Privacy Notice

1. Controller

Brida OÜ, an Estonian company with registry code 17445507 and its registered address at Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia, is the controller of the personal data this notice describes. For any privacy matter, write to hi@brida.ai.

2. Scope

This notice covers the brida.ai website, the emails you send us to ask for early access or support, Brida accounts (people, Organizations, memberships and invitations), passkeys and sessions, the acceptance of the data processing agreement, delegations to agencies and the Brida Reflex Free Preview.

It does not cover the data an Organization processes in Brida about its contacts. For that data, the Organization is the controller and Brida is a processor (section 6).

3. Data we process

• Account: your email, your display name, your language and when you verified your email.
• Passkeys: for each passkey, its credential identifier and public key, its counter, how it connects, the authenticator model (AAGUID), the device type and whether it is backed up. We store nothing biometric: your fingerprint or face never leaves your device. We also record each time a passkey is added, used or removed, with its outcome and time.
• Password and second factor, if you use them: the password only as an Argon2id hash, never in plaintext; the authenticator code (TOTP) secret, encrypted; and the recovery codes, as hashes.
• Sessions: a hash of the session token, its authentication level, the selected Organization, the last activity, its expiry and, if it is revoked, when and why.
• Security: each password sign-in attempt, with the email used, your IP address and the outcome. At registration we store HMAC digests of your email, your IP address and its network, never the plain values. We do not store your browser's user agent.
• Organizations and invitations: each Organization's name, who belongs to it and with which role, and each invitation: the invited email, the role, its status, its expiry and who invites. Brida does not send the invitation email: it hands the link once to the person who invites, who passes it on.
• Acceptance of the data processing agreement: the version, the language, the cryptographic digest of the text and of its annexes, the entity (legal name, country and identifier), the signatory (name and role), the person who accepts, the session, its authentication level, the verification of their passkey and the time, without IP address or user agent.
• OAuth authorizations of MCP clients: when you authorise an AI client to use Brida, we keep the client (its identifier, its name and its redirect addresses) and each authorization: the resource, the scopes requested, who grants it and for which Organization, its status and its timestamps, with the one-use code only as a hash.
• Agencies: which agency holds a delegation over an Organization, with which permissions, and the events of each delegation.
• Notices to owners: to email an Organization's owners, we keep their email, their language and the Organization's name until shortly after the notice resolves.
• Contact: what you write to hi@brida.ai and your email address.
• Brida Reflex Free Preview: the bounded state you submit for semantic evaluation and the metadata needed to execute and reconcile each run; for each API key, its identifier, prefix, scopes, status and timestamps (the plaintext key is shown only when it is created); and the delivery state of the verification email.
• Operational metadata: request identifiers, timestamps, versions, counts, latencies and error categories. Logs, metrics and audit records do not store the content of messages, emails, tokens or secrets.

4. Why we process it and on what legal basis

• To provide the service you ask for and to run your account and your Organization: performance of a contract or of the pre-contractual steps you request (GDPR art. 6.1.b).
• For security, abuse prevention and audit, and to be able to show who accepted the data processing agreement and when: our legitimate interest in a secure service and in proving compliance (art. 6.1.f).
• To meet legal obligations, such as billing (art. 6.1.c), and to establish, exercise or defend legal claims (art. 6.1.f).
• To answer your emails and manage early access: our legitimate interest in answering you or, if you are already a customer, the contract.

5. AI processing

The Brida Reflex Free Preview sends the eligible non-sensitive state through Vercel AI Gateway to TypeSafe AI's Jev evaluation model. Each provider request asks for Zero Data Retention and no-prompt-training controls. If the evaluator is unavailable, Reflex fails closed rather than silently sending the request to another model or provider.

In an Organization's funnels, Brida drafts with Anthropic's Claude models without sending them any contact data, and classifies incoming replies with Jev through Vercel AI Gateway, with emails and phone numbers replaced and Zero Data Retention requested on each request. Replies with signs of clinical or sensitive content, or with attachments, skip the model and wait for human review. No message goes out without the approval of an authorised person.

6. Brida as processor of an Organization's data

When an Organization imports contacts, connects channels, sends messages or receives replies in Brida, the Organization is the controller of that data and Brida is a processor: it processes it only to provide the service and on the Organization's instructions, under the data processing agreement of GDPR art. 28, which the Organization accepts before any of that data is stored.

If you are one of its contacts or have replied to it, the privacy notice that applies to you is that Organization's, and the Organization handles your rights. If you write to Brida, we pass your request on to it. You can unsubscribe from the link in each message or by replying to it: we then stop writing to you on every channel of that Organization.

Brida is not built to process health data, patient data or other special categories of data, and the data processing agreement excludes them.

Under that agreement, Brida deletes approved outbound content after 180 days, raw inbound email after 30 days, decision records and the MCP call audit after 13 months, and resolved attention items after 90 days. When the relationship closes, the Organization has 30 days to export its data. Brida then deletes it, and it leaves the backups within 30 days at most.

7. Service providers and recipients

• Hetzner Online GmbH: hosts the servers, the database and its backups, in Finland.
• Cloudflare, Inc.: proxy, TLS and protection of the traffic to Brida's application and API (app.brida.ai and api.brida.ai); sending of Brida's verification emails and notices; and receipt of email on dedicated inbound addresses.
• Infisical Inc., in its European Union region: stores the credentials of the channels an Organization connects.
• Vercel Inc.: hosts and serves the brida.ai website, with the IP address and technical data of each visit; and, with its AI Gateway and TypeSafe AI, Reflex evaluation and the classification of incoming replies.
• Anthropic Ireland, Limited: drafting with Claude models, without contact data.
• Agencies with a delegation from an Organization see that Organization's data with the permissions it grants them, and lose access when it revokes the delegation.
• We may also disclose data when required by law, to protect rights or security, or in a lawful corporate transaction.

8. Transfers outside the European Economic Area

Some of these providers process data outside the European Economic Area. Cloudflare does so in its global network of data centers. Infisical and Vercel do so from the United States. Anthropic stores data in the United States and may process it in any country where it runs its models.

For those transfers, Brida relies on the EU-US Data Privacy Framework for Cloudflare, and on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) that each provider's data processing agreement includes. This is not an EU-only or EU-residency promise.

9. Retention

• Unaccepted invitations: deleted 90 days after they expire or are cancelled, with the registrations that cite them.
• Acceptance of the data processing agreement, delegations and their events, and the events of an Organization's admission: kept during the relationship and for 5 years after closure.
• Data of a notice to owners: deleted 7 days after the notice resolves.
• Account, passkeys and sessions: kept while the account exists. A session stops working after at most 8 hours without activity, and after 30 days at most even if it is used.
• Sign-in attempts (the email used, the IP address and the outcome), including those for an email with no account: they have no deletion period today; the database keeps them as an immutable security record.
• Brida Reflex: an unfinished registration expires and stops working. Central Reflex receipts hold metadata and, by default, not the submitted state.
• Your emails: as long as needed to answer you and manage the relationship.
• Billing: for the period the law sets.

10. Cookies and local storage

Brida uses only first-party cookies:

• brida_session: your session. It is not readable from JavaScript, travels only over HTTPS (HttpOnly, Secure and SameSite=Lax) and expires after at most 8 hours without activity.
• brida_registration: completes a registration. It is sent only to the registration routes and lasts until that step expires.
• __Host-brida_gmail_connect: protects the connection of a Gmail mailbox while it completes.
• brida_locale: keeps the language you choose in the application pages (app.brida.ai). It is created only if you change the language, it can be read from JavaScript and it lasts one year.

Your browser's local storage keeps your preferred language and, during Reflex sign-up, the page to return to. During Reflex sign-up, that tab's session storage also keeps your email and a random key, which is sent with the sign-up request so it is not duplicated; it is cleared when you close the tab. The language and the page to return to never leave your browser. The public pages use no third-party analytics or advertising scripts. If that changes, we will update this notice and ask for your consent first where required.

11. Security

Among other measures: passkeys with user verification and a second factor for sensitive decisions; no machine credential can approve a send or accept the data processing agreement; API keys stored as a prefix and an HMAC verifier; every read limited to its Organization; TLS for all traffic; no database port exposed outside the server; and logs with metadata only. No measure removes all risk.

12. Your rights

Where the GDPR applies, you may ask to access, correct or erase your data or to restrict its processing, object to certain processing, receive your data in a portable format where applicable, and withdraw consent where processing is based on it. Write to hi@brida.ai. We may ask you to verify your identity before acting on a request.

You may also complain to the data protection authority where you live or work or where the infringement took place, among them the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). If you are an Organization's contact, see section 6.

13. Automated decisions and children

Brida Reflex produces semantic evidence and recommendations. The hosted service does not itself make a decision that produces legal or similarly significant effects about you. In funnels, the Organization decides whom it writes to, and no send goes out without human approval.

Brida is not directed to children. You must be at least 18 years old to create an account, unless Brida has explicitly agreed another lawful arrangement.

14. Changes and language

We will update this notice when Brida or its providers change. The version shown above identifies the current one, and we will describe material changes before or when they take effect, as the law requires. This notice exists in Spanish and English: if the two versions differ, the Spanish version prevails.