Privacy Policy

Brilliant Systems LLC, located at 1500 N Grant St Ste R, Denver, CO 80203, USA ("Open Lance", "we", "us", or "our"), operates the Open Lance platform (the "Platform"). Open Lance is a product of Brilliant Systems LLC. This Privacy Policy explains what personal data we collect, why, how we use and share it, and the rights you have over it.

For the purposes of the EU/UK General Data Protection Regulation (GDPR), Brilliant Systems LLC is the data controller for personal data processed through the Platform. This policy is designed to meet international standards including the GDPR, UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA).

We collect data you provide and data generated through your use of the Platform:

• Account & profile data: name, email, username, password (hashed), role, professional title, skills, portfolio, languages, and verification details.
• Identity & payout data: information needed to verify identity and to pay you or charge you, including payout method details and limited payment metadata (we do not store full card numbers).
• Transactional data: jobs, proposals, bids, offers, contracts, milestones, escrow funding and releases, invoices, disputes, and messages.
• Technical data: IP address, device and browser information, log data, and cookies/similar technologies.
• Communications: messages you send through the Platform and to our support team.
• Google integration data (optional): if you connect a Google account to schedule meetings, your Google email and account identifier, an encrypted OAuth token, and the meeting events/links we create — see “Google account & calendar integration” below.

We use personal data to:

• provide, operate, and maintain the Platform and your account;
• facilitate jobs, proposals, contracts, escrow, payments, and dispute resolution;
• verify identity, prevent fraud, enforce our Terms, and keep the Platform safe;
• send service communications and, where permitted, relevant updates;
• comply with legal, tax, and accounting obligations;
• improve and analyze the Platform.

Where the GDPR/UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Platform and process your transactions;
• Legitimate interests — to secure the Platform, prevent fraud, and improve our services (balanced against your rights);
• Legal obligation — to meet tax, accounting, and regulatory requirements;
• Consent — for optional communications or cookies that require it, which you may withdraw at any time.

We share personal data only as needed:

• With other users — the limited profile and transactional details required to engage (for example, a client sees a freelancer's profile and proposal once the freelancer engages). Freelancer profiles are not publicly listed.
• With service providers — payment processors (e.g., Stripe), cloud hosting, email, and analytics providers acting as our processors under contract;
• For legal reasons — to comply with law, enforce our Terms, or protect rights, safety, and security;
• In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell your personal data.

If you choose to connect your Google account (Settings → Integrations) to schedule Google Meet calls with the other party inside a contract conversation, we request access to your basic Google profile (your email address and Google account identifier) and to Google Calendar via the Google Calendar API (the calendar.events scope).

We use this access only to create, update, cancel, and read the meeting events you schedule through Open Lance, and to generate their Google Meet links. We do not read, display, or use any of your other Google Calendar events, and we do not use Google data for advertising or to train generalized AI/ML models.

What we store: your connected Google email address and an OAuth refresh token, which is encrypted at rest; and the identifiers and Meet links of the meetings created through Open Lance. We never sell this information or share it with third parties except as needed to provide the meeting feature (for example, Google itself).

You are in control: you can disconnect your Google account at any time in Settings → Integrations, which revokes and deletes the stored token, or revoke Open Lance's access directly at https://myaccount.google.com/permissions.

Limited Use: Open Lance's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Your data may be processed in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms to protect your data.

We use cookies and similar technologies that are strictly necessary to operate the Platform (for example, to keep you signed in and to secure sessions), and, where applicable, optional cookies for analytics. You can control non-essential cookies through your browser settings or any cookie controls we provide.

We keep personal data for as long as your account is active and as needed to provide the Platform. We retain certain records (such as transaction, tax, and dispute records) for longer where required by law or to resolve disputes and enforce agreements. When no longer needed, data is deleted or anonymized.

We use technical and organizational measures to protect personal data, including encryption in transit, hashed credentials, access controls, and audit logging. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to incidents.

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — correct inaccurate or incomplete data;
• Erasure — request deletion of your data in certain circumstances;
• Restriction & objection — limit or object to certain processing;
• Portability — receive your data in a portable format;
• Withdraw consent — where processing relies on consent;
• CCPA rights (California residents) — know, access, delete, correct, and opt out of the "sale"/"sharing" of personal information (we do not sell personal data), without discrimination for exercising your rights.

To exercise any right, contact us at privacy@openlance.io. You also have the right to lodge a complaint with your local data protection authority.

The Platform is not directed to individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be posted on the Platform and, where appropriate, communicated to you. The "Last updated" date above reflects the latest revision.

For privacy questions or to exercise your rights, contact Brilliant Systems LLC, 1500 N Grant St Ste R, Denver, CO 80203, USA, at privacy@openlance.io.