Privacy Policy

Last Updated: October 27, 2026 Effective Date: October 11, 2026 for accounts created on or after that date. November 10, 2026 for accounts created before it, which remain under the version dated October 5, 2026 until then. Section 4.6 describes the work profile as it already operates and applies to everyone from today, and you can turn your work profile off at any time. The October 23, 2026 update removes Frame.io, which ABRAM no longer connects to, names the onboarding answers ABRAM keeps, and applies to everyone from that date. The October 27, 2026 update describes video uploads and ABRAM Vision, including searching footage by what is in the picture (Section 4.1), connecting an AI client such as Claude or ChatGPT to ABRAM (Section 4.8), and the Meta Pixel on abram.network, which shares visit and signup information with Meta for advertising unless you opt out (Sections 6 and 8.4). It applies to everyone from that date. Thomas Abram, LLC | privacy@abram.network

1. Overview

Thomas Abram, LLC ("ABRAM," "we," "us," or "our") operates ABRAM, production management software for film, video, and other creative productions. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the ABRAM platform in a browser or in the ABRAM iPhone app (the "Platform"), visit our marketing site at abram.network, or meet us at an event.

We design our practices to meet the GDPR (EU/EEA), the UK GDPR, the Swiss Federal Act on Data Protection, the CCPA (California), and other applicable US state privacy laws, and we extend the rights in Section 8 to everyone.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, your answers during onboarding (what you make, and whether you work on your own or as a team), profile photo, and time zone.
• Professional profile: Skills, experience, portfolio links, availability, rates, location, and, where your organization records them, employment details such as title, department, and weekly capacity.
• Files and documents: Documents, pictures, and other files you upload, such as scripts, briefs, certifications, and portfolio materials. If you choose to import a resume into your profile, its text is processed by AI to extract your skills (Section 4.1). Video and other files a workspace uploads are stored with Cloudflare, and Modal makes the review copies people play. Video review can also work from a link to a video hosted on Vimeo.
• Project information: Project briefs, scripts, deliverables, work orders, schedules, call sheets, run-of-shows, wrap reports, budgets, quotes, and expenses.
• Call transcripts: Transcripts of client calls or meetings that you paste or upload so that ABRAM can summarize them and suggest changes. ABRAM does not record calls. A transcript is visible only to people who can manage the project, and it is sent to our AI provider only when one of them asks ABRAM to read it.
• Hours and attendance: Timesheet entries, hours worked, and check-ins you record in ABRAM or through Slack.
• Financial information: Bank account details (via Stripe), billing information, billing address (used to calculate applicable sales tax on subscription purchases), invoices, transaction records. Payments between users are processed on the payment recipient's own Stripe account; identity and banking details you provide during Stripe onboarding are collected by Stripe as the account provider, not by ABRAM.
• Communications: Messages, comments, invitations, and notifications sent through the Platform, including conversations with Clients, comments left on deliverables or video cuts, and conversations with the ABRAM AI Assistant.
• Imported records: Projects, tasks, and related records you bring in from a spreadsheet file or from another project management tool you choose to import from.
• Your choices: Your consent and privacy settings, including cookie choices, the AI training opt-in, marketing email preferences, and your work profile settings, such as turning it off and confirming or rejecting style tags.

2.2 Information Collected Automatically

• Device & technical data: IP address, browser type, operating system, and device identifiers. We use IP addresses for security and rate limiting. ABRAM does not collect your device's precise location.
• Product usage events: If you allow analytics in the Platform's cookie settings, records of which features and pages you use, tied to your account, your organization and a per-session identifier. ABRAM keeps these itself and does not send them to an analytics company.
• Calendar data: Events from calendar feeds (calendar links) you choose to subscribe to, which ABRAM fetches periodically to show your availability. ABRAM also publishes a private calendar feed of your own schedule, at a link only you hold, if you choose to use it.
• Push notifications: If you turn on notifications in the ABRAM iPhone app, a device token from Apple, and the title and text of each notification we send, which can include names, timecard updates and message previews.
• Crash reports: Described in Section 2.3.
• Connected AI clients: If you connect an AI client to ABRAM (Section 4.8), a record of each request it makes: which tool it used, whether it worked, how long it took, and a one-way fingerprint of the request. We do not keep what it asked or what ABRAM returned.

2.3 Log Data and Diagnostics (Crash Reports)

When you encounter an error or crash while using the Platform, we automatically collect diagnostic information ("Crash Reports"): your browser type, operating system, preferred language, screen dimensions, the page address you were visiting, the error message, and a technical stack trace. If you are signed in, a Crash Report is associated with your User ID so that we can resolve the issue. A Crash Report may include component information captured at the time of the error, which could in limited circumstances contain data you had entered immediately before the crash.

ABRAM stores Crash Reports itself, and sends summaries of them to our internal Slack workspace, to staff email, and to the internal AI tooling described in Section 4.3, so that bugs are found and fixed. If you allow analytics in the Platform's cookie settings, Sentry also receives error messages, stack traces, page addresses with access links removed, and browser and device data. Sentry does not receive your User ID or email address.

We process this data solely to identify, diagnose, and resolve technical issues, under legitimate interest (GDPR Article 6(1)(f)), as described in Section 3.

2.4 Information From Third Parties

• WorkOS: Authentication identity, organization membership, SSO session data.
• Stripe: Payment confirmation, payout status, account verification status.
• Slack: Workspace identity when Slack notifications are enabled, and check-ins or replies you send to ABRAM from Slack.
• Jira, Asana, and monday.com: When your organization connects one of these tools to import work, the projects, tasks, assignees, and related details it chooses to import. People who appear as assignees are added as draft crew contacts, and nothing is sent to them. For Jira, we also periodically check with Atlassian whether imported Jira accounts have been closed or changed, so that we can erase or update that personal data as Atlassian requires.
• Calendar feeds: The events in any calendar link you subscribe to.

2.5 Marketing Site, Events, and Digital Contact Cards

Our marketing site at abram.network is a separate surface from the Platform, and some of what we collect there works differently.

Digital contact cards and conference capture. ABRAM staff use printed codes at conferences and industry events. Scanning one opens a digital contact card at an address beginning /c/. When a card is opened we record that the scan happened, together with the device type, browser family, operating system, referring page, and an identifier derived from your IP address and browser user agent by a one-way salted hash that changes daily. We do not store your raw IP address for these scans. The hash lets us tell repeat views apart from distinct ones without keeping data that identifies you.

Contact details you choose to give us. A contact card includes an optional form. If you submit it, the name, email address, and any other details you enter are stored as a prospect record in ABRAM's own customer relationship management (CRM) system, along with the event and the staff member whose card you scanned, and a notice of the submission is posted to our internal Slack workspace. Submitting the form is voluntary, and nothing about the card requires it.

The contact card email. Submitting the form triggers one email to the address you provide. It contains the contact details of the ABRAM staff member whose card you scanned, as an attached contact file (vCard), so you can save them. This is a one-time response to your own submission and does not add you to any mailing list unless you tick the separate box on the form asking to join it.

Campaign and link pages. When you visit an ABRAM campaign page or a link page on abram.network, we record the visit, how far you scrolled and what you clicked, with your country, device type, browser, operating system, referring page, campaign tags, and the same daily salted hash. Outside the EEA, the United Kingdom, and Switzerland, or once you allow analytics, link pages keep a random session identifier in your browser's session storage for as long as the tab is open. We do not store your raw IP address for these visits.

Newsletter. If you sign up for our newsletter on the marketing site, we keep your email address and the details you enter, and send you the newsletter until you unsubscribe.

Marketing site analytics and advertising. The marketing site uses Google Analytics and Vercel Analytics, and the Meta Pixel to measure our ads, under the cookie rules in Section 6. The marketing site also hosts product demonstration videos streamed by Mux, which receives playback and delivery data.

2.6 Information an Organization Provides About You

You may appear in ABRAM without having an account, because an organization that uses ABRAM has added you. For example:

• Crew contacts: An organization may add you to its crew roster or to a production with your name, contact details, role, rates, availability, and the hours and schedule you work on its productions. If it invites you to work, ABRAM records the invitation, the rate offered, and your answer, including any reason you give for declining.
• Client contacts: An organization may record you as a contact for one of its Clients, together with the quotes, invoices, approvals, call transcripts, and messages that relate to the work it does for you. If the organization turns on detailed job records (Section 4.6), your name as its client may appear in the records of the jobs done for you.
• Equipment borrowers: An organization that lends equipment may record your name and email address and, where a school records them, your student ID number and course codes.
• Client portal visitors: If an organization shares a client portal with you, you open it from a secure link and, depending on how the organization set it up, either verify your email address with a one-time code or enter your name and email address. You do not need an ABRAM account. We record the email address and any name you enter, whether the address was verified, and when you visited, and we show that visit record to the organization that shared the portal. Comments, approvals, and other activity you leave in the portal are stored with that organization's records. If you view or sign a quote, we record your IP address, your browser's user agent, and the e-signature consent text you agreed to, as evidence of the signature.
• Records of your work: When you work on an organization's projects, the organization's records of that work include the roles you held, the hours it approved, the deliverables you worked on and when they were delivered, approved, or revised, your bookings and check-ins, the invitations it sent you and how quickly you answered them, ratings left by people you worked with, and its crewing decisions, including whether you were suggested for a role, where you were ranked, and whether you were picked. ABRAM uses these records to build the work profile described in Section 4.6.

For this information the organization is the data controller and ABRAM processes it on the organization's behalf, as described in Section 17 of the Terms of Use and our Data Processing Addendum. If you want to access, correct, or delete it, please contact the organization first. You may also contact privacy@abram.network, and we will help you or pass your request to the organization.

There is one exception. If you have an ABRAM account, ABRAM also uses the records of your work in each organization to build a single work profile that spans every organization you have worked with on ABRAM (the "cross-workspace profile"). ABRAM decides why and how that profile is built, so ABRAM is the data controller for it, and you can turn it off at any time (Section 4.6). Requests about the cross-workspace profile come to us, not to the organization.

2.7 Information We Derive About Your Work

If you have an ABRAM account and work on projects in ABRAM, we calculate facts about that work from the records described in Sections 2.1 and 2.6. Together these make up your "work profile," described in full in Section 4.6. They are:

• Delivery: How many deliverables you worked on, how many were delivered by their due date (judged in the project's time zone), how many were approved at the first version, and the average number of revisions.
• Hours: Hours that an organization approved, and, where both exist, those hours compared with the estimate.
• Responsiveness: Invitations you accepted or declined and how long you typically took to answer.
• Invitations: For each crew invitation sent to you, the rate offered, the asking rate on your own profile at that moment, whether your ABRAM calendar already had a booking or time off in the invitation's dates with any organization (only that it did and which kind, never which booking or for whom), your answer, and any reason you choose to give for declining.
• Bookings: Bookings completed and cancelled, and how often you checked in.
• Collaboration: How many projects and organizations you have worked with, repeat work with the same organization, ratings left by people you worked with and their average, and a score for each person you have completed projects with, reflecting how recently and how often you worked together, whether one of you ran, crewed or chose the other for the project, and how the shared work turned out (a "pair score"). For each pairing on a crew we also record who chose whom. When a project is completed we record who was asked to rate their teammates and who answered, and with each rating the rater's role and working relationship to you (for example your lead, the producer, the client, or a colleague in the same or another department), worked out from the project's records.
• Confirmed jobs: A record each time an organization confirms your work on a project by approving your time or deliverables or completing the project: your role (with a standard role code where one applies), dates, approved hours, deliverables confirmed, what confirmed it and who approved it, with a cryptographic fingerprint so that the record can later be checked as unaltered. No rates or budgets are included. If the organization turns on detailed job records, the record also includes its name, the project title, and the client's name.
• Style of the work: Tags that describe the work itself, such as its format, genre, tone, look, pacing, audience, industry, or technique, chosen from a fixed list, together with the records each tag came from. You can confirm or reject a tag.
• Embeddings: Numerical representations of the text that describes your work, such as project and deliverable descriptions, used to compare the style of pieces of work.
• Crewing record: Each time someone in an organization looks for a person for a role or deliverable: everyone the suggestion scored (up to 500 people) with their scores, the top 25 with up to four reasons each, the role, dates, rate range and location the requester entered, which suggested people the requester viewed or opened, who was picked, and how the work turned out.

Every figure is stored with the number of items it is based on. A rate is shown only once three or more items count toward it, as a range, adjusted toward the average for everyone on ABRAM whose work profile is on. That average is used only when it covers at least 10 people and 50 items, and it is rounded, so it reveals no one. We calculate these facts from work recorded in ABRAM only, generally over the most recent two years. We do not infer your personality, character, emotions, health, or any other personal trait, and we do not use special categories of personal data to build a work profile.

3. How We Use Your Information

We use your information for the following purposes. Where ABRAM relies on legitimate interest as a legal basis, we have conducted and documented a Legitimate Interest Assessment (LIA) confirming our interests are not overridden by your rights. You may request a copy by contacting privacy@abram.network.

4. AI & Automated Processing

ABRAM uses artificial intelligence and automated processing as core functions of the Platform.

4.1 What We Process With AI

Your data may be processed by AI systems to: analyze project briefs, intake requests, and scripts; read call transcripts you provide and summarize decisions, follow-ups, and changes to scope or price; suggest people for open roles on a production; extract skills from a resume you choose to import; generate call sheets, run-of-shows, schedules, and project summaries; power the ABRAM AI Assistant; and index documents into your organization's knowledge base.

Some AI processing runs automatically rather than when someone asks: ABRAM classifies written feedback on deliverables, indexes documents uploaded to an organization, and prepares nightly summaries of an organization's outcomes.

Generative AI processing is performed by Anthropic, PBC through its commercial API. Under Anthropic's commercial terms, data sent through the API is not used to train Anthropic's models. ABRAM also creates numerical representations (embeddings) of document text, and of the text that describes projects, deliverables and people's work, using an open-source model that runs inside our database provider's infrastructure, so that step does not send your content to an additional company.

ABRAM Vision. On paid plans, ABRAM Vision checks footage against a project's shot list and plan, transcribes its sound, and lets people find shots by what is in the picture. A Vision or transcript run starts only when a person who manages the project approves it. For a run, Modal Labs, Inc. analyzes the picture and sound and turns speech into text, and Google Cloud receives low-resolution frames (no sound), the shot list and plan, and transcript text. To make a shot findable by its picture, ABRAM keeps a numerical representation of each sampled frame, made after people in the frame are masked out, so a search matches what is in the shot and never who is in it. When you search footage, the words you type (up to 200 characters) are sent to Modal, and where it is used to Google Cloud, to turn them into a search; ABRAM does not log or store them. ABRAM Vision does not identify anyone by face or voice.

On the Enterprise plan, ABRAM switches off every AI feature for an organization at an owner's request. On every plan, owners can limit what the AI Assistant does on its own in Settings.

4.2 Web Search Within AI Features

Some AI features can search the public web to answer a request. Where that happens, a search query derived from what you asked is sent to our AI provider, which performs the search and returns results to the feature. This means text derived from your request leaves the Platform for the purpose of running that search. The query is derived from your request rather than copied from your stored records, and web search is used only where the feature needs current public information to answer you.

4.3 Internal Use of AI by ABRAM

ABRAM staff, and ABRAM's internal AI agents, which run on GitHub, Inc.'s infrastructure, use AI tooling to diagnose and fix errors, support customers, review changes to the Platform, research the market, and work with ABRAM's own business records, including the CRM described in Section 5.6. To do that they can read Platform data, including account contents and the Crash Reports described in Section 2.3, and they use it only for those purposes.

That tooling runs on Anthropic's Claude subscription service, not on its commercial API, and is governed by Anthropic's terms for that service rather than the commercial terms in Section 4.1. We have turned off the setting that lets Anthropic use those conversations to improve its models. Because Anthropic does not offer a data processing agreement for that service, we list it separately on our sub-processor page.

4.4 Organization Brain (Private Organizational Knowledge)

The Organization Brain is a private, organization-specific knowledge base. Data uploaded to the Organization Brain:

• is not shared with other users or organizations;
• is never used to train ABRAM's shared AI models regardless of your AI training consent setting; and
• is stored and processed solely to power AI features within your organization's account.

4.5 Automated Decision-Making & Your Rights (GDPR Article 22)

ABRAM does not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

ABRAM's crew suggestions, rankings, work profile figures, style tags, and pair scores are produced by automated processing, and they can influence who an organization considers for work. They are inputs for a person to weigh, not decisions:

• A person decides. Choosing, booking, or engaging someone is always an action taken by a person in the organization. ABRAM does not book anyone, reject anyone, or send an invitation on its own. Invitations are sent only when a person in the organization sends them.
• Suggestions come with reasons. A suggestion is shown with the main factors behind it, such as matching skills, past roles, availability, and the delivery record and collaborators described in Section 4.6, so the person deciding can judge it rather than simply follow it.
• Figures show their basis. Every work profile figure carries the number of items it is based on, and rates are shown as ranges.
• One entry may be chosen at random. A suggestion list may add one person labelled "Also consider," picked at random from the organization's own members and crew who ranked lower, so that we can measure and improve the fairness of our suggestions. It is always labelled and shown after the ranked suggestions, and we record the probability of each pick.

If you believe an automated suggestion or figure has significantly and adversely affected you, you may contact privacy@abram.network to ask for an explanation of the main factors behind it, to request human review of it by ABRAM, to give your point of view, or to contest it, and to have inaccurate data corrected. We will respond within 30 days. Where the decision itself was made by an organization, that organization is responsible for it, and we will help it answer your request.

4.6 Your Work Profile

ABRAM builds a work profile from the projects you work on: your roles, hours, delivery, invitations, collaborators, confirmed jobs, and the style of your work (Section 2.7). Its purpose is to help match people to work on the evidence of work they have actually done, and to give you a record of your own work.

How it is built. Work profiles are calculated by fixed rules and statistics in our database. No generative AI model calculates any figure, tag, or score in a work profile, and building it does not send your data to Anthropic or any other AI company. Style tags come from matching the words used to describe a project or deliverable against a fixed list. Embeddings are created by the open-source model described in Section 4.1, inside our own infrastructure. If we ever turn on an optional feature that asks our AI provider to suggest style tags, it will run only for organizations on a paid plan with AI turned on, only on that organization's own deliverable text, and only choosing from the same fixed list, and we will update this Policy before it runs.

Two kinds of work profile.

• Workspace profile. Each organization has a work profile for each person who works on its projects, calculated only from work done in that organization. It is part of the organization's own records: the organization is the controller and ABRAM processes it on the organization's behalf (Section 2.6). People in that organization who manage crewing can use it when choosing people for work.
• Cross-workspace profile. If you have an ABRAM account, ABRAM combines your workspace profiles into one profile across every organization you have worked with on ABRAM. ABRAM is the controller for it. Only you can see it. It is not shown to any organization.

Two figures draw on work across organizations and can be seen by people other than you. The average of ratings left by people you have worked with, with the number of ratings behind it, appears on your professional profile, so anyone who can view your profile can see it (Section 5.3). A pair score between you and another person can be seen by members of an organization you both belong to. Neither includes any rate, budget, client name, or document. Figures in each workspace are shown as ranges adjusted toward anonymous platform-wide averages (Section 2.7).

Confirmed jobs. Confirmed job records belong to the organization whose work they describe and are visible only to you and to that organization's owners, Admins and project managers. Records are never edited: a change or withdrawal adds a new record, and the earlier one is kept as history. Detailed job records, which add the organization's name, the project title and the client's name, are off unless the organization's owners or Admins turn them on, and they, or a project's owner, can keep a project's title and client off its records, which also removes them from that project's existing records. Deleting a client removes the client's name from every record.

Your choice. The work profile is on unless you turn it off. We tell you about it when you sign up, or with a notice in the Platform if your account was created before it existed, and you can turn it off at that point or at any time in your account settings under Privacy. When you turn it off:

• we delete your cross-workspace profile, the embeddings that describe you as a person, the style tags you confirmed, every pair score involving you, the peer rating average on your professional profile, your entries in our matching tests, and the working-patterns summary described below. Tags you rejected stay rejected, so they are not shown again;
• we stop building a cross-workspace profile, pair scores and a peer rating average for you, and do not rebuild them from old records while it is off;
• if you had chosen to be discoverable in a marketplace, that choice is withdrawn too; and
• the deletion happens automatically when you make the choice. Any copies in backups expire on the normal backup cycle and are not restored to use.

Turning it off does not delete an organization's own records of the work you did for it, including its workspace profile, its crewing record, and confirmed job records. Those belong to the organization (Section 2.6). Deleting your account removes them as described in Section 7. If you turn the work profile back on, your cross-workspace profile is rebuilt from the records that still exist. We keep a record of each choice you make, so that a choice to turn it off is never lost.

Working-patterns summary. If you have given the separate AI training consent (Section 6.2 of the Terms of Use) and your work profile is on, ABRAM writes a short summary of your working patterns, such as the roles you are booked for most, how quickly you usually answer invitations, and your average peer rating. The ABRAM AI Assistant can use it as context when you talk to the Assistant, which means it is sent to Anthropic, PBC as part of your own conversations. It leaves out work for any organization that has switched AI off. Withdrawing either consent deletes it.

Testing our matching. We test how well ABRAM's matching works by running it in the background over work profiles that have not been turned off and comparing its results with what actually happened. Each test keeps every person it scored with the main reasons for their score, and monthly counts of how often each person ranked near the top, so that we can check that matching treats people fairly. These results are not shown to any organization or to you, nothing is decided from them, and ABRAM staff see totals only. Your data export includes your entries.

What we do not do with work profiles. We do not sell or license work profiles or any other customer data, and we do not provide them to AI companies or anyone else as training data. We do not use them for advertising. We do not use your work profile to train a machine-learning model unless you have given the separate AI training consent. We do not infer personality, character, or other personal traits.

Your rights over your work profile. You can turn it off (above), confirm or reject the style tags ABRAM shows you, ask us to correct a figure that is wrong, and download your work profile as part of your data export (Section 8.1). Where a figure is wrong because an organization's underlying record is wrong, we will tell you, and we can pass your request to that organization.

4.7 Matching Suggestions and a Future Marketplace

Today. ABRAM suggests people for work only to an organization that already works with them: its own members and the crew it has added. ABRAM does not suggest you to, or show your work profile to, an organization you have not worked with or been added to. When an organization looks for someone, ABRAM keeps the result in that organization's crewing record. The full list of candidates for a role, which suggested people were viewed or opened, and who chose whom for a crew are visible only to people who can manage crewing for that project. People who crew a project can also see the rate offered in an invitation, whether a calendar conflict existed, your answer, and any reason you gave for declining. They cannot see the asking rate recorded from your profile, which ABRAM keeps to compare offers with asking rates and which is included in your data export. If you were a candidate, you can ask us where you were ranked and the reasons given.

A future marketplace. ABRAM may in future offer a marketplace that helps organizations find people they have not worked with before. If it does:

• only people who choose to be discoverable will be shown to organizations they have not worked with. Being discoverable will be a separate choice, off by default, and turning off your work profile will turn it off too;
• a person in the hiring organization will make every decision to contact or book someone, and suggestions will come with the reasons behind them; and
• before it launches, we will update this Policy to describe exactly what an organization can see about a discoverable person, and we will ask for your choice.

The marketplace is not available today, and nothing in ABRAM shows you to an organization you have not worked with.

4.8 AI Clients You Connect

On paid plans, you can connect an AI client that you use, such as Claude or ChatGPT, to your ABRAM account. Here is what that means for your data:

• You start it. Nothing is shared until you connect the AI client yourself and sign in to ABRAM from it. Sign-in for these connections runs through WorkOS.
• It sees what you can see. The AI client asks ABRAM for information, and ABRAM answers with what you are allowed to see, such as schedules, projects, people's names and roles, budgets, documents and footage search results. It can also make the small changes described in Section 10.2 of the Terms of Use. It cannot send messages, move money, approve, delete or invite.
• What it receives goes to the company that provides it. ABRAM's answers are sent to the provider of your AI client, for example Anthropic for Claude or OpenAI for ChatGPT, and are then handled under your own agreement with that provider and its privacy policy. That provider is not ABRAM's sub-processor, and this sharing happens because you direct it. Where you use ABRAM for an organization, you share its information only as that organization allows.
• What ABRAM keeps. A record of each request, described in Section 2.2, without its content.
• You can stop it at any time by disconnecting ABRAM in your AI client. An organization can ask us to switch it off for its workspace by writing to privacy@abram.network.

5. Third-Party Integrations & Data Sharing

5.1 Service Providers and Sub-processors

We share personal data with service providers that host, store, and process it on our behalf: infrastructure (Vercel, Supabase), file storage and video review (Cloudflare, Modal), identity (WorkOS), payments (Stripe), AI (Anthropic, and for ABRAM Vision, Modal and Google Cloud), error monitoring (Sentry), email (Resend and Microsoft 365), push notifications (Apple), analytics on the marketing site (Google Analytics, Vercel Analytics), video (Mux, Vimeo), engineering tools (GitHub, Slack), and the integrations you choose to connect (Slack, Jira, Asana, monday.com).

Every provider that processes personal data for us, what it receives, why, where it operates, and the terms it works under is listed at abram.network/subprocessors, which forms part of this Policy. Our providers' agreements include data processing terms that address GDPR Article 28, except where the sub-processor page says otherwise. You may ask which arrangement applies to a specific provider by contacting privacy@abram.network.

Vercel and Supabase are infrastructure providers rather than optional integrations. Because they host and store the Platform and the marketing site, data you give us necessarily passes through and rests on their systems, and this cannot be switched off while continuing to use ABRAM.

Embedded content. Some pages load content directly from another company's servers, which then receives your IP address and browser information and may set its own cookies under its own privacy policy. Video cuts in a client portal or on a link page play in Vimeo's embedded player, served by Vimeo.com, Inc. Public link pages may also load thumbnails from YouTube and fonts from Google Fonts. Where a person has no profile photo, ABRAM may display a placeholder image generated from their initials by an outside avatar service (ui-avatars.com), which receives those initials. The iPhone app loads a document-reading component from a public code library network (cdnjs, operated by Cloudflare) when you import a resume.

Use of the integrations you connect is subject to the respective third parties' privacy policies and terms of service, and we encourage you to review them before connecting your accounts.

5.2 Google API Services User Data Policy Compliance

ABRAM Network's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.3 Between Users

Certain profile information (name, skills, availability, profile photo, professional experience) is visible to the other members of organizations you belong to, and to people working on the same productions as you, for the purpose of crewing and collaboration. Rates are shown only to people with permission to view financial data. If your professional profile is set to public, other signed-in ABRAM users can see its descriptive parts, including your peer rating average and the number of ratings behind it, and a rate or contact detail only where you chose to show it. An organization decides what its Clients can see in a client portal, and nothing is shared there until the organization shares it.

Within an organization, people who manage crewing can see that organization's workspace profiles and crewing record (Sections 4.6 and 4.7). Each peer rating, with the rater's role and relationship to you, can be seen by the rater, the person rated, members of the organization that ran the project, its crew, and its client, and the same people can see who was asked to give ratings. Your cross-workspace profile is visible only to you.

5.4 Legal Compliance

We may disclose your information if required by law, court order, or to protect the rights and safety of ABRAM, our users, or the public.

5.5 Business Transfers

If ABRAM is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will tell you before your data becomes subject to a different privacy policy.

5.6 Transfers Between ABRAM's Own Systems

ABRAM runs the Platform and its business systems in separate databases. Both are controlled by Thomas Abram, LLC. The transfers described here are internal to ABRAM and are not disclosures to a third party.

Account records copied to our CRM. When you create a Platform account, your name, email address, your account type, your organization's identifier and name, your plan, and the date you joined are copied into ABRAM's separate customer relationship management and marketing database, where they become a contact record. We also copy account milestones, such as your first project, quote or invoice, AI usage thresholds, plan and trial changes, and periods of inactivity. We use that record to understand who is using ABRAM, for sales and support follow-up, and to choose which lifecycle emails to send. If you allow analytics in the Platform, the campaign that brought you to ABRAM (campaign tags, first landing page, referring site, and that site visit's identifier) is attached to your new account and its CRM record. If you allowed Marketing on abram.network, that choice and the Meta click identifiers your browser carried are attached too, so that we can report the signup to Meta (Section 6). Deleting your account also deletes the contact record copied to our CRM within the same period.

Marketing email. Creating an account does not sign you up to marketing email in the EEA, the United Kingdom, or Switzerland: there we send it only after you opt in, which you can do in Settings, Notifications. Elsewhere, account holders receive our newsletter and promotional lifecycle email until they turn it off in Settings, Notifications or use the unsubscribe link in any marketing email. The same opt-in rule applies to contact records created at events under Section 2.5. Transactional email about your account, such as security, billing, invitation and legal notices, is separate and is sent under contractual necessity.

Billing records mirrored to internal finance records. Payment and collection events, including amounts, dates, payment status, and refunds, are mirrored from the Platform's billing systems into ABRAM's internal finance and commission records. This mirror carries transaction and account identifiers and exists so that revenue, collections, and internal commission calculations can be maintained. It does not include payment card numbers or bank account credentials, which remain with Stripe.

5.7 No Sale or Licensing of Customer Data or Work Profiles

ABRAM does not sell, rent, or license customer data or work profiles to anyone, and does not provide them to AI companies or anyone else as training data. Matching people to work inside ABRAM, as described in Sections 4.6 and 4.7, is a feature of the Platform, not a sale or license of your data. Service providers that help us run those features process data only on our behalf.

6. Cookies & Tracking

ABRAM runs two surfaces, and each keeps its own separate consent record. The marketing site at abram.network is where our public pages, documentation, and demonstration videos live. The Platform is the signed-in application. Setting preferences on one surface does not set them on the other.

Choosing. On both surfaces you can accept all, reject all, or choose category by category. Accept and reject are presented with equal visual prominence, and no optional category is pre-selected in the EEA, the United Kingdom, or Switzerland. Your choice is saved in your browser's local storage rather than in a tracking cookie, and you can change or withdraw it at any time: on the marketing site with the Your privacy choices control in the footer, and in the Platform under Settings, About, Cookie settings (on the phone, from the Me menu). In the Platform, if you are signed in, your choice is also recorded against your account so that it follows you to another browser, and that record is kept as evidence of consent.

In the Platform. There are two categories:

• Essential: Sign-in, session management, security, and your preferences, such as the organization you last opened and your display settings. These cannot be turned off.
• Analytics: Product usage events kept by ABRAM (Section 2.2), signup attribution (Section 5.6), and Sentry error and performance monitoring (Section 2.3). Nothing in this category starts, in any region, until you make a choice.

Google Analytics and advertising tools do not run inside the Platform.

On the marketing site. There are three categories:

• Strictly Necessary: Required for the site to work, including remembering your cookie choice. Cannot be turned off.
• Analytics & Performance: Google Analytics and Vercel Analytics, used to measure traffic and page views. Turning this category off stops both.
• Marketing: The Meta Pixel, provided by Meta Platforms, Inc. and, for the EEA, the United Kingdom and Switzerland, Meta Platforms Ireland Limited ("Meta"). It tells Meta which pages you visited after seeing one of our ads, and when you click through to create an account. If you then create an account, we send Meta a record of that signup from our servers: your email address, name and account ID, each hashed so that Meta can match them without receiving them in readable form, with the Meta click identifiers your browser carried. We do not send Meta anything about your work, your organization or your plan. Meta uses this to measure our ads and to show them to people likely to find ABRAM useful, and processes it under its own privacy policy. Turning this category off stops the Pixel and the signup record.

How analytics behave depends on where you are, which we work out from your IP address when the page loads, without storing it:

• In the EEA, the United Kingdom, and Switzerland, Google Analytics does not load at all, and no analytics signal is sent, until you opt in.
• Elsewhere, Google Analytics runs from your first visit until you opt out, which is the opt-out model those jurisdictions permit, and stops as soon as you do.
• Everywhere, Vercel Analytics does not load until you have allowed analytics, and every Google advertising signal stays denied.

Marketing follows the same regions, one step stricter:

• In the EEA, the United Kingdom, and Switzerland, the Meta Pixel does not load, and no signup is reported to Meta, unless you have turned Marketing on.
• Elsewhere, the Meta Pixel runs until you opt out. Turning Marketing off, or browsing with a Global Privacy Control signal, opts you out, and we treat a Global Privacy Control signal as a valid request to opt out of sharing under California law. A choice you saved before the Marketing category existed keeps your Analytics answer, so if you rejected analytics, Marketing stays off.

Sending this information to Meta for advertising is "sharing" as California law defines it. We do not sell personal information.

Our sites do not respond to browser Do Not Track signals. You can control analytics at any time with the cookie settings above.

7. Data Retention

Deleted data can remain in our providers' backups until those backups expire, and it is not restored to use in the meantime.

You can delete your account in your account settings or by contacting privacy@abram.network. If you do not have a Platform account and want the CRM or prospect record we hold about you corrected or deleted, including a record created when you scanned a contact card at an event, email privacy@abram.network. You do not need an account to make that request.

8. Your Rights

8.1 For All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Data Export / Portability: Download your data in a portable, machine-readable format in your account settings. The export covers your Platform records and personal files, including your work profile, confirmed job records, invitation records including the asking rate we recorded, the crewing records in which you were picked, when your entry in a suggestion list was viewed, your matching test entries, and the records of requests from AI clients you connect. For our CRM or mailing list copy, or data held by Stripe or WorkOS, email privacy@abram.network. You can also ask us for other crewing records that concern you, such as where you were ranked.
• Withdraw Consent: Withdraw any consent you have given, including the AI training consent and analytics cookies, at any time in your settings. Withdrawal is prospective only.
• Marketing Email: Opt out at any time in Settings, Notifications or with the unsubscribe link in any marketing email.
• Turn Off Your Work Profile: Turn it off at any time in your account settings under Privacy. What that deletes and what it does not is set out in Section 4.6.
• Correct Your Work Profile: Confirm or reject the style tags ABRAM shows you, and ask us to correct a work profile figure that is wrong (Section 4.6).

8.2 Additional Rights for EU/EEA and Swiss Users

• Object to Processing: Object to processing based on legitimate interests. For the cross-workspace work profile, turning it off is an objection we honor in full, without asking for reasons. For an organization's workspace profile, the organization decides on the objection as controller, and we will pass your request to it. You can object to direct marketing at any time, without giving a reason.
• Restrict Processing: Request restriction of processing while a dispute is resolved.
• Automated Decision Rights: Request an explanation of, human review of, or to contest automated processing that significantly affects you (Section 4.5).
• Lodge a Complaint: With your national Data Protection Authority (see edpb.europa.eu), or in Switzerland with the Federal Data Protection and Information Commissioner.

8.3 Additional Rights for UK Users

The same rights as EU/EEA users above apply under the UK GDPR. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8.4 Additional Rights for California Residents (CCPA)

We extend these rights to California residents whether or not the CCPA applies to ABRAM.

• Know: The categories and specific pieces of personal information collected about you.
• Delete: Personal information we hold about you.
• Correct: Inaccurate personal information we hold about you, including your work profile.
• Opt-Out: Of the sale or sharing of personal information. ABRAM does not sell personal information. We share identifiers and internet activity with Meta for cross-context behavioral advertising, as described in Section 6. You can opt out with Your privacy choices in the footer of abram.network, or by sending a Global Privacy Control signal.
• Non-Discrimination: You will not be discriminated against for exercising your CCPA rights.

In the past 12 months we collected the categories of personal information described in Section 2: identifiers, such as name, email address and IP address; customer records and commercial information, such as billing details and transactions; internet and device activity; professional and employment-related information; and inferences drawn from your work (Section 2.7). We collected them from you, from organizations that use ABRAM, and from the providers in Section 2.4, for the purposes in Section 3, and disclosed them for business purposes to the service providers listed at /subprocessors. In the same period we shared identifiers (hashed email address, name and account ID, and cookie identifiers) and internet activity (pages visited on abram.network) with Meta for advertising, unless you opted out. We do not use sensitive personal information to infer characteristics about you.

Automated decisionmaking technology. California regulations on automated decisionmaking technology apply from January 1, 2027 to technology used to make significant decisions about people, including decisions about employment and independent contracting opportunities. ABRAM does not make those decisions. Suggestions and work profile figures are shown to a person in an organization, who reviews them and decides, as described in Section 4.5. An organization that uses ABRAM's suggestions in its own decisions is responsible for any notices and rights California law requires of it, and we will give it the information it reasonably needs. If we introduce a feature that would bring ABRAM's own processing within those regulations, including a marketplace (Section 4.7), we will provide the notices and rights they require before the feature is used.

8.5 Residents of Other US States

Several other US states give their residents rights over their personal data, and some regulate artificial intelligence used in decisions about employment and other opportunities. Colorado, for example, regulates high-risk artificial intelligence systems used in consequential decisions, with obligations taking effect on January 1, 2027. We are assessing how these laws apply to crew suggestions inside an organization's workspace and to any future marketplace, and we will update this Policy as that work concludes. Wherever you live, you can use the rights in Section 8.1, including asking for an explanation of a suggestion, for human review, and for correction of data a suggestion used (Section 4.5).

8.6 How to Exercise Your Rights

Email privacy@abram.network, or use the settings described above. We will respond within 30 days (CCPA) or one month (GDPR, UK GDPR and Swiss law). To protect your data we may confirm your identity before acting, usually by asking you to reply from the email address on your account. You may use an authorized agent, who must show us your signed permission. If we decline a request, you may appeal by replying to our decision, and we will answer the appeal in writing.

9. Data Security

We implement the following security measures:

• Encryption of data in transit (TLS 1.2+) and at rest by our infrastructure providers.
• Row-level security in the database that separates each organization's data.
• Authentication and single sign-on through WorkOS, and role-based permissions within each organization.
• Error monitoring and automated daily compliance checks.

No method of transmission over the internet is 100% secure. While we use commercially reasonable security measures, we cannot guarantee absolute security. The Trust Center describes our security program and what is still in progress.

10. International Data Transfers

ABRAM is based in the United States, and the Platform's data is stored in the United States. If you use ABRAM from the EEA, the United Kingdom, or Switzerland, your personal data is processed in the United States.

• Data you give us directly. When you sign up and use ABRAM yourself, you provide your data directly to ABRAM in the United States.
• Data an organization gives us. When an organization in the EEA, the United Kingdom, or Switzerland puts personal data into ABRAM, our Data Processing Addendum applies, with the 2021 EU Standard Contractual Clauses, the UK Addendum, and the Swiss adjustments.
• Our providers. Our providers are listed at /subprocessors with the region each operates in. Where a provider is certified under the EU-US Data Privacy Framework we rely on that, and otherwise on Standard Contractual Clauses.
• Transfer impact assessments. We are completing transfer impact assessments for these transfers.

You may request information about our international transfer safeguards by contacting privacy@abram.network.

11. Data Breach Notification

In the event of a personal data breach, ABRAM will notify the relevant supervisory authority within 72 hours where required by GDPR Article 33 or applicable US state law, and will notify affected individuals without undue delay where the breach is likely to result in high risk to their rights and freedoms. Where we hold the data for an organization, we notify the organization within 48 hours, as our Data Processing Addendum provides. All breaches are documented in ABRAM's internal breach register.

Report a potential breach or security issue: security@abram.network

12. Children's Privacy

The Platform is not intended for individuals under the age of 18, and we do not knowingly collect personal data from minors. Schools and other organizations must not add students under 18 to ABRAM without the consent their law requires. Contact privacy@abram.network if you believe we have collected data from a minor.

13. Changes to This Policy

We will notify you of material changes via email and/or in-app notification at least 30 days before changes take effect for existing accounts. A new version applies to accounts created after it is published from the day it is published. Where a change requires new consent, we will obtain that consent separately. Previous versions are available from privacy@abram.network.

14. Contact & Data Controller

Data Controller: Thomas Abram, LLC

Thomas Abram, LLC is the controller of the personal data described in this Policy, including the cross-workspace work profile. For information an organization provides about you and the records of work it keeps, including its workspace profiles and crewing records, the organization is the controller and ABRAM acts on its behalf (Section 2.6).

Based in: Washington, DC

Mailing address: 131 Continental Dr, Suite 305, Newark, DE 19713, US

EU and UK representatives (GDPR and UK GDPR Article 27): Not yet appointed. Until they are, contact privacy@abram.network, and we will answer requests from the EU and the UK on the same terms.

Data Protection Officer: ABRAM has assessed whether it must appoint a Data Protection Officer and has not appointed one. privacy@abram.network reaches the person responsible for data protection.

For GDPR-related complaints, EU/EEA users may contact their national Data Protection Authority (edpb.europa.eu). UK users may contact the ICO at ico.org.uk.

© 2026 Thomas Abram, LLC. All rights reserved.