Privacy Policy

Effective: June 5, 2026

Bare ("Bare," "we," "us," or "our") is operated by Bare Industries LLC, an Illinois limited liability company. This Privacy Policy explains what information we collect when you use Bare, how we use it, who we share it with, and the choices you have. It applies to our website at https://getbare.tech, the Bare web and mobile app, our API, our marketing materials, and any email or notification we send you (collectively, the "Service").

If you have questions about this policy, write to us at support@getbare.tech.

1. Who this policy applies to

This policy applies to you if you (a) sign up for an account, (b) use the Service as a technician invited by your shop, (c) request a demo or pilot, or (d) visit our marketing site. It does not apply to third-party services we link to from inside the Service.

2. Information we collect

Information you give us.

Account information. Your name, work email address, organization (shop) name, role (technician or shop admin), trade, phone number (for shop owners during onboarding), and password (stored as a one-way hash — we cannot see it).
Google sign-in. If you sign in with Google, we receive your Google account ID, email, and name as confirmed by Google. We do not receive your Google password or access your Gmail, Drive, or other Google data.
Content you submit. Chat prompts, diagnosis symptoms, part-lookup queries, equipment manufacturer and model numbers, nameplate photos and other images you upload, and follow-up questions.
Billing information. If you are a paying customer, we collect your billing email, billing contact name, and subscription preferences. Payment card data is handled by Stripe and is never sent to or stored by Bare.
Communications. Messages you send to support@getbare.tech or sales@getbare.tech.

Information collected automatically.

Usage data. Which features you use (chat, guided diagnosis, part lookup), workflow type, timestamps, token counts, and similar service-quality data.
Device and connection data. IP address, browser type, operating system, device type, referrer URL, and approximate location inferred from your IP.
Cookies. A single authentication cookie named bare_token (HTTP-only, secure, used to keep you signed in). We do not use advertising cookies, third-party trackers, or analytics that build a profile of you across other sites.

Information from third parties. When your shop's admin adds you to a roster, we receive your email address from your admin.

3. How we use your information

We use the information we collect to:

Provide, operate, secure, and improve the Service.
Authenticate you and keep your session active.
Process payments and send invoices and receipts (via Stripe).
Send service-related emails (invites, password resets, security notices, billing notices).
Respond to support requests.
Investigate and prevent fraud, abuse, and security incidents.
Comply with legal obligations.
Review and debug specific Service interactions, including reviewing prompts and AI responses to fix bugs and improve answer quality (see Section 5).

4. Legal bases (US contract law)

We are a US business and our customers are in the United States. We process your information because doing so is necessary to provide the Service you've contracted with us for, to comply with US law, and to pursue our legitimate interests in operating and securing the Service.

5. AI processing and content retention

This section is important and we want it to be clear.

Where prompts go. When you use chat, guided diagnosis, or part lookup, we send your prompt — along with any image you've attached and a system instruction we author — to Google's Gemini API for inference. Google is our AI subprocessor.

No model training on your content. Google's Gemini API does not use API inputs or outputs to train its models, and we do not train, fine-tune, or otherwise develop any AI model on your content. Your prompts and responses are used to provide and improve the Service for you and your shop — not to build a product sold to others.

What we retain. We store the full text of your prompts and the AI's responses in our database for up to 90 days so that:

We can debug specific issues you or your shop reports.
We can review answer quality and improve our system prompts.
We can investigate security incidents and abuse.

After 90 days, transcripts are eligible for deletion under our retention schedule. Active product-improvement work may extract general lessons (e.g., "users often ask about capacitor sizing"), but never republish your specific prompts or customer-identifying information.

Who can read transcripts. Access to transcripts is restricted to authorized Bare personnel acting under confidentiality obligations.

Images. Photos you upload (for example, nameplate photos in part lookup) are sent to Google Gemini for inference. We do not store the image bytes in our transcript database — we only record that an image was attached. The image is held in memory for the duration of the request and discarded.

Your right to request deletion. You or your shop admin can email support@getbare.tech at any time to request deletion of transcripts associated with your account.

6. How we share your information

We do not sell your personal information and we do not "share" it for cross-context behavioral advertising as defined by California law.

We share information with:

Service providers (subprocessors). Google (Gemini AI inference; Google Sign-In), Stripe (payment processing), Resend (transactional email), Vercel (frontend hosting), Railway (backend hosting), and our managed PostgreSQL provider. Each receives only the information necessary to perform its function and is bound by confidentiality obligations.
Your organization. If you are a technician invited to a shop, your shop admin can see your account, your usage counts, and whether you are active. Your shop admin can remove you from the roster, which ends your access.
Legal and safety. We may disclose information when we believe in good faith that it is required by law, subpoena, court order, or other legal process, or to protect the rights, property, or safety of Bare, our users, or the public.
Business transfers. If Bare is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will require any successor to honor this policy or notify you of material changes.
With your consent. For any other purpose, with your permission.

7. Cookies and tracking

We use one cookie: bare_token, an HTTP-only authentication cookie that keeps you signed in. We do not use advertising cookies. We do not embed third-party analytics that build a cross-site profile of you. Our hosting providers may set short-lived cookies necessary for routing and security.

8. Data retention

Account info (name, email, org): while your account is active, plus a short tail for billing and dispute resolution.
Prompts and AI responses (transcripts): up to 90 days from creation, then deleted on a rolling basis.
Usage logs (no prompt text): up to 24 months for service improvement and billing audits.
Billing records: as required by US tax and accounting law (typically 7 years).
Support emails: while needed to resolve issues, then archived.

When your account is closed, we delete or anonymize the data above except where retention is required by law.

9. Security

We use industry-standard safeguards to protect your information:

TLS encryption for all data in transit.
Encryption at rest where our hosting providers offer it.
Least-privilege access to production systems.
Password hashing using modern algorithms; we never see or store plaintext passwords.
No public access to transcripts; admin endpoints are role-gated.

No system is perfectly secure. If we learn of a security incident that affects you, we will notify you as required by applicable law.

10. Your California privacy rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know. You can ask us what categories of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of recipients.
Right to access. You can request a copy of the specific personal information we hold about you.
Right to delete. You can ask us to delete personal information we have collected from you, subject to legal exceptions.
Right to correct. You can ask us to correct inaccurate personal information.
Right to opt out of "sale" or "share." Bare does not sell or share your personal information as those terms are defined under California law.
Right to non-discrimination. We will not deny you service, charge a different price, or provide a different level of service because you exercised any of these rights.
Authorized agents. You may designate an authorized agent to make a request on your behalf; we may verify the agent's authority.

To exercise any of these rights, email support@getbare.tech with the subject line "California Privacy Request." We will verify your identity by matching the email address on file before fulfilling the request.

11. Children

The Service is intended for working professionals and is not directed to anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us at support@getbare.tech and we will delete it.

12. International users

Bare is a US-based service and our infrastructure is hosted in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States, which may have different data protection laws than your home country.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by an in-app notice before the change takes effect. Continuing to use the Service after a change means you accept the updated policy. The "Effective" date at the top reflects the current version.

14. Contact us

Questions, requests, or concerns about this Privacy Policy:

Bare Industries LLC support@getbare.tech