privacy policy

last updated oct 22, 2026

This Privacy Policy explains how Disjoint, Inc. (“BGICOE,” “we,” “us,” or “our”) collects, uses, and shares information when you use BGICOE, including our website at bgicoe.com and our related apps, APIs, and services (the “Service”).

BGICOE is an early-stage product. As it evolves, our practices will too, and we'll keep this policy up to date when they change (see “Changes to this policy”).

Information we collect

Information from Google Sign-In

When you sign in with Google, Google shares basic profile information with us: your name, email address, profile picture, and a unique Google account identifier. We don't receive your Google password, and we don't access your Gmail, Google Drive, Calendar, contacts, or other Google data.

Information you provide

• Your tools: the third-party tools and services you tell us you use or connect to the Service (“Third-Party Services”).
• Credentials: API keys, tokens, and other credentials for Third-Party Services that you connect so we can monitor those services or rotate their credentials.
• Settings: your preferences, such as alert channels and rotation rules.
• Communications: information you send us, such as support requests and feedback.
• Payment information: if you buy a paid plan, our payment processor collects your payment details. We receive limited information from them, such as your billing name and address, card type, the last four digits of your card, and your transaction history, but never your full card number.

Information from Third-Party Services you connect

When you connect a Third-Party Service, we receive information from it as needed to provide the Service. This includes metadata about your credentials (such as names, IDs, permissions, and creation and expiration dates), account identifiers, and the results of requests we make on your behalf. It may include some personal information, such as the names or email addresses of your teammates.

Information collected automatically

• Usage and device information, such as IP address, browser and device type, pages and features you use, referring URLs, and timestamps.
• Cookies and similar technologies, which keep you signed in, remember your preferences, and help us understand how the Service is used (see “Cookies and analytics”).

Information about security incidents

To produce alerts, we collect information about security incidents from public and third-party sources, such as vendor disclosures, status pages, advisories, news, and social media. This information is generally about companies and services, not about you.

How we use information

We use information to:

• Provide the Service: sign you in, monitor the Third-Party Services you use, send alerts, and perform the credential rotations you've turned on.
• Communicate with you: send alerts, account and service messages, responses to your requests, and, unless you opt out, occasional product updates.
• Keep the Service secure: prevent and investigate fraud, abuse, and security threats, and fix problems.
• Improve and develop: understand how the Service is used, improve it, and develop new features, products, and services.
• Comply with the law: meet legal obligations and enforce our Terms.
• Do what you ask: carry out other uses you direct or agree to.

Data we receive from Google is subject to the additional limits in “Google user data” below, and credentials are subject to the limits in “How we handle your credentials.”

How we handle your credentials

Credentials for Third-Party Services are the most sensitive information we hold, so they get stricter treatment than anything else:

• We use them only to provide the features you've turned on (such as verifying a connection or rotating a credential), to keep the Service secure, or as you otherwise direct.
• We store them encrypted and limit access to the systems and people who need it to run the Service.
• We don't sell them or use them for advertising. We share them only with service providers that help us securely store and process them (such as our cloud infrastructure provider), or when required by law.
• When you disconnect a Third-Party Service or delete your account, we delete the associated stored credentials within a reasonable time. Copies in backups are deleted on our normal backup schedule.
• Disconnecting a Third-Party Service from BGICOE doesn't revoke the credential itself. To fully cut off our access, also revoke or rotate it in that Third-Party Service.
• If we learn of a security incident that we believe exposed credentials you've stored with us, we'll notify you so you can rotate them.

How we share information

We share information only as described below:

• Service providers that process information on our behalf to help run the Service, such as cloud hosting, database, email delivery, analytics, payment processing, customer support, and AI or other data-processing providers.
• Third-Party Services you connect. When we act on your behalf, for example to rotate a credential, we send requests to that Third-Party Service, and it receives the information in those requests.
• Your organization. If you use the Service through a team or organization account, its administrators and members may be able to see information about your use of the Service.
• Legal and safety. When we believe it's reasonably necessary to comply with law or legal process; to protect the rights, property, or safety of BGICOE, our users, or others; or to investigate fraud, abuse, or security issues.
• Business transfers. If we're involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, information may be transferred as part of that transaction. We'll make reasonable efforts to notify you if your information becomes subject to a different privacy policy as a result.
• With your consent or at your direction.
• Aggregated or de-identified information that can't reasonably be used to identify you.

We don't sell your personal information.

Google user data

This section covers the information we receive from Google when you sign in with Google (“Google user data”).

• What we access: your name, email address, profile picture, and Google account identifier.
• How we use it: to create and secure your account, sign you in, identify you in the Service, communicate with you (including sending alerts), provide support, and understand how the Service is used so we can improve it.
• How we store it: with your account information in our databases, hosted by our cloud infrastructure provider, for as long as your account is active (see “Data retention”).
• How we share it: only with service providers that help us run the Service (such as hosting, email delivery, and analytics providers); when required by law; for security purposes; or as part of a merger, acquisition, or sale of assets, as permitted by Google's policies.
• What we don't do: we don't sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models.
• Your control: you can remove BGICOE's access from your Google Account settings at any time, and you can delete your BGICOE account to have us delete this data.

When we use or transfer information received from Google APIs, we follow the Google API Services User Data Policy, including its Limited Use requirements. If we want to use Google user data in a new way or for a different purpose, we'll update this policy and ask for your consent first.

Cookies and analytics

We use cookies and similar technologies that are needed to run the Service, for example to keep you signed in. We also use analytics tools that help us understand how the Service is used so we can improve it. You can control cookies through your browser settings, but blocking necessary cookies may stop parts of the Service, including sign-in, from working. The Service doesn't currently respond to “Do Not Track” browser signals.

Data retention

We keep personal information while your account is active and as long as needed for the purposes in this policy, such as providing the Service, complying with legal obligations, resolving disputes, preventing abuse, and enforcing our agreements. When you delete your account, we delete or de-identify your personal information within a reasonable time, unless we need to keep it for one of those reasons. Stored credentials are deleted as described in “How we handle your credentials,” and copies may remain in backups for a limited time.

Security

We use administrative, technical, and physical safeguards designed to protect your information. No system is perfectly secure, though, and we can't guarantee the security of information you send us or that we store. If we learn of a security incident affecting your personal information, we'll notify you as required by law. As described above, we'll also tell you if we believe credentials you've stored with us were exposed.

Your choices and rights

• Account and settings: review and update your account information and settings in the Service.
• Connections: disconnect any Third-Party Service at any time.
• Account deletion: delete your account by emailing team@disjoint.com.
• Emails: unsubscribe from product update emails using the link in them. You'll still get alerts and account messages while you have an account, since they're part of the Service.
• Privacy rights: depending on where you live, you may have the right to access, correct, delete, or get a copy of your personal information, or to object to or restrict certain processing. To make a request, email team@disjoint.com. We may need to verify your identity before responding, and we won't discriminate against you for exercising your rights.

International users

We're based in the United States. We and our service providers may process your information in the U.S. and other countries, whose data protection laws may differ from those where you live. Where required by law, we use appropriate safeguards for these transfers.

If you're in the European Economic Area, the United Kingdom, or Switzerland, Disjoint, Inc. is the controller of your personal information. We process it to perform our contract with you (providing the Service); for our legitimate interests in securing, maintaining, improving, and developing the Service and communicating with you about it, where your rights don't override those interests; with your consent, which you can withdraw at any time; and to comply with legal obligations. You can also lodge a complaint with your local data protection authority.

Children

The Service isn't directed to children, and we don't knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we'll delete it.

Changes to this policy

We expect to update this policy as BGICOE grows and changes. When we do, we'll post the updated policy here and change the “Last updated” date. If we make a material change, we'll let you know before it takes effect, for example by email or in the Service. Where the law or Google's policies require it, we'll ask for your consent.

Contact us

Questions or requests? Email team@disjoint.com.