Last Updated: March, 2026
Contact: support@braxos.com
Introduction
braXos provides a suite of enterprise physical access control and security integration products. This Privacy Notice explains how and why we might collect, store, use, and/or share (“process”) your information when you use any of the following braXos applications and services (collectively, the “Services”):
- braXpass – A mobile credential application that allows authorized users to request, receive, and delete mobile credentials on their mobile device. Available for iOS and Android.
- Composer – A workflow automation platform that enables the construction of integrations using a library of cloud connectors, which may process personal information residing in connected systems. Composer is stateless and currently accessible only to braXos personnel.
- Crescendo – An elevator access control solution integrated with braXos’s access management platform.
- LiftOff – A mobile application that allows users to call an elevator using their mobile device. Available for iOS and Android.
- Symphony – An identity lifecycle management portal and API that enables customers to manage credentials for access control systems under their subscription. Symphony is stateless.
- Harmony – braXos’s cloud platform that underpins the delivery of the above services.
braXos provides these applications and is a controller of personal information. Personal information may also be delegated by the user to building administration and other responsible parties in order to acquire access to otherwise secured destinations or activities.
By using our Services, you consent to this Privacy Notice and our collection, use, and sharing of your information in accordance with the terms below.
Collection of Information
The personal information we collect depends on which braXos Services you use and how you interact with them.
Information You Provide Directly
When you register for or use our Services, you may provide:
- First and last name
- Email address
- Phone number (LiftOff and Harmony only)
Information Collected Automatically
When you use our mobile applications (braXpass and LiftOff), we may automatically collect:
- Device Information: Device make, model, device ID, and online identifiers.
- Location Information: Location data as reported by Bluetooth beacons when you are
within range of an access control reader or elevator lobby beacon. When not within
range of a beacon, the app does not report or collect location information. - Mobile Activity: Activity data when the app is in the foreground or when the app, in the
background, is near an access control reader or elevator lobby Bluetooth beacon
Information Collected from Third Parties
We may receive personal information from buildings or their affiliated third parties with whom you have a relationship, such as building administrators and property management systems.
Symphony-Specific Collection
Symphony manages the synchronization, addition, updating, and deletion of credential information on behalf of properties whose user information resides in access control systems.
The following attributes may flow through Symphony:
- First and last name
- Email address
- Credential information (card number, facility code, etc.)
- Access group membership
- Profile and credential activation and expiration dates
Symphony portal access registration involves users supplying their first and last name and email address.
Composer-Specific Collection
Composer is a workflow automation platform that processes data flowing through integrations configured by braXos. The Composer portal is currently accessible only to braXos personnel via VPN and is not available to end customers. As a stateless system, Composer does not independently store personal information; data passes through integrations in real time as configured.
Use of Information
Personal information collected through our Services may be used for the following purposes:
- Allowing building approvers and administrators to grant access to secured locations and additional privileges (e.g., roles)
- Verifying ownership of contact information presented to building approvers when requesting access (LiftOff)
- Securing braXos systems, preventing fraud, and protecting the security of user accounts
- Providing access to secured destinations in accordance with applicable law
- Processing elevator calls and providing elevator calling activity to building administrators (LiftOff)
- Facilitating support by braXos
- Communicating with you via push notifications (e.g., QuickLift Push, 2FA)
- Fulfilling our legal obligations
- Conducting auditing and monitoring of transactions and engagement
- Maintaining the quality and safety of services and devices, and improving, upgrading, or enhancing them
- Conducting research and development
Disclosure of Information
Disclosure of personal information is limited to:
- Building administrators and approvers you have elected to interact with by requesting access to secured locations or elevated privileges
- Elevator manufacturers and mobile credential issuers in the context of problem determination in collaboration with braXos support
- Security integrators in the context of problem determination in collaboration with braXos support (Symphony)
- Law enforcement or regulatory authorities when presented with a legitimate legal request
Whenever in the course of sharing information we transfer personal information to other countries, braXos will ensure that the information is transferred in accordance with this Privacy Notice and as permitted by the applicable laws on data protection.
Retention
braXos will retain personal information as long as needed in order to permit the functioning of our Services, comply with laws and regulations, and maintain a secure operating environment. When braXos no longer has an ongoing legitimate business need to process your personal information, we will either delete or anonymize such information. We dispose of the information we collect in accordance with braXos’s retention policies and procedures.
Your Information and Rights
You can request access to your personal information, or correct or update out-of-date or inaccurate personal information we hold about you. You may also request that we delete personal information that we hold about you.
Please email support@braxos.com with any questions about this policy.
California Privacy Rights
This California Consumer Privacy Act Notice (“California Notice”) describes how we handle your personal information, the reasons we do so, and the rights you have as a California resident regarding your information. This Notice supplements the braXos Privacy Notice.
This California Notice uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations.
Categories of Personal Information Collected
We may collect or receive (and may have collected or received during the 12-month period prior to the Last Updated date of this California Notice) the categories of personal information listed below. Not all categories will be collected or received for every individual.
- Identifiers: Personal identifiers, such as name, telephone number (LiftOff and
Harmony), and email address. Telephone numbers are not stored by LiftOff; obfuscated
numbers are shown to delegated partners. - Device Information and Online Activity: Device and online identifiers, mobile activity
when the app is in the foreground or when the app, in the background, is near an access
control reader or elevator lobby Bluetooth beacon. - Communications: Verification of the phone number associated with the device (LiftOff)
or via SMS for enrollment (Harmony), and verification of the email address if the property
is managing access via an access control system. - Geolocation: Location information as reported by access control readers or elevator
beacons to the app via Bluetooth. When not within range of a beacon, the app does not
report or collect location information.
Categories of Sources
We may obtain and combine personal information from different sources:
- Provided directly by you
- Collected from the device associated with you
- Collected from a building or a building’s affiliated third party with whom you have a relationship
Purposes for Collecting Personal Information
We may use your personal information for the purposes described in the Use of Information section above and as provided below:
- Providing customer service
- Conducting auditing and monitoring of transactions and engagement, including auditing compliance
- Helping to ensure security and integrity and prevent fraud
- Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them
- Debugging to identify and repair errors
- Conducting business analysis, such as analytics, projections, and identifying areas for operational improvement
- Conducting research and development, including undertaking internal research for technological development and demonstration
- Fulfilling our legal functions or obligations
Sale and Sharing of Personal Information
braXos does not sell personal information. Except as noted in the Disclosure of Information section above, braXos does not share personal information.
Personal Information of Consumers Under 16 Years of Age
braXos does not knowingly collect personal information from children under the age of 16. By using the Services, you represent that you are at least 16 years old or that you are the parent or guardian of a minor and you grant consent to such minor’s use of the Services. If we learn that personal information from users less than 16 years old has been collected, we will deactivate any related accounts and will delete such information from our records.
Disclosing Personal Information for Business Purposes
During the 12-month period prior to the Last Updated date of this California Notice, we may have disclosed your personal information with certain categories of third parties as described in the Disclosure of Information section above, including:
- Device and online identifiers
- Location information
- Personal identifiers
- Access control and elevator calling activity
Retention of Your Personal Information
We will keep the personal information we collect about you for as long as necessary to carry out the purposes set forth in this Privacy Notice or any other notice provided at the time of data collection, but no longer than as required or permitted under applicable law or internal braXos policy.
California Privacy Rights
If you are a California resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial.
You can request that we:
- Provide you with access to a copy of and certain details regarding the personal information we have about you
- Delete your personal information
- Correct your inaccurate personal information
- Limit the use or disclosure of your sensitive personal information (SPI)
To exercise any of these privacy rights, send an email to support@braxos.com.
Request to Access My Personal Information
You have the right to request access to the personal information we may have collected about you. Requests to access your personal information may be submitted up to two times in a rolling twelve-month period. In response, we will return to you the following categories of information, to the extent required by law:
- The categories of personal information we have collected about you
- The categories of sources from which we collect your personal information
- The business or commercial purpose for collecting, selling, or sharing your personal information
- The categories of third parties to whom we disclose personal information
- The specific pieces of personal information we have collected about you
- A list of categories of personal information that we have disclosed for a business purpose, along with the categories of third parties we disclosed it to
Delete My Personal Information
You have the right to ask that we delete your personal information. Once we receive a request, we will delete the personal information (to the extent required by law) we hold about you as of the date of your request from our records and direct our service providers to do the same. Choosing to delete your personal information may impact your ability to use our Services. To delete your personal information, click “Delete Account” on the Settings panel of the applicable app, or send an email to support@braxos.com.
Stop Selling or Sharing My Personal Information
braXos does not sell your personal information. When you make a request for access at a building, or perform email address or phone number verification as requested by a building, you share personal information with that building. You have the right to opt-out of that engagement by sending an email to support@braxos.com.
Correct My Personal Information
You have the right to ask that we correct the personal information we may have collected about you if that information is inaccurate. We reserve the right to request identifying documentation from you in certain circumstances, as permitted by law. To correct your personal information, you may do so in the app, or send an email to support@braxos.com.
Limit the Use and Disclosure of SPI
You have the right to ask that we limit our use and disclosure of your SPI to certain purposes permitted by law. braXos does not collect SPI at this time.
Verifying Your Identity
If you request access to, or the correction or deletion of, your personal information we will verify your identity before disclosing the requested information. To do so, we may ask that you log into your account or provide us with your first name, last name, email address, and/or phone number.
Third-party identification services may help us with verification to prevent disclosure of your personal information resulting from fraudulent requests. You may be asked to log into the app. In the event more documentation is necessary to verify your identity, we will notify you directly.
Unable to Verify
If we are unable to verify your identity, we will notify you, and your request(s) may not be processed to prevent fraud.
Submit a Request Using an Authorized Agent
In order to process requests using an authorized agent, braXos will require documentation demonstrating your agent’s authority to submit requests on your behalf (e.g., power of attorney or other documentation, including a letter, signed by you authorizing the agent to submit your requests).
Number of Requests Received in 2025
0
Shine the Light
California residents have the right to request that we provide you with a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year, and the identity of those third parties. To exercise this right, please send an email to support@braxos.com.
Notice of Financial Incentive
If we provide a financial incentive, we will provide you with the details, including how the incentive is related to your data before you participate so that you may make an informed decision about whether and how to participate. In the event you decide to take advantage of a financial incentive, you will always have the right to withdraw from participation and we will provide you with directions on how to do so.
If you have questions or concerns or would like to exercise your CCPA rights, you should contact braXos by emailing us at support@braxos.com.
Connecticut Privacy Rights
Connecticut residents can exercise the following rights by sending an email to support@braxos.com or by going to the Settings section within the applicable braXos app:
- Request to Access My Personal Information (support@braxos.com)
- Delete My Personal Information (Settings or support@braxos.com)
- Correct My Personal Information (Settings or support@braxos.com)
braXos does not process personal information for the purposes of targeted advertising. Nor does braXos sell your personal information.
Virginia Privacy Rights
Virginia residents can exercise the following rights by sending an email to support@braxos.com or by going to the Settings section within the applicable braXos app:
- Request to Access My Personal Information (support@braxos.com)
- Delete My Personal Information (Settings or support@braxos.com)
- Correct My Personal Information (Settings or support@braxos.com)
braXos does not process personal information for the purposes of targeted advertising. Nor does braXos sell your personal information.
Utah Privacy Rights
This Utah Consumer Privacy Act Notice (“Utah Notice”) describes how we handle your personal information, the reasons we do so, and the rights you have as a Utah resident regarding your information. This Notice supplements the braXos Privacy Notice.
This Utah Notice uses certain terms that have the meaning given to them in the Utah Consumer Privacy Act of 2022.
Categories of Personal Information Collected
| Category | Details |
|---|---|
| Identifiers | Personal identifiers, such as name, telephone number (LiftOff and Harmony), and email address |
| Device Information and Online Activity | Device and online identifiers, mobile and web network activity and related information (such as IP address and Device ID) |
| Commercial Information | Not collected |
| Communications | Communication details (such as the content of emails, text messages, or other communications) where braXos is a party to the exchange |
| Demographic Information | Not collected |
| Financial Information | Not collected |
| Biometric Information | Not collected |
| Geolocation | Location information, such as geolocation information by means of Bluetooth beacon reporting or when a credential is presented at a reader |
| Sensory Information | Not collected (activity at sensor-equipped locations may be communicated to an access control system by the property) |
| Background Information | Not collected |
| Inferences | Individual preferences and characteristics |
| Sensitive Personal Information | Not collected |
Purposes for Collecting Personal Information
We may use your personal information for the purposes described in the Use of Information section of this Privacy Notice and as provided below:
- Sharing identity information with building administrators, at your request, to gain access to secured destinations
- Performing services, including maintaining or servicing accounts, providing customer service, verifying customer information, providing analytics services, providing storage, or providing similar services
- Conducting auditing and monitoring of transactions and engagement, including auditing compliance
- Helping to ensure security and integrity and prevent fraud
- Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them
- Debugging to identify and repair errors
- Conducting business analysis, such as analytics, projections, and identifying areas for operational improvement
- Conducting research and development, including undertaking internal research for technological development and demonstration
- Fulfilling our legal functions or obligations
To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.
Sharing of Personal Information
We only share personal information with third parties (building administrators, elevator vendors, and their respective systems) when you collaborate with the building in order to gain access to otherwise secured destinations or when your personal information is stored in their access control system.
| Category of Personal Information | Category of Third-Party Recipient |
|---|---|
| Identifiers | Building administrators, elevator vendors |
| Device Information and Online Activity | Building administrators, elevator vendors |
| Geolocation | Building administrators, elevator vendors |
Share of Personal Information of Consumers Under 16 Years of Age
braXos shares the same categories of information as described above irrespective of the age of the user. braXos does not collect age as a data point.
Exercising Your Utah Privacy Rights
If you are a Utah resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial.
Utah residents can exercise the following rights by sending an email to support@braxos.com or by using the “Delete” function in the applicable app:
- Request to Access My Personal Information
- Delete My Personal Information
You can also email support@braxos.com to contact our Support Team with any questions or comments about this notice or about how we handle your personal information.
Colorado Privacy Rights
This Colorado Consumer Privacy Notice supplements the information in the braXos Privacy Notice and applies solely to Colorado consumers who interact with us in an individual capacity. This Colorado Notice uses certain terms that have the meaning given to them in the Colorado Privacy Act (the “CPA”).
Collection, Use, and Sharing of Personal Data
| Category | Processing Purpose | Targeted Ads? | Sold or Shared |
|---|---|---|---|
| Identifiers | Fulfilling legal obligations Ensuring security and preventing fraud Performing services Auditing and monitoring Quality and safety verification | No | Only first name, last name, email address, and obfuscated phone number (LiftOff and Harmony) are shared with building administrators and elevator vendors for managing authorized access |
| Device and Online Identifiers | Fulfilling legal obligations Ensuring security and preventing fraud Debugging Performing services Auditing and monitoring Quality and safety verification | No | No |
| Internet and Network Activity | Fulfilling legal obligations Ensuring security and preventing fraud Debugging Performing services Auditing and monitoring Quality and safety verification | No | No |
| Commercial Info | Same as above where applicable | No | No |
| Demographic Info | Not collected | No | No |
| Financial Info | Not collected | No | No |
| Biometric Info | Not collected | No | Biometric authorization may be required for certain app functions, but biometric data is not collected by braXos. The app relies on iOS or Android for biometric authorization. |
| Geolocation | Fulfilling legal obligations Ensuring security and preventing fraud Debugging Performing services Auditing and monitoring Quality and safety verification | No | Activity at access control readers and elevators is shared with building administrators and elevator vendors, contingent upon local laws and regulations. |
| Sensory Info | Not collected | No | Activity controlled by a property’s access control system may participate in a synchronization or reporting transaction, managed by the property. |
| Background Info | Not collected | No | No |
| Inferences | Fulfilling legal obligations Ensuring security and preventing fraud Debugging Performing services Auditing and monitoring Quality and safety verification | No | No |
Processing Purposes
- Performing services – including maintaining or servicing accounts, providing customer service, processing elevator calls, synchronizing access control system data, permitting the management of logical access via an access control system, and providing a management portal for administrative and reporting functions
- Conducting auditing and monitoring of transactions and engagement, including auditing compliance
- Helping to ensure security and integrity and prevent fraud
- Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them
- Debugging to identify and repair errors
- Conducting business analysis, such as analytics, projections, and identifying areas for operational improvement
- Conducting research and development, including undertaking internal research for technological development and demonstration
- Fulfilling our legal functions or obligations
braXos does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the CPA.
Your Colorado Privacy Rights
If you are a Colorado consumer who interacts with us in an individual capacity (and not in a commercial or employment context), you may have the right to: (1) request access to, correction of, or deletion of your personal data; and (2) opt-out of the processing of your personal data for purposes of targeted advertising or the sale of your personal data. In addition, you may have the right to obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another entity.
How to Submit a Request
To request access to, correction of, or deletion of your personal data, please email support@braxos.com.
Identity Verification
If you request access to, or the correction or deletion of, your personal information we will verify your identity before disclosing the requested information. To do so, we may ask that you log into your account or provide us with your first name, last name, email address, phone number, and/or address.
Third-party identification services may help us with verification to prevent disclosure of your personal information resulting from fraudulent requests. You may be asked to log into your online account and complete a one-time passcode validation. In the event more documentation is necessary to verify your identity, we will notify you directly.
Policy Change Log
The following summarizes material updates to this Privacy Notice.
| Date | Version | Summary of Changes |
|---|---|---|
| Feb 2026 | 2.0 | Consolidated individual product privacy notices (braXpass, Composer, LiftOff, Symphony) into a single unified Privacy Notice. Added Crescendo and Harmony product coverage. Renamed PropertyHub references to Symphony and Steward Cloud references to Harmony. Updated Composer section to reflect internal-only portal access. Updated request counts to 2025. General formatting and consistency improvements. |
| Mar 2025 | 1.0 | Initial publication of individual product privacy notices for braXpass, Composer, LiftOff, and Symphony. |