Privacy Policy

Last updated: 12 August 2026

This Privacy Policy explains how BARRA AI LIMITED ("Barra", "we", "us" or "our") collects, uses, shares and protects personal data across our services, products, software, digital properties, communications and business operations. It also explains the choices and privacy rights available to people worldwide.

BARRA AI LIMITED is a private limited company registered in England and Wales under company number 17014429. Our registered office is 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF. For privacy questions or requests, email hello@barra.ai.

References in this policy to the Barra website, blog, content downloads, Barra App or toolbar are examples, not an exhaustive list. Unless we provide a separate privacy notice for a particular activity, this policy also applies to current and future Barra services, products, features, software, APIs, trials, beta services, digital properties, communications, events, communities, promotions, support channels and online or offline business relationships.

1. Where this policy applies

Applies to: People who interact with Barra in any capacity, including website and digital-property visitors, end users, blog readers and subscribers, download requesters, prospects, leads, marketing contacts, event and community participants, promotion or survey participants, customers, authorised users, customer-site visitors, suppliers, contractors, advisers, integration and referral partners, other business partners, job applicants and representatives of any of these organisations.

1.1 Service-wide and non-exhaustive scope

This policy applies whenever Barra handles personal data in connection with a Barra-controlled service, product, feature, website, domain, subdomain, application, API, integration, documentation portal, marketplace listing, social channel or other digital property, and when we interact through email, telephone, video meeting, messaging, social media, post or in person. Examples describe current or expected activities but do not mean that every activity, data category or provider applies to every person.

1.2 Barra websites, digital properties and public content

This policy applies when you visit www.barra.ai or another Barra-controlled digital property, read our blog or documentation, submit a form, request a demonstration, contact us or otherwise interact with public content.

1.3 Subscriptions, content, marketing and sales follow-up

This policy applies when you subscribe to updates, request a guide, report, checklist or other download, or agree to receive marketing follow-up. We use your details to deliver what you requested. We send promotional follow-up only where permitted by applicable law, including where you have given the required consent or where a business-to-business marketing rule or valid customer soft opt-in applies. You can unsubscribe at any time.

1.4 Communications, events, communities, research and promotions

This policy applies when you communicate with Barra, join a webinar, event, group or community, participate in a survey, research activity, referral programme, competition or other promotion, engage with our social channels, or receive sales, service or support communications. If a particular activity requires additional information or consent, we will provide it at the relevant time.

1.5 Barra software and customer services

This policy applies to people who create or use an account at app.barra.ai or another Barra service, administer a workspace or account, configure Barra software or integrations, use a trial or beta feature, manage billing, receive service communications or request support.

1.6 Barra acting for customers

When a Barra customer deploys the toolbar or uses another Barra service to process information for its own purposes, that customer normally decides why the service is used, which features are enabled and what end-user information is collected. The customer is normally the controller or business responsible for that processing, and Barra acts as its processor or service provider. The customer's own privacy notice should explain its use of Barra and provide any required choices.

Barra may act as an independent controller for limited processing needed to protect the service, prevent fraud and abuse, meet legal obligations and understand the performance of Barra's own service. This policy covers that processing.

1.7 Business relationships and recruitment

This policy applies when we develop or manage a relationship with a prospective or existing customer, supplier, contractor, adviser, integration provider, referral or channel partner, investor or other business contact, including sales, procurement, due diligence, contracting, invoicing and relationship management. It also applies to job applicants where no more specific applicant notice is provided.

1.8 Worldwide users

Barra is established in the United Kingdom and uses UK data protection law as its primary privacy framework. We also respect mandatory privacy rights that apply in other countries and regions. The regional section below explains additional rights that may apply depending on where you live.

2. Our role and responsibility

Applies to: All audiences.

2.1 When Barra is a controller

Barra is a controller when it determines why and how personal data is processed, including for Barra-controlled digital properties, direct marketing, sales, events, communities, research, account administration, billing, security, support, product improvement, supplier and partner management, recruitment and our direct relationship with users and business contacts.

2.2 When Barra is a processor or service provider

Barra acts on a customer's documented instructions when it processes personal data solely to provide customer-configured Barra services. Depending on the service and contract, this may include customer content, authorised-user information, customer-site visitor or other end-user data, integrations, support material and service analytics. Customers are responsible for giving people appropriate notices, selecting a lawful basis, obtaining any required consent and responding to requests. If your data was provided to Barra through one of our customers, you should normally contact that customer first.

Barra's role is determined by the facts and applicable law, not only by a contractual label. Barra may be a processor for one activity and a controller for separate account, billing, security, legal or service-improvement processing relating to the same customer relationship.

2.3 Conflicting instructions

If a customer instructs Barra to process data in a way that Barra reasonably believes breaches applicable data protection law, Barra may suspend the affected processing while the parties resolve the issue.

3. Personal data we collect

Applies to: The audiences identified for each category below.

3.1 Contact and professional information

Applies to: Website, blog, downloads, marketing, App and support.

We may collect your name, work email address, organisation, role, country, contact preferences and any other information you choose to enter in a form or communication.

3.2 Account, workspace and configuration information

Applies to: Barra App customers and users.

We collect login and authentication identifiers, first and last name, email address, company and country, account and workspace identifiers, memberships and roles, website domains, onboarding answers, configuration settings, selected modules and integrations, invitation details, account status and records of acceptance of the Terms and acknowledgement of this policy.

3.3 Billing and transaction information

Applies to: Barra App customers and billing contacts.

We process plan, subscription, credit and usage information, transaction currency, billing contact details, billing and legal-business country, billing address, tax details where required, and Stripe customer, checkout and subscription references. Payment card details are collected and processed on Stripe-hosted payment pages; Barra does not store complete payment card numbers in its application database.

3.4 Website, device and usage information

Applies to: Website, blog, App and customer-site visitors.

We and our providers may collect IP address, approximate location derived from IP, browser and device type, operating system, page URL and path, referral source, page title, screen or viewport size, dates and times, session and visitor identifiers, events, clicks, toolbar interactions, module identifiers, experiment and goal information, performance measurements and diagnostic data.

3.5 Customer-site toolbar information

Applies to: Visitors to customer websites using Barra.

Depending on the customer's configuration, Barra may process a pseudonymous session identifier and visitor identifier, the page path or full page URL, referrer, device category, module interactions, experiment assignments, CTA or goal events, toolbar display and performance events, and timestamps. Page URLs may contain query parameters. Website operators should not place sensitive or unnecessary personal data in URLs.

3.6 Feedback, likes, support and communications

Applies to: Customer-site visitors, App users and anyone contacting Barra.

We may collect feedback sentiment and message text, like or heart interactions, page URL and path, session and browser identifiers, support requests, chat interactions with Barra, email correspondence, diagnostic details and attachments you choose to provide. Do not submit special-category, highly sensitive or confidential data unless it is necessary and we have asked for it through an appropriate secure channel.

3.7 Marketing engagement information

Applies to: Blog subscribers, download requesters and marketing contacts.

We may record the form, campaign or content you interacted with, subscription status, consent or opt-out record, emails sent, delivery and engagement events, event attendance, sales contact history and suppression-list status.

3.8 Security and anti-abuse information

Applies to: All digital services.

We process IP addresses, request identifiers, authentication and session events, security logs, rate-limit information, error reports, fraud signals and hashes derived from identifiers or message content where needed to prevent spam, misuse and attacks.

3.9 Cookies and similar technologies

Applies to: Website, blog, App and customer-site visitors.

We use cookies, local storage, session storage, tags, pixels and related technologies. Our Cookie Policy describes these technologies, their purposes and your controls.

4. How we collect personal data

Applies to: All audiences.

4.1 From you

We collect information you provide when you create an account, submit a form, subscribe, request content, configure Barra, make a purchase, invite a user, provide feedback or contact us.

4.2 Automatically

We collect technical, usage and security information when you use our website, App or a configured Barra toolbar, subject to applicable consent requirements and customer settings.

4.3 From customers and authorised users

A customer or account administrator may give us your business contact details, invite you to a workspace, configure processing that involves customer-site visitors or submit a support request concerning you.

4.4 From service providers and business partners

We may receive payment status from Stripe, authentication information from Supabase, marketing and website engagement from HubSpot and analytics providers, delivery information from communications providers, and information from referral, integration or support partners.

5. Why we use personal data and our legal bases

Applies to: All audiences. A legal basis is stated where UK GDPR or EU GDPR applies.

5.1 Provide the website, requested content and App

We use personal data to deliver pages and downloads, create and secure accounts, provide the toolbar, save configurations, administer workspaces, process billing, provide support and communicate service information. Our legal bases are performance of a contract, steps requested before entering a contract and our legitimate interests in operating our business.

5.2 Blog subscriptions and marketing follow-up

We use contact and engagement data to deliver subscriptions and, where permitted, send product news, educational content, event invitations and sales follow-up. Our legal basis is consent where consent is required. In limited situations we may rely on a valid customer soft opt-in or legitimate interests for permitted business-to-business marketing. We do not treat acceptance of our Terms or acknowledgement of this Privacy Policy as marketing consent.

5.3 Billing, tax and records

We use transaction and account information to take payment, renew subscriptions, administer credits, prevent fraud, keep financial records and meet tax and accounting obligations. Our legal bases are contract and legal obligation.

5.4 Analytics, product improvement and experiments

We use aggregated and individual usage information to understand performance, improve features, test changes and measure outcomes. Where required for cookies or similar technologies, our legal basis is consent. For subsequent processing that does not require consent, we rely on legitimate interests in improving and measuring our services, balanced against your rights.

5.5 Security, fraud prevention and enforcement

We use account, device, request and security information to authenticate users, detect abuse, apply rate limits, investigate incidents, enforce our Terms and protect Barra, customers and visitors. Our legal bases are legitimate interests and, where relevant, legal obligation.

5.6 Legal claims, compliance and corporate transactions

We may process data to respond to lawful requests, protect rights, establish or defend legal claims, complete audits and support a financing, merger, acquisition, restructuring or sale. Our legal bases are legal obligation and legitimate interests.

6. Marketing choices

Applies to: Blog subscribers, download requesters, leads, customers and other marketing contacts.

6.1 Requested content is separate from marketing

We may use your email address to send the download, subscription confirmation or other content you requested. Receiving the requested item does not by itself mean that you have agreed to unrelated promotional email.

6.2 Consent and permitted business marketing

Where the law requires consent, marketing permission will be requested clearly and separately. Where the law permits business marketing without prior consent, we may rely on legitimate interests but will respect objections and opt-outs.

6.3 Unsubscribing

You can unsubscribe using the link in a marketing email or by emailing hello@barra.ai. We may retain a minimal suppression record so that we continue to honour your request. Unsubscribing from marketing does not stop necessary service, security, billing or legal communications.

7. How we share personal data

Applies to: All audiences, depending on the service used.

7.1 Infrastructure and hosting

We use providers including Supabase for database and authentication services, Vercel for application hosting and operational services, and infrastructure and security providers needed to deliver and protect the service.

7.2 Website, CRM and marketing

We use HubSpot for website content, forms, customer relationship management, subscriptions, marketing operations and selected service-email activity records. We may use Google Analytics, Google Tag Manager, PostHog and Vercel analytics services for measurement and product analytics, subject to applicable consent requirements.

7.3 Payments and tax

We share transaction and billing information with Stripe and relevant payment, tax, banking and fraud-prevention providers.

7.4 Communications and support

We use providers including Resend for transactional email and may use Tawk and Userback for chat, support, feedback and diagnostics where those services are enabled.

7.5 Customer-selected integrations

If a customer enables an integration, data may be sent to or received from that provider under the customer's instructions and the provider's own terms. For example, a Barra module may activate a customer's existing chat, analytics, consent or search service.

7.6 Professional advisers, authorities and transactions

We may share data with auditors, insurers, lawyers, accountants, regulators, courts, law-enforcement bodies, potential investors or transaction counterparties where reasonably necessary and legally permitted.

7.7 No sale for money

We do not sell personal data for money. Some privacy laws define "sale", "sharing" or "targeted advertising" broadly enough to include certain analytics or advertising disclosures. Where such a law applies, we will provide the required notice and opt-out mechanism.

8. International processing and transfers

Applies to: All audiences.

8.1 Processing locations

Barra is a UK company and configures its primary application services in European hosting regions where reasonably available. However, the United Kingdom is not part of the EU or EEA, and some current infrastructure, support and specialist providers may process or access data in the United Kingdom, EEA, United States, Singapore and other countries where they or their subprocessors operate. We therefore do not represent that every category of data remains exclusively inside the European Union.

8.2 Transfer safeguards

When personal data is transferred from the United Kingdom or EEA to a country without an applicable adequacy decision, we use an appropriate safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, the EU Standard Contractual Clauses or another legally recognised mechanism. We may also rely on a permitted derogation in limited circumstances.

8.3 Copies of safeguards

You may contact us to request further information about the safeguard relevant to your data. We may redact confidential or commercially sensitive provisions.

9. Retention

Applies to: All audiences.

9.1 General rule

We keep personal data only for as long as reasonably necessary for the purpose collected, including to provide the service, meet legal, tax and accounting duties, resolve disputes, enforce agreements and protect security. Retention may be extended where a complaint, investigation, litigation hold or legal duty applies.

9.2 Current retention examples

• Raw Barra toolbar analytics are generally retained for 7 days on Free, 14 days on Starter, 30 days on Professional and 90 days on Advanced plans.
• Aggregated analytics may be retained for periods ranging from 30 days to 730 days, depending on the aggregation and plan.
• Unauthenticated abandoned onboarding sessions are generally eligible for deletion after 24 hours; authenticated incomplete onboarding sessions after 30 days.
• Feedback anti-abuse guard records are generally retained for 72 hours.
• Account, workspace, billing, feedback, like, CRM, audit and security records are retained while needed for the service, customer instructions, fraud prevention, legal compliance or claims. Some of these records do not currently have a fixed automatic deletion date and are subject to necessity-based review.
• Marketing contact records are retained while the relationship remains active. Suppression records may be retained after opt-out so we can honour the request.

9.3 Deletion and backups

Account deletion may initially restrict or soft-delete active records rather than immediately erase every copy. Data may remain for a limited period in backups, audit logs, fraud-prevention records and provider systems before deletion or irreversible anonymisation, or longer where law requires.

10. Security

Applies to: All audiences.

We use technical and organisational measures designed to protect personal data, including access controls, authentication, encryption in transit, environment separation, monitoring, rate limiting and restricted administrative access. No online service can guarantee absolute security. Customers must also secure their accounts, devices, websites, credentials and integrations and promptly tell us about suspected compromise.

11. Your privacy rights

Applies to: All audiences, where the stated law applies.

11.1 UK, EEA and Switzerland

You may have the right to access, correct or erase personal data; restrict processing; receive portable data; object to processing based on legitimate interests or direct marketing; and withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully.

You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint/. Barra's ICO registration is pending; we will add the registration number after it is issued. If EU or Swiss law applies, you may also complain to your local supervisory authority.

11.2 United States

Depending on your state and whether the relevant law applies to Barra, you may have rights to know or access personal data, correct inaccuracies, delete data, obtain a portable copy, opt out of sale, sharing, targeted advertising or certain profiling, limit certain sensitive-data uses, receive equal service and appeal a refusal. We may need to verify your identity. An authorised agent may submit a request where local law permits.

11.3 Canada

Where Canadian private-sector privacy law applies, you may request access and correction, ask how data has been used or disclosed, withdraw consent subject to legal or contractual limits, and challenge our compliance. You may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

11.4 Brazil

Where Brazil's Lei Geral de Proteção de Dados applies, you may have rights to confirmation, access, correction, anonymisation, blocking or deletion, portability, information about sharing, consent withdrawal and review of qualifying automated decisions. You may complain to the Autoridade Nacional de Proteção de Dados.

11.5 Australia and New Zealand

Where applicable, you may request access and correction and make a privacy complaint to us. You may also contact the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner in New Zealand.

11.6 Other locations

We will honour other mandatory local rights where they apply. These may include rights to access, correct, delete, restrict, object, withdraw consent or complain to a regulator.

11.7 How to exercise a right

Email hello@barra.ai and describe your request. We may ask for information needed to verify your identity and authority. If Barra processes your data only for a customer, we may refer the request to that customer and assist it as required.

12. Children

Applies to: All services.

The Barra App is intended for people aged 18 or over acting in a business or professional capacity. Our website and services are not directed to children, and we do not knowingly collect personal data from children under 16. Contact us if you believe a child has provided data to Barra without appropriate authority.

13. Third-party sites and services

Applies to: Website, App and customer-site visitors.

Our services may link to, activate or integrate with services controlled by other organisations. Their privacy notices govern their independent processing. Barra is not responsible for a third party's privacy practices, although Barra remains responsible for selecting and managing its own processors as required by law.

14. Changes to this policy

Applies to: All audiences.

We may update this policy to reflect service, provider, legal or operational changes. We will change the date above and, where required, give additional notice or request renewed consent. Material changes do not retrospectively create marketing consent.

15. Contact us

Applies to: All audiences.

Email: hello@barra.ai

Post: BARRA AI LIMITED, 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF.