Privacy Policy

1. Introduction

This Privacy Policy explains how Barrow AI, Inc. ("Barrow," "we," "our," or "us") collects, uses and discloses information when you use our platform for researching, drafting and reviewing professional reports and its related services (the "Service"). The Service includes the Barrow web application at barrow.site and Barrow for Word, our Microsoft Word add-in, which is covered by this Privacy Policy in full. This Privacy Policy is incorporated into and subject to our Terms of Service.

2. Information We Collect

Personal Information

We may collect personal information that you provide directly to us, including:

• Name, email address, and contact information
• Professional credentials and company information
• Account registration details and preferences
• Payment and billing information
• Communications with our support team

Project and Site Data

When using our platform, you may upload or input:

• Site location and property information
• Environmental assessment data and documents
• Maps, photographs, and site plans
• Historical research and regulatory database information
• Draft reports and associated metadata

Automatically Collected Information

We automatically collect certain information when you use our Service:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Performance and error logs
• Cookies and similar tracking technologies (see Section 13)

3. How We Use Your Information

We use the collected information for the following purposes:

• Providing and maintaining our AI-powered platform services
• Researching, drafting and reviewing professional reports
• Improving our platform functionality and user experience
• Processing payments and managing subscriptions
• Providing customer support and technical assistance
• Communicating updates, security alerts, and service information
• Ensuring compliance with legal and regulatory requirements
• Detecting and preventing fraud or unauthorized access

4. AI Processing and Data Use

Barrow processes your project evidence and report content using AI services to provide the research, drafting and review features you request:

• Your project data is processed through AI providers to produce drafts, answers and review suggestions. AI-generated outputs are preliminary drafts, as described in our Terms of Service.
• We do not use your individual project data to train AI models.
• Access to project details is limited to authorized users and service providers as described in this policy.
• We use account and organization access controls to restrict access to project data.
• You retain ownership of all project data you input into our platform, as set forth in Section 6 of our Terms of Service.

AI System Transparency

When using AI-assisted features:

• AI-generated content is identified as draft work for professional review; documents can also contain source material, template text and your own edits
• Our AI features work with your project evidence and templates. They may produce inaccurate, incomplete or inconsistent content.
• AI-generated output requires review by an appropriately qualified professional before reliance or distribution, including an Environmental Professional where the report type or applicable standard requires one
• You remain responsible for the final reports you issue and the professional judgments they contain

Aggregated and Anonymized Data

We may create aggregated, anonymized data derived from your use of the Service ("Aggregated Data"). Aggregated Data is data that has been combined with data from other users and stripped of all personally identifiable information and project-specific details such that it cannot reasonably be used to identify you, your organization, or any specific property or project. Barrow retains all rights in Aggregated Data and may use it for any lawful business purpose, including service improvement, benchmarking, and industry analysis. Aggregated Data is not subject to the data deletion obligations in Section 11 or in our Terms of Service.

4a. Barrow for Word

Barrow for Word is a Microsoft Word add-in published by Barrow AI, Inc. It runs inside Word and connects to the same Barrow account and the same Service described in this Privacy Policy. Using it requires signing in to a Barrow account, and access is sold as a paid subscription.

When you use Barrow for Word, we process:

• Document content you act on. When you ask the add-in to draft a section, answer a question about your sources, or check your writing, the relevant content from the open Word document and your selection is sent to Barrow's servers so the request can be fulfilled. The add-in also reads document structure and content locally to display sections and protect existing edits.
• Source documents you upload or import. Reports, records, and other files you add to a Barrow workspace through the add-in, including files imported from OneDrive or Google Drive when you connect those accounts and choose the files.
• Account and session information. Your Barrow account identity, organization, subscription status, and the add-in session needed to link your work in Word to your account.

This content is used to produce the drafts, answers, and verifications you request, and is handled under the same terms as content you provide through the web application: it is processed for the purposes described in Section 4 using the service providers described in Section 7, is not used to train third-party models, is not sold, and remains your property under Section 5.

We use usage analytics, error diagnostics, and masked session recordings of the Barrow task pane for internal support and service improvement. These help us understand which tools you use, how long operations take, and where an interaction fails. Diagnostics may be linked to your Barrow account ID, email address, and add-in session. Report text, source content, and typed inputs are masked before recordings leave your device. Recordings do not include Word's document canvas, source-file previews, console logs, authentication headers, or API request and response bodies.

Distribution through Microsoft Marketplace does not itself send your Barrow project evidence to Microsoft. Microsoft’s own privacy practices govern Microsoft Word, your Microsoft account and any Microsoft services you connect. Removing the add-in stops it from running in Word; it does not delete content already uploaded to Barrow or cancel server-side work already requested. To request deletion of your Barrow account data, follow Section 11.

5. Your Data Ownership

All data, documents, and materials you upload or provide through our platform remain exclusively your property. For a complete description of data ownership rights, intellectual property, and output ownership, please refer to Section 6 (Data Ownership and Intellectual Property) of our Terms of Service.

6. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

• Service Providers: Third-party vendors who assist in operating our platform (see Section 7)
• Legal Requirements: When required by law, court order, or regulatory authority
• Business Transfers: In connection with mergers, acquisitions, or asset sales
• Consent: When you explicitly authorize us to share your information
• Security: To protect rights, safety, and security of our users and platform

7. Third-Party Service Providers

We use the following categories of third-party service providers to operate our platform. Your data may be processed by these providers in accordance with their respective privacy policies:

• Authentication: Identity management and secure login services
• Cloud Infrastructure: File storage, hosting, and cloud computing
• AI Processing: Large language model services for report drafting
• Payment Processing: Billing, subscription management, and transaction processing
• Analytics: Product usage analytics and session replay for internal service improvement, including the masked Word task-pane replay described above
• Error Monitoring: Application errors, performance monitoring and technical logs for internal support; diagnostics may include device information, operation details and error context
• Website Analytics: Google Analytics on the public pages of our website, to measure visits and how visitors reach us. It is switched off on the signed-in pages of the Service
• Advertising Measurement: Google Ads conversion tracking on our website to measure interactions with our advertising

8. Data Security

We use HTTPS for connections to the Service and account and organization access controls to restrict access to customer information. Barrow and its service providers process document content to provide the features you request. No method of transmitting or storing information can guarantee complete security. Existing security obligations under your applicable agreement with Barrow continue to apply.

9. Data Breach Notification

When we become aware of a security incident affecting personal information, we investigate it and take steps to contain and address it. We notify affected customers, individuals and authorities as required by applicable law and our applicable agreements. Notices describe the information available at the time and may be supplemented as the investigation progresses. Notification commitments already made to you continue to apply.

10. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Account information: Until you delete your account
• Project data: As long as you maintain your account, plus the retrieval period described in Section 16 of our Terms of Service
• Payment information: As required for tax and accounting purposes
• Usage logs: Typically 12-24 months for security and optimization

11. Your Rights and Choices

You have several rights regarding your personal information:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Export your data in a common format
• Restriction: Limit how we process your information
• Objection: Object to certain types of processing

To exercise these rights, please contact us at support@barrow.site. We will respond to verified requests within thirty (30) days, or within the timeframe required by applicable law.

12. GDPR — Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases as required by the General Data Protection Regulation (GDPR):

• Performance of Contract: Processing necessary to provide the Service, including account management, report generation, and payment processing (Articles 6(1)(b))
• Legitimate Interest: Processing necessary for our legitimate business interests, including service improvement, analytics, fraud prevention, and security, where these interests are not overridden by your data protection rights (Article 6(1)(f))
• Legal Obligation: Processing necessary to comply with applicable laws, regulations, or legal proceedings (Article 6(1)(c))
• Consent: Where we rely on your consent for processing (such as optional marketing communications or non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal (Article 6(1)(a))

For users in the EEA/UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

13. Cookies and Tracking Technologies

13.1 Cookies and Local Storage

We use cookies and browser local storage to operate the Service, remember preferences and collect analytics. Word task-pane analytics use local storage. Browser settings can remove these stored identifiers. The categories below describe the purposes of these technologies:

• Essential Cookies: Required for the Service to function. These include authentication session cookies, security tokens (CSRF protection), and user preference cookies (theme selection). These cannot be disabled without breaking core functionality. Duration: session or up to 7 days.
• Analytics Cookies: Used to understand how visitors interact with the Service. These cookies collect information such as pages visited, features used, and session duration. Duration: up to 12 months.
• Performance Cookies: Used to monitor application performance and errors. These cookies help us identify and resolve issues. Duration: up to 12 months.
• Website Analytics: The public pages of our website load Google Analytics, which uses cookies lasting up to 12 months to tell one visit from another and to count pages viewed. It is switched off on the signed-in pages of the Service.
• Advertising Measurement: Our website loads the Google Ads tag for conversion measurement. The tag may process device and interaction information associated with visits or conversions.
• Visitors in the European Economic Area, the United Kingdom and Switzerland: The Google tags on our website are set not to store cookies for visitors in these countries.

13.2 Your Cookie Choices

You can control cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, if you block essential cookies, some features of the Service may not function properly. For users in jurisdictions requiring cookie consent (including the EU/EEA), we will obtain your consent before setting non-essential cookies.

14. CCPA/CPRA — California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act (collectively, "CCPA"):

14.1 Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, IP address, account credentials
• Commercial Information: Payment history, subscription details, transaction records
• Professional Information: Professional credentials, company affiliation, job title
• Internet/Electronic Activity: Browsing history on our Service, search queries, interaction data
• Geolocation Data: Approximate location derived from IP address

14.2 No Sale or Sharing

Barrow does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA.

14.3 Your CCPA Rights

As a California resident, you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Delete: Request that we delete your personal information, subject to certain exceptions
• Correct: Request correction of inaccurate personal information
• Opt-Out: Opt out of the sale or sharing of personal information (not applicable — we do not sell or share)
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights

14.4 Exercising Your Rights

To submit a CCPA request, contact us at support@barrow.site. We will verify your identity before processing requests. You may also designate an authorized agent to submit requests on your behalf; authorized agents must provide proof of written authorization.

15. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws, including, where applicable, Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

16. Children's Privacy

Our Service is not intended for children under 13 years of age (or under 16 in jurisdictions where applicable, including certain EU member states under the GDPR). We do not knowingly collect personal information from children under these age thresholds. If you become aware that a child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of any material changes via email or through the Service at least thirty (30) days before such changes take effect. Your continued use of our Service after such changes take effect constitutes acceptance of the updated Privacy Policy.

18. Contact Us

Send privacy questions, access or deletion requests, and other inquiries to support@barrow.site. Include “Privacy request” in the subject line when applicable. Do not send passwords or access tokens.

For users in the European Union or United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority. These clarifications do not retroactively reduce commitments under previously accepted agreements; the notice requirements in Section 17 continue to apply.