Privacy Policy
Last updated 11 September 2026
This policy describes what personal information BM-i Prospect Engine handles, why, who it is shared with, and the choices and rights you have.
1. Who this policy covers
This policy explains how BrightMinds (“we”, “us”) handles personal information in BM-i Prospect Engine (the “Service”), a lead-qualification service that scores, researches and flags business leads for human review. It covers two groups of people:
- Users: staff of a Customer organisation who sign in to the Service.
- Prospects: business contacts whose details a Customer imports into, or the Service gathers for, that Customer.
For Prospect information, and for Users’ activity inside their organisation’s workspace, the Customer decides why and how the information is used. Under the Philippine Data Privacy Act of 2012 the Customer is the personal information controller and we are a personal information processor acting on its instructions (a “processor” under the GDPR). For account and billing information, and for keeping the Service secure, we act as the controller.
2. Information we process
- Account information (Users): name, work email address, role, a one-way hash of the password, two-factor authentication secrets and backup codes (stored encrypted), and session details such as IP address, browser type and sign-in times.
- Prospect information: name, job title, company, business email address and phone number, public professional-profile links, company website content, and other business details a Customer imports or the Service finds from public and licensed business-data sources, together with the qualification results, research notes and drafts the Service produces.
- Usage information: actions taken in the Service (for example approvals, edits and notes), technical logs and error reports needed to run and secure the Service.
- Billing information: organisation name, billing contact, invoices and payment status. Card details, where used, are handled by our payment provider and never stored by us.
3. How and why we use it
- To provide the Service: authenticate Users, store and display Prospect information, run the qualification, research and drafting features the Customer has enabled, and send notifications the Customer has asked for.
- To keep the Service secure: detect and prevent unauthorised access, abuse and fraud; enforce two-factor authentication and rate limits; keep audit records.
- To support and bill Customers and to communicate about the Service.
- To improve the Service using aggregated, de-identified usage statistics. We do not use Customer Data to train general-purpose AI models.
- To comply with the law and enforce our agreements.
4. Automated processing
The Service uses automated rules and artificial-intelligence models to score, research, summarise and draft. Results are shown to the Customer’s Users for review; the Service does not make legally significant decisions about individuals on its own. Prospects who want to know how information about them was assessed can contact the Customer or us using the details below.
5. Who we share it with
We share personal information only as needed to run the Service:
- Service providers (subprocessors) for cloud hosting and databases, transactional email delivery, business-data enrichment and search, and AI model processing. Each is bound by a written contract to process data only on our instructions and to protect it. A current list of subprocessor categories and locations is available on request.
- The Customer: Users’ activity and Prospect information are visible to other authorised Users of the same Customer workspace.
- Legal and safety: where required by law, court order or a competent authority, or to protect the rights, safety and property of Users, Customers, the public or us.
- Business transfers: if we merge with or are acquired by another organisation, personal information may transfer as part of that transaction under this policy.
We do not sell personal information and do not share it with third parties for their own marketing.
6. International transfers
Our providers store and process data in the United States and other countries. Where personal information about people in the Philippines, the European Economic Area, the United Kingdom or other jurisdictions with transfer rules leaves that jurisdiction, we rely on contractual safeguards (such as standard contractual clauses) and our providers’ security certifications.
7. How long we keep it
- Account information: for as long as the User’s account exists, then deleted or anonymised within 30 days of deactivation unless needed for billing or legal reasons.
- Prospect information: until the Customer deletes it or the Customer’s subscription ends. After termination it is deleted from live systems within 30 days and from backups within a further 30 days.
- Security and technical logs: for a limited period (normally no more than 90 days) unless needed to investigate an incident.
- Billing records: for the period required by Philippine tax and accounting law.
8. How we protect it
We encrypt data in transit and at rest, hash passwords with an industry-standard algorithm, require two-factor authentication for every User, restrict access by role, rate-limit sign-in attempts, apply security headers and keep audit logs. Access to production systems is limited to personnel who need it. No system is perfectly secure; if we learn of a personal-data breach that is likely to cause harm, we will notify the affected Customer without undue delay and, where required, the National Privacy Commission and affected individuals within the periods the law sets.
9. Your rights
Depending on where you live, you may have the right to be informed about, access, correct, delete, restrict or object to our processing of your personal information, to receive a copy in a portable format, to withdraw consent, and to complain to a supervisory authority (in the Philippines, the National Privacy Commission). You may also be entitled to damages where the law provides.
If you are a Prospect, the Customer that holds your information is usually the right first contact. You may also write to us at privacy@brightminds.com.ph; we will pass your request to the Customer and help them respond, or respond ourselves where we act as controller. We aim to reply within 15 working days.
10. Cookies
The Service uses only the cookies it needs to work: a session cookie to keep you signed in, a short-lived cookie during the two-factor step, and an optional “trusted device” cookie if you choose to skip the two-factor prompt for 30 days. We do not use advertising or cross-site tracking cookies.
11. Children
The Service is for business use by adults. We do not knowingly collect information from anyone under 18.
12. Changes to this policy
We may update this policy from time to time. Material changes will be announced by email or inside the Service at least 30 days before they take effect. The “Last updated” date at the top shows the current version.
13. Contact
Data Protection Officer, BrightMinds: privacy@brightminds.com.ph. You can also lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).