Privacy Policy

Last updated: 9 September 2026

This policy explains what personal data Bremlio Ltd ("Bremlio", "we", "us") collects, why, and what rights you have over it — for people who create a Bremlio account, and for people whose phone numbers our customers message through Bremlio.

Two kinds of personal data we process

Bremlio is a messaging API, so we sit in two different roles depending on whose data it is:

• Account data (we are the controller). Information about you when you sign up for a Bremlio account — email, password, company name, phone, and the business details we collect for account review (see "Account verification" below).
• Message data (we are a processor). When one of our customers sends a message through the Bremlio API, the recipient's phone number and the message content pass through our systems so we can deliver it. We process this on the customer's behalf and instruction — we don't use it for our own purposes, and we don't sell it.

Account data we collect

What	Why
Email, password (stored as a salted hash, never in plain text)	Create and secure your account
Company name, phone (optional)	Identify your business; phone is used to send an OTP verification code
Business website, use case, company number (optional)	Account review before your account can send messages (see below) — required by UK anti-spam and messaging-abuse obligations
Payment details	Handled entirely by Stripe. Bremlio never receives or stores your card number — see "Third parties" below

Account verification

Every new Bremlio account is held for review before it can send messages. As part of that review, the business website and use-case description you provide may be checked automatically (including by an AI-assisted risk-scoring step) and by a human reviewer, to confirm the account is a genuine business and not being used for spam, fraud or abuse. This is a condition of using a messaging platform under UK anti-spam and telecoms regulation, not optional profiling — it runs on every account, and a human makes every approve/reject decision.

How message data is used and who it's shared with

When a message is sent through the Bremlio API, the recipient's phone number and message content are shared with the SMS carrier that delivers it, purely to complete delivery. We do not use recipient data for our own marketing or profiling.

If a recipient replies STOP (or a recognised equivalent) to a message, we add their number to a suppression list and block all further messages to it automatically — this applies platform-wide, not just to one customer.

Third parties we share data with

Who	What they receive	Why
Amazon Web Services (AWS)	All account and message data	Hosting and infrastructure. Bremlio's UK infrastructure runs in AWS's London (eu-west-2) region
Stripe	Payment/card details, billing email	Payment processing for credit top-ups. Stripe is its own data controller for this data — see Stripe's privacy policy
SMS carriers (currently Webex Interact and The SMS Works)	Recipient phone number, message content	Message delivery
AWS Bedrock (AI service)	Business website, use-case description (account data, not message content)	Automated part of account-review risk scoring, described above

We don't sell personal data to anyone, and we don't share it for third-party advertising.

Cookies and tracking

The Bremlio website does not use cookies or third-party analytics/advertising trackers. The dashboard uses your browser's sessionStorage to keep you signed in — this stays on your device, is cleared when you close the tab, and is never sent to a third party.

We count page visits and which campaign (for example a social media post) brought you here, using your browser's localStorage and a same-day, non-identifying visit count — this never uses cookies, is never sent to a third party, and isn't used to recognise you on a later visit. If you sign up, we note which campaign you arrived from against your account so we know which of our own promotions are working.

How long we keep data

We keep account and message data for as long as your account is active, plus a reasonable period afterwards to meet our own legal, accounting and anti-fraud obligations. We're in the process of formalising exact retention periods for each category of data; if you'd like detail on a specific record, contact us and we'll confirm it.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data, where we're not required to keep it for a legal reason
• Restrict or object to certain processing
• Receive your data in a portable format

To exercise any of these, email hello@bremlio.com. If you're not satisfied with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Changes to this policy

We'll update the date at the top of this page whenever this policy changes materially.