data we hold.
• Correction — ask us to fix inaccurate name, gender, or date of birth.
• Deletion — request deletion of your account.
• Export — request a machine-readable copy of your profile and chats.
• Email opt-out — turn off “Email me when I’m away” in the app, or use the unsubscribe link in an activity email.

GDPR (EEA/UK residents)

You may also have the right to restrict processing, to data portability, to withdraw consent (for example notification permission or Google scopes by disconnecting Google), and to lodge a complaint with a supervisory authority. We have not appointed a separate Data Protection Officer; contact privacy@broker-ai.app.

CCPA (California residents)

You have the right to know what personal information is collected, to request deletion, to opt out of the sale of personal information (we do not sell data), and to non-discrimination for exercising those rights.

To exercise any of these rights, email privacy@broker-ai.app.

We use cookies and similar storage for:

• Authentication — Supabase session cookies so you stay signed in. These are required for the app to work.
• Security — to complete the sign-in code exchange (PKCE) in the same browser that started login.

We do not use advertising cookies. You can clear cookies in your browser; doing so will sign you out.

If you use the Service from outside Japan, your data is transferred to and processed in Japan (Supabase Tokyo, Fly.io Tokyo) and in the countries of our other processors, including the United States (Google, Vercel, Resend, and model providers). Where required, we rely on appropriate safeguards such as the processors’ Standard Contractual Clauses and their data processing terms.

The Service is for adults. It is not intended for anyone under 18. We do not knowingly collect personal information from children. Because we store date of birth for introductions, do not use BrokerAI if you are under 18. If you believe we have collected data from a minor, email privacy@broker-ai.app and we will delete it.

We will post updates on this page and change the “Last updated” date. For material changes we will also notify you by email or in the app when we can. Continued use of the Service after an update means you accept the revised policy.

For privacy questions, access or deletion requests, or Google Sign-In data:

• Privacy: privacy@broker-ai.app
• General: hello@broker-ai.app
• Operator: The Ace Fixer, website https://broker-ai.app

Email is the contact method for this policy.

Structure adapted from the SaaS / web app privacy template (PolicyForge / ryuno2525), rewritten to match what BrokerAI actually collects and does.

Back to home