Privacy policy

Last updated 30 October 2026

Brightwell Solutions runs Brightwell Hub, an email marketing service that businesses (our clients) use to email their own customers and subscribers. This policy explains what we collect, why, and what you can do about it. Use of the service is also covered by our terms of service. You can reach us at [email protected].

If you sign in to Brightwell Hub

Staff of our clients sign in with Google. Google shares your name, email address and profile picture with us, and nothing else. We use them only to sign you in, to check that you were invited, and to show your colleagues who made a change. We also keep your display preferences and a sign-in cookie.

We do not ask for or use your Gmail, contacts, calendar, files or any other Google data. We do not sell this information, use it for advertising, or share it with anyone except as described below. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you get emails from a business that uses Brightwell Hub

The business that emails you decides what it sends and to whom; it is responsible for your information, and we handle it on its behalf. For that business we store:

• your email address, name and preferred language;
• your consent to marketing: the wording you agreed to, when, and the IP address and browser it came from;
• answers you gave in a signup form;
• activity its online store shares with us, such as orders and items left in a cart;
• whether its emails to you were delivered, opened or clicked, measured with links and a small image in each email.

We use this only to send that business's emails and to report back to it. Every marketing email has an unsubscribe link that works straight away. To see, correct or delete your information, contact the business, or us.

On websites that use our script

A business's website may load our script for its cookie banner and signup popup. It remembers your cookie choice and whether you have seen the popup in your browser's storage. To keep bots from signing other people up, the popup uses Cloudflare Turnstile, which checks that a person is filling it in.

Who else handles it

• Mailgun, which delivers the emails;
• Cloudflare, for Turnstile;
• Google, for sign-in;
• our hosting provider, which runs the servers and stores backups.

They may only use the information to provide their service to us.

How long we keep it

Staff accounts are kept while the person has access. Subscriber information is kept for as long as the business keeps the contact. When a contact is deleted, we remove their details and activity, including any coupons and automated emails in progress, and keep only a one-way fingerprint of the address so it is not added again by mistake. When a business stops using the service, we delete its account and all of its data. Deleted information can remain in our encrypted backups for a limited time, until they are replaced.

Security

Connections are encrypted. There are no passwords to steal: staff sign in with Google. Keys for connected services are stored encrypted, API keys only as a one-way hash, and only invited staff of each business can see its data.

Changes

If we change this policy we update the date above, and we email the staff of each business about significant changes.