Privacy Policy

Effective Date: August 24, 2026 | Last Updated: August 24, 2026 Thomas Abram, LLC | privacy@abram.network

1. Overview

Thomas Abram, LLC ("ABRAM," "we," "us," or "our") operates the ABRAM creative intelligence platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Platform.

We comply with applicable privacy laws, including the GDPR (EU/EEA), UK GDPR, CCPA (California), and applicable US state privacy laws.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, role (Client/Contractor), profile photo.
• Professional profile: Skills, experience, portfolio links, availability, hourly rates, location.
• Resume & documents: Uploaded resume files (parsed by AI), certifications, portfolio materials.
• Project information: Project briefs, deliverables, work orders, call sheets, run-of-shows.
• Financial information: Bank account details (via Stripe), billing information, billing address (used to calculate applicable sales tax on subscription purchases), invoices, transaction records. Payments between users are processed on the payment recipient's own Stripe account; identity and banking details you provide during Stripe onboarding are collected by Stripe as the account provider, not by ABRAM.
• Communications: Messages, invitations, and notifications sent through the Platform.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, click patterns.
• Device & technical data: IP address, browser type, operating system, device identifiers.
• Calendar data: Events and availability from connected calendars (Google/Microsoft).
• Log data: Error logs and API call logs processed via Sentry for error monitoring.

2.3 Log Data and Diagnostics (Crash Reports)

When you encounter an error or crash while using the Platform, we automatically collect diagnostic information ("Crash Reports"). This includes your web browser type, operating system, preferred language, screen dimensions, the exact page URL you were visiting, the error message, and a technical stack trace. If you are logged into your account, this diagnostic data may be associated with your User ID to help our team debug and resolve the issue.

Crash Report data may also include React component tree information captured at the time of the error, which could in limited circumstances contain data you had entered immediately before the crash. We process this data solely to identify, diagnose, and resolve technical issues. This data is processed under Legitimate Interest (GDPR Article 6(1)(f)) as described in Section 3.

2.4 Information From Third Parties

• WorkOS: Authentication identity, organization membership, SSO session data.
• Stripe: Payment confirmation, payout status, account verification status.
• Frame.io: Project and media asset metadata when Frame.io is connected.
• Slack: Workspace identity when Slack notifications are enabled.

2.5 Marketing Site, Events, and Digital Contact Cards

Our marketing site at abram.network is a separate surface from the Platform, and some of what we collect there works differently.

Digital contact cards and conference capture. ABRAM staff use printed codes at conferences and industry events. Scanning one opens a digital contact card at an address beginning /c/. When a card is opened we record that the scan happened, together with the device type, browser family, operating system, referring page, and an identifier derived from your IP address and browser user agent by a one-way salted hash that changes daily. We do not store your raw IP address for these scans. The hash lets us tell repeat views apart from distinct ones without keeping data that identifies you.

Contact details you choose to give us. A contact card includes an optional form. If you submit it, the name, email address, and any other details you enter are stored as a prospect record in ABRAM's own customer relationship management (CRM) system, along with the event and the staff member whose card you scanned. Submitting the form is voluntary, and nothing about the card requires it.

The contact card email. Submitting the form triggers one email to the address you provide. It contains the contact details of the ABRAM staff member whose card you scanned, as an attached contact file (vCard), so you can save them. This is a one-time response to your own submission and does not add you to any mailing list.

Marketing site analytics. The marketing site uses Google Analytics and Vercel Analytics, both subject to the cookie consent choices described in Section 6. The marketing site also hosts product demonstration videos streamed by Mux, which receives playback and delivery data as described in Section 5.1.

3. How We Use Your Information

We use your information for the following purposes. Where ABRAM relies on legitimate interest as a legal basis, we have conducted and documented a Legitimate Interest Assessment (LIA) confirming our interests are not overridden by your rights. You may request a copy by contacting privacy@abram.network.

4. AI & Automated Processing

ABRAM uses artificial intelligence and automated processing as core functions of the Platform.

4.1 What We Process With AI

Your data may be processed by AI systems to: parse your resume to extract skills and attributes; analyze project briefs; match you to projects or contractors; generate call sheets, run-of-shows, and project summaries; power the ABRAM AI Assistant; and index documents into your organization's knowledge base.

4.2 Web Search Within AI Features

Some AI features can search the public web to answer a request. Where that happens, a search query derived from what you asked is sent to our AI provider, which performs the search and returns results to the feature. This means text derived from your request leaves the Platform for the purpose of running that search. The query is derived from your request rather than copied from your stored records, and web search is used only where the feature needs current public information to answer you.

4.3 Internal Use of AI Over Business Records

ABRAM staff use AI tooling over ABRAM's own business records, including the CRM described in Section 5.6, for tasks such as searching, summarizing, and drafting. That processing runs through the same AI provider and under the same terms described in Section 5.1, and it is limited to what the individual staff member is already permitted to see. It does not extend to your Platform account contents or to the Organization Brain.

4.4 Organization Brain (Private Organizational Knowledge)

The Organization Brain is a private, organization-specific knowledge base. Data uploaded to the Organization Brain:

• is not shared with other users or organizations;
• is never used to train ABRAM's shared AI models regardless of your AI training consent setting; and
• is stored and processed solely to power AI features within your organization's account.

4.5 Automated Decision-Making & Your Rights (GDPR Article 22)

While ABRAM's matching and recommendation features involve automated processing, final hiring and engagement decisions are made by human users. If you believe an automated process has significantly and adversely affected you, you may contact legal@abram.network to request human review of the relevant automated output. We will respond to human review requests within 30 days.

5. Third-Party Integrations & Data Sharing

5.1 Service Providers and Sub-processors

We share your data with the following categories of third parties. Each of the providers below offers data processing terms addressing GDPR Article 28, which are incorporated into their standard service agreements and which apply to ABRAM's use of their services. Where a provider requires a separately executed Data Processing Agreement or Standard Contractual Clauses, we complete that step before the provider is used in production. You may ask which arrangement applies to a specific provider by contacting privacy@abram.network.

Vercel and Supabase are infrastructure providers rather than optional integrations. Because they host and store the Platform and the marketing site, data you give us necessarily passes through and rests on their systems, and this cannot be switched off while continuing to use ABRAM.

Data shared with Anthropic, PBC is processed securely via their developer API. In accordance with Anthropic's commercial terms, data sent via the API is not used to train or improve their models, is stored securely, and is deleted in accordance with their data retention policies.

Sentry's privacy policy is available at sentry.io/privacy. Anthropic's privacy policy is available at anthropic.com/privacy. Stripe's privacy policy is available at stripe.com/privacy. Adobe/Frame.io's privacy policy is available at adobe.com/privacy. Slack's privacy policy is available at slack.com/trust/privacy/policy. Use of these integrations is subject to the respective third parties' privacy policies and terms of service, and we encourage you to review them before connecting your accounts.

5.2 Google API Services User Data Policy Compliance

ABRAM Network’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.3 Between Users

Certain profile information (name, skills, availability, profile photo, professional experience) is visible to other users for the purpose of crew matching and collaboration.

5.4 Legal Compliance

We may disclose your information if required by law, court order, or to protect the rights and safety of ABRAM, our users, or the public.

5.5 Business Transfers

If ABRAM is acquired by or merged with another company, your data may be transferred as part of that transaction. We will notify you prior to its completion.

5.6 Transfers Between ABRAM's Own Systems

ABRAM runs the Platform and its business systems in separate databases. Both are controlled by Thomas Abram, LLC. The transfers described here are internal to ABRAM and are not disclosures to a third party.

Account records copied to our CRM. When you create a Platform account, your name, email address, account type (for example Contractor or Client), and organization identifier are copied into ABRAM's separate customer relationship management and marketing database, where they become a contact record. We use that record to understand who is using ABRAM and to run our own sales and support work.

Creating an account is not a mailing list signup. No marketing email is sent to you as a result of creating an account. Being added to a marketing mailing list requires a separate, affirmative opt-in that you give yourself, and the same rule applies to contact records created at events under Section 2.5. Transactional email about your account, such as security and billing notices, is separate and is sent under contractual necessity.

Billing records mirrored to internal finance records. Payment and collection events, including amounts, dates, payment status, and refunds, are mirrored from the Platform's billing systems into ABRAM's internal finance and commission records. This mirror carries transaction and account identifiers and exists so that revenue, collections, and internal commission calculations can be maintained. It does not include payment card numbers or bank account credentials, which remain with Stripe.

6. Cookies & Tracking

ABRAM runs two surfaces, and each keeps its own separate consent record. The marketing site at abram.network is where our public pages, documentation, and demonstration videos live. The Platform is the signed-in application. Visiting or setting preferences on one surface does not set them on the other, and each surface shows you its own banner and its own settings control.

On both surfaces, a consent banner appears on your first visit. You may accept all, reject all, or open the preferences panel and choose category by category. Accept and reject are presented with equal visual prominence, no optional category is pre-selected, and your choice is saved in your browser's local storage rather than in a tracking cookie. You can change or withdraw it at any time using the Cookie Settings control in the footer of either surface. On the Platform, if you are signed in, your choice is also recorded against your account so that it follows you to another browser, and that record is kept as evidence of consent.

Categories on the marketing site:

• Strictly Necessary: Required for the site to function. Cannot be disabled.
• Analytics & Performance: Google Analytics and Vercel Analytics, used to measure traffic and page views. Turning this category off stops both. Vercel Analytics does not load at all until this category has been affirmatively allowed, in every region.
• Personalized Recommendations & Ads: Controls the Google Consent Mode signals ad_storage, ad_user_data, and ad_personalization.

Categories on the Platform:

• Essential: Authentication, session management, and security. Cannot be disabled without preventing core functionality.
• Analytics & Performance: Product usage measurement.
• Third-Party / Integration: Telemetry and diagnostic tooling, including Sentry.

Google Analytics and Google Consent Mode are used on the marketing site only. They do not run inside the signed-in Platform.

How the marketing site's Consent Mode defaults are set. If you are in the EEA, the United Kingdom, or Switzerland, all four optional Consent Mode signals default to denied and stay denied until you opt in. Outside those regions they default to granted until you opt out, which is the opt-out model those jurisdictions permit. Either way the banner is shown, your choice always overrides the default, and once saved your choice is what applies on every later visit. Where advertising storage ends up denied, we additionally instruct Google to redact advertising data.

What happens before you choose. On neither surface do we record a consent decision before you have made one. The defaults above apply to that first visit only and are not written down as your choice. In the EEA, the United Kingdom, and Switzerland this means no analytics or advertising signal is sent from the marketing site until you opt in. Outside those regions, where the opt-out model applies, marketing site analytics may run during that first visit under the granted default and stop as soon as you opt out. Inside the signed-in Platform, no non-essential tracker starts and no preference is stored until you act on the banner, in every region. Where a region permits an opt-out model, the Platform banner may show its optional toggles already switched on to reflect that, but nothing is written or started until you choose.

We do not use advertising cookies or behavioral tracking cookies to build marketing profiles of you, and we do not sell or share personal information as those terms are defined by California law.

7. Data Retention

You may request account deletion through your account settings or by contacting legal@abram.network. Personal data will be deleted within 30 days of the request. You may request an export of your personal data at any time through your account settings.

If you do not have a Platform account and want the CRM or prospect record we hold about you corrected or deleted, including a record created when you scanned a contact card at an event, email privacy@abram.network. You do not need an account to make that request, and we will act on it within the same timeframes.

8. Your Rights

8.1 For All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Data Export / Portability: Download your data in a portable, machine-readable format.
• Withdraw AI Training Consent: Withdraw at any time through account settings. Withdrawal is prospective only.

8.2 Additional Rights for EU/EEA Users (GDPR)

• Object to Processing: Object to processing based on legitimate interests.
• Restrict Processing: Request restriction of processing while a dispute is resolved.
• Automated Decision Rights: Request human review of automated processing that significantly affects you (Section 4.5).
• Lodge a Complaint: With your national Data Protection Authority — see edpb.europa.eu.

8.3 Additional Rights for UK Users

The same rights as EU/EEA users above apply under the UK GDPR. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8.4 Additional Rights for California Residents (CCPA)

• Know: The categories and specific pieces of personal information collected about you.
• Delete: Personal information we hold about you.
• Opt-Out: Of the sale or sharing of personal information (ABRAM does not sell personal data).
• Non-Discrimination: You will not be discriminated against for exercising your CCPA rights.

To exercise any of these rights, contact legal@abram.network. We will respond within 30 days (CCPA) / 1 month (GDPR).

9. Data Security

We implement the following security measures:

• Encryption of data in transit (TLS 1.2+) and at rest.
• Row-level security (RLS) on all database records via Supabase.
• Access control and permission management via WorkOS.
• Error monitoring and alerting via Sentry.
• Regular security reviews of third-party integrations.
• Least-privilege access controls for ABRAM personnel.

No method of transmission over the internet is 100% secure. While we use commercially reasonable security measures, we cannot guarantee absolute security.

10. International Data Transfers

ABRAM is based in the United States. If you are accessing the Platform from the EEA or UK, your personal data may be transferred to and processed in the United States.

We rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We use the 2021 EU SCCs for transfers of personal data from the EEA to the United States.
• Transfer Impact Assessments (TIAs): Completed for each international transfer and maintained on file.
• UK IDTA: For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK addendum to the EU SCCs.

You may request information about our international transfer safeguards by contacting privacy@abram.network.

11. Data Breach Notification

In the event of a personal data breach, ABRAM will notify the relevant supervisory authority within 72 hours where required by GDPR Article 33 or applicable US state law, and will notify affected individuals without undue delay where the breach is likely to result in high risk to their rights and freedoms. All breaches are documented in ABRAM's internal breach register.

Report a potential breach: legal@abram.network

12. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. Contact legal@abram.network if you believe we have collected data from a minor.

13. Changes to This Policy

We will notify you of material changes via email and/or in-app notification at least 30 days before changes take effect. Where changes require new consent, we will obtain that consent separately. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

14. Contact & Data Controller

Data Controller: Thomas Abram, LLC

Address: Washington, DC

EU Data Protection Representative (GDPR Article 27): Thomas Abram, LLC is in the process of appointing an EU representative. In the interim, contact privacy@abram.network.

For GDPR-related complaints, EU/EEA users may contact their national Data Protection Authority (edpb.europa.eu). UK users may contact the ICO at ico.org.uk.

© 2026 Thomas Abram, LLC. All rights reserved.