Privacy Policy

Brighter Days Advisory LLC doing business as Kelsey Quality ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. DATA COLLECTION

We collect the following information:

• Account Information: Name, email address, and profile picture via Google OAuth
• Document Access: Read-only access to Google Drive documents you authorize for scanning, documents you upload for scanning, and any document you choose to submit for scanner improvement
• Compliance Data: Gap findings, clause references, document classifications, and compliance scores generated from your scans
• Usage Data: Information about how you interact with the Service

2. AI DISCLOSURE

We use Anthropic Claude to analyze your documents against ISO 13485, FDA QMSR, and related regulatory requirements.

Documents you scan from a connected source such as Google Drive are processed in-flight; we do not store or copy them. Documents you upload from your computer are held in private, encrypted storage so they can be scanned, and are deleted within 24 hours. Our AI provider does not store or copy your documents in either case. We retain compliance metadata (gap findings, clause references, document classifications) and, as evidence behind each finding, short quoted excerpts from your documents.

If you choose to submit a document to help us improve the scanner, we keep that document. See Scanner Improvement below.

Important: We do not use your documents or compliance data to train machine learning models. We do not permit our AI providers to use your content for model training purposes.

3. TRACKING

If you decline analytics cookies, we still collect anonymous usage analytics without cookies to monitor service performance and improve the Service. If you choose "All Cookies", we also use analytics cookies, link your activity to your account, and may record your session to improve the product; those recordings hide everything you type and all page text except navigation labels.

4. DATA HOSTING

We use Vercel for hosting and infrastructure services. Your data is stored on servers located in the United States.

5. DATA SECURITY

We implement industry-standard security measures to protect your data:

• OAuth tokens are encrypted at rest
• Document content is sent for analysis over encrypted API calls. Documents from a connected source are never written to persistent storage. Uploaded documents are held in private storage for up to 24 hours and then deleted. Short quoted excerpts are retained as evidence for each finding, and are stored encrypted at the field level — see Data Retention below
• Sensitive data is transmitted over secure HTTPS connections
• Access to user data is restricted to authorized personnel only

6. PAYMENT PROCESSING

Payment information is processed by Paddle, our third-party payment provider. We do not store or have access to your full payment details.

7. COMPLIANCE WITH API POLICIES

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. YOUR RIGHTS

Depending on your location, you may have the following rights:

All Users:

• Access: Request a copy of your data at any time. You can export all data we hold about you — including your account details, scan results, compliance findings, and purchase history — as a JSON file from your Account page or the API (POST /api/account/export). The export is prepared asynchronously and delivered as a signed download link valid for 24 hours. Vector embeddings are non-reversible and are excluded from exports. The export lists any documents you submitted for scanner improvement, but not their contents.
• Deletion: Request deletion of your account and associated data
• Correction: Update inaccurate information from your Account page

EU/EEA Users (GDPR):

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

California Users (CCPA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising privacy rights

Australia/New Zealand Users:

• Rights under the Privacy Act 1988 (Australia) and Privacy Act 2020 (New Zealand)

To exercise any of these rights, contact us at: support@kelseyqms.com

9. CONSENT AND SCANNER IMPROVEMENT

We maintain a structured audit trail of the consent events that occur during your use of the Service — including Google Drive access authorisation, acceptance of these terms, and participation in scanner improvement. Each record captures the type of consent, the version of the relevant text at the time of consent, whether consent was granted or revoked, and the timestamp. This audit trail is included in your GDPR data export and is deleted when you delete your account.

Scanner improvement is optional and off unless you turn it on for a specific document. When you report that a finding is wrong and choose to submit the document behind it, we keep a copy of that document in private storage and use it to test and correct the scanner. We do not use it to train machine learning models. Only authorized personnel can access it. You can withdraw your consent at any time; we then stop using the document and delete it.

10. DATA RETENTION AND DELETION

• Active Accounts: Compliance scan results are retained as long as your account is active. Findings may retain short quoted excerpts from your documents as evidence. We do not keep full documents, with two exceptions: documents you upload are held for up to 24 hours, and documents you submit for scanner improvement are kept until you withdraw consent or delete your account.
• Scanner improvement documents: Deleting a scan does not delete a document you submitted for scanner improvement. To remove it, withdraw your consent or delete your account.
• Deletion: You can delete an individual scan from your scan history, which removes its results and any quoted excerpts retained as evidence. Deleting your account is self-service from your Account page and takes effect immediately — it removes your scans, results, and any quoted excerpts retained as evidence, along with the rest of your account data.
• Backups: Deleted data may persist in encrypted backups for up to thirty (30) days before permanent removal.

11. CHILDREN'S PRIVACY

This Service is not directed at individuals under thirteen (13) years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately at support@kelseyqms.com.

12. DATA BREACH NOTIFICATION

In the event of a data breach that affects your personal information, we will notify you via email within seventy-two (72) hours of discovery and provide information about the nature of the breach and steps we are taking to address it.

13. INTERNATIONAL DATA TRANSFERS

If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least thirty (30) days before the changes take effect. Your continued use after the effective date constitutes acceptance of the updated policy.

15. CONTACT US

For questions or concerns about this Privacy Policy or our data practices, contact us at:

Email: support@kelseyqms.com