Privacy Policy

Last updated: August 15, 2026

Knightian Labs, LLC (“we”, “us”, or “our”) is the data controller for the Bridge Town platform and website at https://www.bridgetown.builders/ (the “Service”). This Privacy Policy describes how we collect, use, and protect your information when you use the Service.

1. Information We Collect

Account Information

When you sign up for Bridge Town, we collect:

• Auth0 profile data: your name, email address, and profile picture as provided via Auth0 or your OAuth provider (Google).
• Organisation information: your company or team name if provided during onboarding.

Financial Model Data

Bridge Town is a financial planning and analysis platform. When you use the Service, we store:

• Financial models and plans you create or import, including any data you upload (CSV, spreadsheets, etc.).
• Model code and version history stored in your tenant’s versioned model storage.
• Query results and snapshots generated by the DuckDB query engine from your data.

You retain ownership of all financial data you upload or create. We process it solely to provide the Service.

Usage Analytics

We collect anonymised usage data to improve the Service using PostHog and Google Analytics. This includes:

• Pages visited and features used within the platform.
• Session duration and interaction patterns.
• Error logs and performance metrics.

PostHog and Google Analytics use cookies and similar tracking technologies to recognise returning visitors and understand page usage. This data does not include the content of your financial models. PostHog’s data processing is governed by PostHog’s Privacy Policy, and Google Analytics data processing is governed by Google’s Privacy Policy.

2. How We Store Your Data

Encryption and Security

• At rest: All data stored in our PostgreSQL database is encrypted at rest using AWS RDS encryption (AES-256).
• In transit: All communication between your browser and our servers uses TLS 1.2 or higher.
• Object storage: Files and snapshots stored in Amazon S3 use server-side encryption.

Tenant Isolation

Bridge Town enforces strict tenant isolation using PostgreSQL Row-Level Security (RLS). Your data is logically separated from other tenants’ data at the database level. Every query is automatically scoped to your organisation.

3. Third Parties We Share Data With

We use the following third-party services to operate the platform:

We do not sell your personal data to third parties. AI providers you select are not Bridge Town subprocessors; any data they process is governed by your separate agreement with that provider.

For a complete list of third-party services and subprocessors, see our Subprocessors page.

Bridge Town does not call or host LLMs on your behalf

Bridge Town is a Bring Your Own AI Client (BYOC) platform. You connect a local or provider-hosted AI client — such as Claude, Codex, Gemini, or any MCP-compatible client — to Bridge Town’s MCP server. Your prompts travel from your AI client to the provider you selected; they do not pass through Bridge Town’s infrastructure.

Bridge Town receives only structured MCP tool calls: typed inputs such as model names, Python code to store, or SQL query strings. We do not have access to the conversational context between you and your AI agent.

When you connect Claude.ai, ChatGPT, or another OAuth-capable MCP host, Bridge Town requests the complete capability set described on the MCP scopes page. Those permissions allow the host to send tool calls that can read and change Bridge Town content, execute models, edit separately authorized Google Sheets, and manage sharing. Each call remains subject to your workspace role, model grants, and tenant isolation. If you decline the connection, no MCP access is established; if host policy removes a capability, tools requiring it fail before any effect.

If you choose an AI client that processes data on your behalf, your relationship with that AI provider is governed by that provider’s terms and privacy policy, not ours. Bridge Town does not receive or retain the conversational context exchanged between you and that client unless you separately send content to a Bridge Town tool.

PostHog Analytics

We use PostHog to understand how users interact with Bridge Town. PostHog collects anonymised event data (page views, feature clicks, session replays where enabled) using cookies stored in your browser. No financial model content is included in analytics events. PostHog may process data outside your jurisdiction; see PostHog’s Privacy Policy for details. You can opt out of analytics tracking by enabling “Do Not Track” in your browser settings.

Google Analytics

We use Google Analytics to understand public website traffic and content performance. Google Analytics collects page views, browser/device metadata, and approximate geography using cookies and similar technologies. No financial model content is included in analytics events. See Google’s Privacy Policy for details.

4. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate data be corrected.
• Deletion: Request deletion of your account and associated personal data. Financial model data will be deleted within 30 days of account closure.
• Data export: Export your financial models and data in standard formats (CSV, JSON, versioned model archive) via the account settings page.
• Objection: Object to certain processing activities.

To exercise any of these rights, contact us at privacy@bridgetown.builders.

5. Data Retention

• Account data: Retained for the duration of your subscription and for 90 days after account closure (to allow recovery).
• Financial model data: Deleted within 30 days of account closure upon request.
• Usage analytics: Retained in aggregated, anonymised form for up to 2 years. PostHog and Google Analytics cookies persist according to each provider’s configured retention period.
• Billing records: Retained for 7 years as required by law.

6. Children’s Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice within the Service at least 14 days before the change takes effect. The updated “Last updated” date at the top of this page will always reflect the most recent revision.

8. Contact Us

For privacy-related questions or to exercise your rights, contact:

Knightian Labs, LLC (trading as Bridge Town) Email: privacy@bridgetown.builders

For DPA requests or security review enquiries, see our Security and Compliance page.