Privacy Policy

Last Updated: October 12, 2026

1. Introduction

Brainstorm IT LLC, a Delaware limited liability company doing business as Brainstorm IT ("we," "us," or "our"), is a software development consulting company. We provide software development consulting services and embedded product teams to businesses worldwide.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website (bstormit.com), submit our contact form, book a call with us, or email us. It applies to all visitors, prospective clients, and business contacts.

Brainstorm IT LLC is the data controller responsible for your personal information as described in this policy. If you have questions or concerns about how we handle your data, please contact us using the details provided in the "Contact Us" section below.

2. Information We Collect

We collect only the personal information necessary to respond to your inquiries and evaluate potential project engagements. The categories of information we collect are:

Contact Form Submissions

When you submit our contact form, we collect the following information:

Your name
Your email address
Where you are today (the situation that best describes your product or team, selected from a list)
Monthly budget range (selected from a list)
Project description (open text field)
File attachments (optional; up to 3 files, maximum 5 MB total; accepted formats include PDF, PNG, JPEG, GIF, WEBP, DOC, and DOCX)

Call Booking and Emails

Our Talk to Dan buttons open a Google Calendar appointment page, hosted by Google, where you can book a 30-minute intro call with Dan. When you book, Google processes the name and email address you enter, the time you choose, and any other details the booking form asks for, and adds the booking to our Google Workspace calendar, so we receive the same details.

When you email us directly, we receive your name, your email address, and the content of your message.

Server Logs

Our website is hosted on Amazon Web Services (AWS Amplify and Amazon CloudFront), with our primary region in Asia Pacific (Singapore). AWS automatically collects standard server log information, which may include:

IP address
Browser type and version
Timestamps of page requests

Analytics and Cookies

We use Google Analytics 4, a web analytics service provided by Google, to understand how visitors use our website. Google Analytics sets first-party cookies in your browser and collects information such as the pages you visit, how long you stay, the site that referred you, your device and browser type, and your approximate location derived from your IP address.

We also record a few website events in Google Analytics: when you click a Talk to Dan or Pick a time with Dan button (both open our Google Calendar booking page), when you click the email link on our contact page, and when you successfully submit the contact form. The form event includes the situation and budget range you selected. It does not include your name, email address, project description, or attachments.

We look at this information in aggregate to understand which pages and calls to action are useful. We do not use it to identify you personally.

When you dismiss the contact banner, our website stores a small flag in your browser's session storage so the banner does not reappear during your visit. The flag stays in your browser, is not sent to us, and is cleared when you close the tab.

How to Opt Out of Analytics

You can block or delete cookies in your browser settings, browse in a private window, or install the Google Analytics Opt-out Browser Add-on. The website works fully without analytics cookies.

3. How We Use Your Information

We use the personal information we collect to:

Respond to your inquiries submitted through our contact form
Evaluate potential projects and determine whether our services are a good fit for your needs
Schedule and conduct consultation calls
Understand, in aggregate, how visitors use our website so we can improve it (see Analytics and Cookies in Section 2)
Communicate with you about our services, including follow-up correspondence related to your inquiry
Comply with applicable legal obligations, including tax, accounting, and regulatory requirements

4. Lawful Basis for Processing (GDPR)

For individuals located in the European Economic Area (EEA) and the United Kingdom, we process personal information on the following legal bases under the General Data Protection Regulation (GDPR):

Legitimate Interest (Article 6(1)(f)): We have a legitimate business interest in processing inquiries from prospective clients in a business-to-business context. This includes reviewing contact form submissions, evaluating project requirements, and responding to inquiries. We have assessed that this processing does not override your rights and freedoms given its limited scope and business nature.
Legitimate Interest in Website Analytics (Article 6(1)(f)): We rely on our legitimate interest in understanding, in aggregate, how our website is used. You can object at any time by blocking cookies or using the opt-out add-on described in Section 2.
Pre-Contractual Steps (Article 6(1)(b)): When your inquiry relates to a potential engagement, we process your information as necessary to take steps at your request prior to entering into a contract. This includes evaluating project scope, scheduling discussions, and preparing proposals.
Legal Obligation (Article 6(1)(c)): We may process your information where required to comply with applicable legal obligations, such as tax or accounting requirements.

5. Third-Party Service Providers

We use a limited number of third-party service providers to operate our website and communicate with you. These providers act as data processors on our behalf and process your information only as necessary to provide their services.

Resend (email delivery): We use Resend, a US-based email delivery service, to send emails generated by our contact form. Resend is SOC 2 Type II compliant and maintains a Data Processing Agreement (available at resend.com/legal/dpa).
Google Analytics (website analytics): Google processes the usage data described in Section 2 in accordance with Google's Privacy Policy. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.
Google Workspace (email and Google Calendar call booking): Contact form submissions and emails you send us are delivered to and stored in our Google Workspace email accounts. When you book an intro call, Google hosts the appointment page, processes your booking details (name, email address, chosen time, and any other details the booking form asks for), and adds the booking to our Google Workspace calendar. Both are handled in accordance with Google's Privacy Policy and the Google Workspace Data Processing Agreement.
Amazon Web Services (hosting): Our website runs on AWS Amplify and is delivered through Amazon CloudFront, with our primary region in Asia Pacific (Singapore). AWS processes server logs as part of standard hosting operations, under the AWS Data Processing Addendum.

We do not sell, rent, or trade your personal information to any third party for marketing purposes or any other reason.

6. International Data Transfers

Our team works from the Philippines. The Philippines does not currently hold an adequacy decision from the European Commission under the GDPR. When we transfer personal data from the EEA to the Philippines, we rely on the European Commission's Standard Contractual Clauses (SCCs). For transfers from the UK, we rely on the SCCs together with the UK International Data Transfer Addendum, or on the UK International Data Transfer Agreement (IDTA).

Our website is hosted by Amazon Web Services, with our primary region in Asia Pacific (Singapore), and is delivered through Amazon CloudFront's global network. Transfers to AWS are covered by the AWS Data Processing Addendum, which incorporates the SCCs. For data processed by Resend in the United States, transfers are covered under the EU-US Data Privacy Framework, to which Resend adheres. For data processed by Google, including Google Calendar bookings, transfers are governed by Google's standard data processing terms, which incorporate SCCs and other approved transfer mechanisms.

We ensure that all international transfers of personal data are accompanied by appropriate safeguards to protect your rights and freedoms in accordance with applicable data protection laws.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this policy. Our retention periods are as follows:

Contact form submissions (no engagement): If your inquiry does not lead to a business engagement, we retain your information for 12 months from the date of submission, after which it is deleted.
Contact form submissions (leading to engagement): If your inquiry leads to a client relationship, we retain your information for the duration of the business relationship plus 6 years to comply with contractual and legal obligations.
Call bookings and emails: Retained on the same basis as contact form submissions above.
Analytics data: Retained in Google Analytics for the data retention period configured in our Google Analytics account, after which Google deletes it. Analytics cookies remain in your browser until they expire or you delete them.
Server logs: Retention is determined by the standard policies of our hosting provider, Amazon Web Services.

We conduct an annual review of our retention periods to ensure they remain appropriate and that data is deleted when no longer needed.

8. Your Rights

Depending on your location, you may have specific rights regarding your personal information under applicable data protection laws.

European Economic Area and United Kingdom (GDPR)

If you are located in the EEA or UK, you have the right to:

Access the personal data we hold about you and receive a copy
Rectification of inaccurate or incomplete personal data
Erasure of your personal data ("right to be forgotten")
Restrict processing of your personal data in certain circumstances
Data portability to receive your data in a structured, commonly used, machine-readable format
Object to processing based on legitimate interests
Withdraw consent at any time where processing is based on consent
Lodge a complaint with a supervisory authority: the data protection supervisory authority of your EU member state or, in Germany, of your federal state (Land). The European Data Protection Board lists every authority at edpb.europa.eu. For the UK, this is the Information Commissioner's Office (ICO).

Philippines (Data Privacy Act of 2012, RA 10173)

If you are located in the Philippines, you have the right to:

Access your personal information and be informed of how it is processed
Rectification of inaccurate or incomplete personal information
Erasure or blocking of personal information that is incomplete, outdated, false, or unlawfully obtained
Object to the processing of your personal information
Data portability to obtain your data in an electronic or structured format
Lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph

California (CCPA)

If you are a California resident, you have the right to:

Know what personal information we collect, use, and disclose about you
Delete personal information we have collected from you, subject to certain exceptions
Opt out of the sale of your personal information. We do not sell your personal information, so this right is already satisfied by default.
Non-discrimination for exercising your CCPA rights

To exercise any of these rights, please contact us at hello@bstormit.com. We will respond to your request within the timeframes required by applicable law (generally 30 days for GDPR requests and 45 days for CCPA requests). We may need to verify your identity before processing your request.

9. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that information. If you believe we have collected information from a child, please contact us at hello@bstormit.com.

10. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using HTTPS/TLS across our entire website
Access controls to limit who within our organization can access personal data
Use of third-party service providers that maintain recognized security certifications (such as SOC 2 Type II compliance)

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your data, but we are committed to maintaining and improving our security practices.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable laws. When we make changes, we will update the "Last Updated" date at the top of this page and post the revised policy on our website.

For material changes that significantly affect how we process your personal information, we will make reasonable efforts to notify affected individuals where feasible, such as by posting a prominent notice on our website or sending an email to the address you provided.

We encourage you to review this policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: hello@bstormit.com
Company: Brainstorm IT LLC, a Delaware limited liability company
Mailing address: Brainstorm IT LLC, 254 Chapman Rd, Ste 208 #21505, Newark, DE 19702, USA

To exercise your data subject rights (such as access, rectification, erasure, or portability), please send your request to the email address above. Include your full name and the email address associated with your inquiry so we can locate your data and verify your identity. We will acknowledge your request within 5 business days and provide a substantive response within the timeframes required by applicable law.