Brilliant Labs Privacy Policy
Date last updated 7 October 2026
Brilliant Labs Pte. Ltd. (UEN 202316146G), a company incorporated in Singapore ("Brilliant", "we", "us" or "our"), collects, uses, discloses and protects personal information as described in this Privacy Policy. It covers our smart glasses, including Halo, Frame and Monocle, Noa, our mobile applications, websites and related services (together, the "Products and Services"). It also covers use of Noa directly on a phone without connected glasses.
Noa uses cloud AI to support conversation and image understanding. With your permission, relevant information is shared with Google's Gemini services. We retain conversation transcripts and associated memory data in encrypted cloud storage to support recall and personalization until you request deletion. Details of our processing and your choices appear below.
1 Who we are and how to contact us
Brilliant is the controller of personal information processed for consumer use of our Products and Services. Where we process information on behalf of an enterprise or developer customer, our Data Processing Agreement governs that processing.
For privacy questions, requests to delete information, or to exercise your rights, contact our data protection officer at hello@brilliant.xyz. We may provide additional notices for particular features. Those notices explain the processing specific to those features.
Our Products and Services are intended for adults aged 18 and above. We do not knowingly collect personal information from children under 18 and will delete such information when identified, subject to applicable law.
2 Information we collect
Personal information means information that identifies a person or can reasonably be linked to an identifiable person. Depending on the features you use, we collect the following categories.
Account and transaction information. Name, contact details, account credentials or authentication tokens, subscription status, purchase history and payment-related information. Payment providers may process payment card details directly; we do not store payment card details.
Conversation and content information. Voice inputs, typed messages, conversation transcripts, AI responses, images you capture or upload, and relevant context provided to Noa. These may contain personal information about you or other people.
Location and sensor information. Location information, when you grant the relevant permission, and inputs from supported sensors used for the features you activate.
Technical and usage information. IP addresses, device and app identifiers, operating system and software versions, connection information, feature interactions, performance data, crash reports, diagnostic logs and notification delivery information.
Memory and personalization information. Transcripts, summaries, preferences and other records derived from your interactions to support recall and personalized responses. Summaries and other derived records may still contain personal information; encryption or conversion to a different format does not make them anonymous.
Support and communications information. Information you provide when contacting us, requesting support, completing a form or choosing to receive communications.
3 How information is collected
We collect information when you create an account, purchase or use our Products and Services, communicate with us, or activate features. Noa can receive audio and images from compatible glasses or from your phone, including the phone microphone in phone mode. Information may also be collected through permitted app functions, supported sensors and service logs.
Where available, optional ambient or memory capture features may collect information continuously or intermittently while enabled. You can pause or disable these features. Enabling a capture feature does not replace permission for third-party cloud AI sharing.
Audio and images may incidentally include other people. You are responsible for using recording and sensing features in accordance with applicable law, including obtaining others' permission where required. Your consent to Noa does not provide consent on another person's behalf.
We may receive information from service providers that support payments, hosting, security, analytics or customer support. Our websites and applications may use cookies, SDKs and similar technologies to operate services, remember preferences and measure performance. We obtain consent for non-essential technologies where required, and you can manage relevant browser, device or service settings.
4 How we use information
We use information to provide and operate the Products and Services; generate AI responses and interpret images; support memory recall and personalization; manage accounts, subscriptions and payments; deliver notifications and service communications; provide support; diagnose faults and improve performance; prevent fraud and abuse; and comply with applicable legal obligations.
We may use aggregated or genuinely anonymized information for analysis and improvement. Information that remains identifiable, including de-identified information that can be linked back to a person, remains subject to this Policy. We do not use identifiable personal information to train third-party AI models without separate explicit permission.
Where a legal basis is required, we rely on performance of a contract, legitimate interests that do not override your rights, legal obligations, or consent, as appropriate. We obtain separate explicit in-app permission before sharing personal information with third-party cloud AI. Accepting our Terms or this Policy does not replace that permission.
We may send marketing communications where permitted by law and obtain consent where required. You can opt out through the unsubscribe instructions or by contacting us. We obtain further permission for materially different uses where required.
AI outputs may be inaccurate. Noa provides general information and assistance, not medical, legal, financial or other professional advice.
5 Cloud AI and third party sharing
Google Gemini. Noa uses Google's Gemini services for conversation and image understanding. With your permission, relevant messages, including transcribed speech, images and conversation context are sent to Google for these purposes. Context may include location information when relevant to a feature and permitted by you. Inputs may contain personal information and are not necessarily anonymous.
Audio and supporting services. Voice features may also involve services that transmit audio or convert speech to text. We use supporting services for hosting, storage, connectivity, crash reporting, notifications, payments and support. These services receive the information relevant to their functions, such as audio for speech processing or technical identifiers for notification delivery. The in-app disclosure identifies additional recipients involved in cloud AI sharing and the information they receive before you are asked to permit that sharing.
Provider changes. We may update the models used within a disclosed provider's services without changing this Policy if the recipient and relevant data handling remain unchanged. Where a new recipient or a material change is not covered by your existing permission, we update the disclosure and obtain permission before the affected sharing begins. A general reference to future providers does not authorize undisclosed sharing.
Protection by service providers. We require service providers receiving personal information to provide the same or equal protection as described in this Policy and required by applicable rules, including applicable App Store requirements. We require appropriate contractual restrictions, confidentiality and security safeguards for their processing. Retention by a provider is governed by the applicable service arrangements and does not necessarily match Brilliant's transcript retention.
Other disclosures. We may disclose information at your direction; to comply with law, legal process or lawful requests; to protect rights, safety and security; or in connection with a merger, acquisition or other business transfer, subject to applicable safeguards. These provisions do not replace the separate permission required for third-party cloud AI sharing.
Independent integrations and links. Third-party websites, applications or integrations you choose to use may process information under their own policies. We limit access through official integrations to the permissions you grant. Modified or unofficial software may change how information is handled; this Policy covers official Brilliant Products and Services.
We do not currently sell personal information or share it for cross-context behavioral advertising as those terms are defined by applicable US privacy laws. If this changes, we will provide the required disclosures and choices. We honor applicable opt-out preference signals where required by law.
6 International transfers
Brilliant and our service providers may process information outside your country, including in Singapore and countries where our providers operate. We apply safeguards required by applicable law. For EEA or UK transfers, these may include adequacy decisions or approved contractual safeguards. For transfers from Singapore, we take steps to ensure a comparable standard of protection under the Personal Data Protection Act. Contact us for information about applicable transfer safeguards.
7 Security
We use technical and organizational measures appropriate to the information and processing, including encryption and access controls. Conversation transcripts and associated memory data are stored in encrypted cloud storage. Access is limited to authorized personnel and service providers who need it for the permitted purposes.
We maintain processes for investigating security incidents and notifying affected individuals and authorities where required by applicable law. No system can guarantee absolute security.
8 Retention and deletion
We retain conversation transcripts and associated memory data in encrypted cloud storage to support recall and personalization until you request deletion. You may request deletion of your transcripts and associated summaries, embeddings and memory records, including records used for contextual recall.
We process verified deletion requests without undue delay and within applicable legal requirements. Account deletion includes deletion of associated transcripts and memory data. Information required to be retained by law may be kept only for the applicable purpose and period. Withdrawal of cloud AI permission stops future sharing covered by that permission; it does not automatically delete information already retained, which you may separately request us to delete.
We retain other information only as long as reasonably necessary for the purposes described in this Policy, including legal, tax, accounting and security requirements. Retention depends on the information, its purpose and applicable obligations.
9 Your choices and rights
You can decline cloud AI sharing or withdraw permission through the in-app consent control. Features that depend on that sharing will not operate while permission is declined or withdrawn. You can manage microphone, camera and location permissions through your phone's settings and use supported controls to pause or disable capture.
You may request access, correction, deletion, a portable copy, restriction of processing, or object to processing, as applicable under the law governing your information. Contact hello@brilliant.xyz or use available in-app controls. We may verify your identity to protect your information and will respond within applicable legal time limits.
Withdrawing consent does not affect the lawfulness of earlier processing. We do not discriminate against you for exercising applicable privacy rights. You may complain to your local data protection authority.
10 EEA and UK rights
Where the GDPR or UK GDPR applies, you have rights to be informed about processing; access and correct information; request erasure, restriction and data portability; object to processing based on legitimate interests and to direct marketing; and withdraw consent. These rights are subject to applicable conditions and exceptions. You also have protections regarding decisions based solely on automated processing that produce legal or similarly significant effects.
You may lodge a complaint with the supervisory authority where you live or work, or where an alleged infringement occurred. Information about EEA authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
11 California privacy rights
Where the CCPA or CPRA applies, you may request information about the categories and specific pieces of personal information collected; sources; purposes; and categories of recipients. You may request access, correction and deletion, subject to legal exceptions. You may also opt out of sale or sharing for cross-context behavioral advertising, and limit certain uses of sensitive personal information, where those rights apply.
Submit requests to hello@brilliant.xyz or through available in-app controls. An authorized agent may submit a request, subject to appropriate verification. We will not retaliate against you for exercising these rights. We may retain information where an applicable legal exception permits or requires it, and will explain an applicable denial as required by law.
12 Singapore privacy rights
Where the Singapore Personal Data Protection Act applies, you may request access to your personal information and information about its use and disclosure, request correction, and withdraw consent, subject to applicable exceptions. Data portability rights apply where legally in force and applicable. Contact our data protection officer at hello@brilliant.xyz.
13 Updates and applicable terms
We will update this Policy when our practices materially change and provide notice as required. Where a change requires new permission, we obtain it before the relevant processing begins. The date above identifies the latest revision.
The governing law and dispute resolution provisions in our Terms of Service apply, subject to mandatory rights and applicable data protection law. This Policy does not limit rights that cannot lawfully be excluded.
Brilliant Labs Data Processing Agreement
Date last updated 7 October 2026
This Data Processing Agreement and its Schedules ("DPA") forms part of the Terms of Service ("TOS") between the Controller and Brilliant. It defines the parties' rights and obligations for Personal Data processed by Brilliant on behalf of the Controller. In the event of a conflict with the TOS, this DPA prevails solely with respect to data protection obligations. Capitalized terms not defined here have the meaning given in the TOS. This DPA supersedes prior data processing agreements between the parties concerning the same Services.
1 Definitions
For the purposes of this DPA, the following terms shall have the meanings specified below:
"Breach Event" means any incident where security is compromised, resulting in unintentional or illegal destruction, misplacement, modification, or unauthorized sharing or access to Personal Data that has been transmitted, stored, or otherwise processed.
"Controller” means the customer who is accessing and using the Services.
"Data Privacy Laws" means all applicable data protection and privacy laws, regulations, codes, and regulatory requirements relating to the collection, use, disclosure, or other processing of Personal Data, as applicable to either party or the Services. This includes, without limitation, EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), the Singapore Personal Data Protection Act of 2012 (PDPA), and other applicable laws.
"Data Subject" refers to the identified or identifiable natural person whose Personal Data is processed.
"Personal Data" refers to any information that is tied to an identified or identifiable natural person (Data Subject) that is protected as personal data, personal information, or personally identifiable information under applicable Data Privacy Laws.
"Personnel" refers to the employees or other individuals who are in a contractual relationship with the Processor, including employees or other individuals who are in a contractual relationship with the Sub-Processor.
"Processing" means actions performed by the Processor on the Personal Data whether by automated means or not, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
“Processor” means Brilliant Labs Pte. Ltd. (UEN: 202316146G), a company incorporated in Singapore, and its affiliates (collectively, "Brilliant"). For clarity, this DPA applies only where Brilliant processes Personal Data on behalf of a Controller as part of its enterprise or developer services.
"Services" means any products or services provided by the Processor pursuant to the TOS.
"Subprocessor" or "Subcontractor" refers to any third party appointed by the Processor to assist in fulfilling its obligations in providing Services to the Controller.
2 Purpose
The purpose of this DPA is to define the conditions under which the Processor shall process Personal Data on behalf of the Controller. This DPA applies only to enterprise or developer integrations where Brilliant acts as a data processor for the Controller. For consumer use of Brilliant’s devices or applications, Brilliant acts as a data controller, and processing is governed by the Privacy Policy.
3 Compliance with Laws
The Processor warrants that any Processing activities performed on behalf of the Controller will be conducted in accordance with all applicable Data Privacy Laws. The Processor must notify the Controller if it is no longer able to meet its obligations under applicable Data Privacy Laws.
The Controller is responsible for the quality and accuracy of Personal Data and the lawfulness of its collection and instructions. The Controller shall provide required notices and obtain permissions for collection, use and transfer, including separate explicit permission before third-party cloud AI sharing where required. Acceptance of this DPA or a privacy policy does not itself provide an end user's permission.
4 Ownership of Data
All Personal Data processed by the Processor in performing the Services shall remain the property of the Controller.
5 Duration of Processing
Processing obligations under this DPA will run until the end of the Processor's provision of Services to the Controller.
6 Types of Data
The Processor will process the categories of Personal Data provided by the Controller as set forth in Schedule 1.
7 Instructions for Processing
The Processor shall only process Personal Data in accordance with this DPA, including specific instructions set forth in Schedule 2, except where otherwise required by applicable law (and in such a case, shall inform the Controller of that legal requirement before processing, unless applicable law prevents it from doing so on important grounds of public interest). The Processor shall immediately inform the Controller if any instruction relating to the Personal Data infringes or may infringe any Data Privacy Laws.
AI processing
As instructed by the Controller, Brilliant may process voice inputs, messages, images, location context, conversation transcripts and associated memory records to provide AI assistance, image understanding, recall and personalization. Sources may include compatible glasses and mobile applications used without glasses. Google's Gemini services support Noa conversation and image understanding and may receive relevant messages, including transcribed speech, images and context. Additional recipients and their processing functions are identified through the subprocessor information described in Clause 15. Inputs and derived records may contain Personal Data and are not necessarily anonymous. Brilliant shall not use or authorize the use of identifiable Personal Data for AI model training without the Controller's separate explicit written authorization and any permissions required by applicable law. Any anonymization or use of genuinely anonymous information shall be consistent with the Controller's documented instructions and applicable law.
8 Data subject Rights
The Processor shall promptly notify the Controller of any requests from a Data Subject to exercise their rights under applicable Data Privacy Laws and shall assist the Controller in responding to a Data Subject's request as provided in the processing instructions, Schedule 2.
9 Data Protection Impact Assessments
The Processor shall assist the Controller in performing data protection impact assessments. At the Controller's request, the Processor shall provide all necessary information the Controller needs to meet their data protection assessment obligations, including but not limited to information about data transmittal, data storage, methods of processing, encryption, and data destruction.
10 Confidentiality
Both Parties agree to maintain the confidentiality of Personal Data and not to disclose such data except as expressly permitted under the terms of this Agreement. The Processor shall ensure that all personnel authorized to process Personal Data are subject to binding confidentiality obligations.
11 Liability
The Parties agree to indemnify one another against any claims, including but not limited to damages and fines, arising out of their respective breaches of this Agreement. Each Party’s liability shall be determined in accordance with applicable Data Privacy Laws, including any obligations to indemnify for administrative fines or data subject claims arising from their respective breaches of such laws, subject to the limitations of liability under the TOS.
12 Data Security
The Processor shall, at all times, implement and maintain appropriate technical and organizational security measures to ensure a level of security appropriate to the risk to protect the Personal Data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access. Such measures shall be at least equivalent to the technical and organizational measures set out in Schedule 3.
13 Breach Notification
The Processor shall notify the Controller without undue delay and, where feasible, within the timeframe required by applicable Data Privacy Laws (e.g., within 72 hours under the EU/UK GDPR, or within three (3) calendar days under the Singapore PDPA) of becoming aware of a Breach Event. The Processor will provide the Controller with all information reasonably available to assist the Controller in assessing the breach and in complying with its notification obligations under applicable Data Privacy Laws.
14 Limitations on Use
The Processor shall not use or authorize the use of the Personal Data for any purpose other than those outlined in this Agreement or for purposes other than performing its obligations under the TOS.
15 Subcontractor Requirements
The Processor may engage Subprocessors to process Personal Data on its behalf, provided that: (a) each Subprocessor is subject to obligations equivalent to those set out in this DPA, in accordance with applicable Data Privacy Laws; (b) the Processor shall notify the Controller in advance of any intended changes concerning the addition or replacement of Subprocessors, thereby giving the Controller the opportunity to object on reasonable grounds.
Subprocessors may provide cloud hosting, storage, real-time connectivity, speech processing, AI inference, diagnostics, notifications and other functions needed to deliver the Services. Google's Gemini services support Noa conversation and image understanding. Brilliant shall maintain current subprocessor information identifying recipients and their processing functions and make it available to the Controller upon request. Each subprocessor shall be subject to a written agreement imposing data protection obligations equivalent to this DPA, and Brilliant remains responsible for its subprocessor obligations. The change-notice and objection process in this Clause applies to additions or replacements of subprocessors. A model update within the same approved subprocessor service does not itself require amendment of this DPA if the recipient and relevant data handling remain unchanged. Changes to recipients or processing remain subject to this DPA and applicable notice and permission requirements.
16 International Data Transfers
Brilliant may transfer and process Personal Data in jurisdictions including Singapore, the United States, the European Economic Area, the United Kingdom, and other countries where Brilliant or its service providers operate. All such transfers shall be made pursuant to appropriate safeguards recognized under applicable law, such as Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms. For transfers from Singapore, Brilliant ensures compliance with Section 26 of the PDPA by implementing legally enforceable obligations to provide a comparable standard of protection. Brilliant conducts and maintains transfer risk assessments for cross-border data transfers as required by applicable Data Privacy Laws.
17 Destruction or Return of Data
As instructed by the Controller, Brilliant may retain conversation transcripts and associated memory data in encrypted cloud storage to support recall and personalization until deletion is requested or the Services terminate. Brilliant shall securely delete or return Personal Data within 30 days of the Controller's request or termination of the Services, except where retention is required by law. Deletion includes related summaries, embeddings and memory records, including graph records used for contextual recall, and is not limited to deleting the visible transcript. Where law requires retention, Brilliant shall limit processing of retained information to that obligation. Brilliant shall require relevant subprocessors to carry out corresponding deletion or return obligations under their agreements.
18 Audits and Compliance
The Processor shall permit the Controller, or an independent auditor appointed by the Controller, to conduct audits or inspections with reasonable notice during regular business hours to ensure compliance with the terms of this DPA, and applicable Data Privacy Laws. The scope of the audit shall be limited by the Parties to the systems, procedures, and documentation relevant to the processing of Personal Data. The Processor agrees to provide the Controller with all necessary cooperation, access, and support to conduct such audits. The Parties shall consider the findings of any such audit confidential information subject to the terms of this agreement.
19 Recordkeeping Obligations
The Processor shall maintain records of processing activities carried out on behalf of the Controller as required under applicable Data Privacy Laws. Such records shall be made available to the Controller upon request within a reasonable period.
20 Governing Law and Dispute Resolution
This DPA shall be governed by and construed in accordance with the laws of Singapore, without regard to conflict-of-law principles. Any dispute arising in connection with this DPA shall be submitted to and finally resolved by arbitration administered by the Singapore International Arbitration Centre (SIAC) in accordance with the SIAC Rules. The seat of arbitration shall be Singapore, and the proceedings shall be conducted in English.
Schedule 1 Personal data and data subjects
Categories of Personal Data
Contact information (e.g., name, email address)
Device and technical identifiers (e.g., IP address, device ID, operating system, browser type)
Usage and interaction data (e.g., app activity, preferences, diagnostic logs)
Transaction and payment data (e.g., purchase history, subscription status)
Location and language information, where relevant to the Services
Voice and conversation information, including messages, transcripts, AI responses, images, and associated summaries, embeddings and memory records, as provided or generated in delivering the Services
Categories of Data Subjects
End users of the Brilliant products or services
Customers or clients of the Controller
Employees or contractors of the Controller (if applicable)
Schedule 2 Processing instructions
These measures are consistent with the technical and organizational safeguards described in Brilliant’s Privacy Policy.
The Processor shall
Process Personal Data only as necessary to provide the Services described in the TOS and in accordance with the Controller's documented instructions, including AI assistance, recall and personalization where enabled
Assist the Controller in responding to Data Subject requests as required by applicable Data Privacy Laws
Refrain from using Personal Data for its own purposes
Limit access to Personal Data to authorized personnel only
Implement appropriate security measures as set out in Schedule 3
Notify the Controller of any Breach Event in accordance with Clause 13
Schedule 3 Security measures
The Processor shall implement appropriate measures to ensure the confidentiality, integrity, availability, and resilience of Personal Data. These measures include, at a minimum:
Encryption of data in transit and at rest
Role-based access controls and authentication mechanisms
Regular vulnerability and patch management
Secure data backup and recovery processes
Monitoring and logging of access and use
Privacy-by-design measures to minimize incidental capture of bystander or environmental data.
Data minimization and appropriate safeguards for local and cloud processing, including encrypted transmission to cloud services
Supported user controls for capture permissions and withdrawal of cloud AI sharing permission, and processes to assist the Controller with deletion of transcripts and associated memory records