Privacy notice

Last updated: 7 October 2026.

This notice covers briq: the website briq.cloud, the dashboard app.briq.cloud, and the REST API and MCP server at api.briq.cloud.

Who is responsible

Uplab SAS, RCS Lyon 823 752 175, VAT FR50823752175, 254 rue Vendôme, 69003 Lyon, France. Contact: privacy@briq.cloud. We have no Data Protection Officer; the thresholds of Article 37 are not met.

What we collect and why

Data	Why	Legal basis
Name, email address	Create your account; send service email (security notices, invitations)	Contract, Art. 6(1)(b)
Password hash, if you use a password	Authenticate you	Contract
With Google or GitHub sign-in: account id, profile picture URL, the provider's sign-in tokens (encrypted, never used)	Authenticate you	Contract
Session token, IP address, user agent	Keep you signed in; detect session abuse	Contract; legitimate interests, Art. 6(1)(f)
Team name, slug, member roles	Decide who may see and change what	Contract
API keys and connected agents: name, prefix, hash, policy, the client's reported name	Authenticate agents and enforce their limits	Contract
Audit rows: key, action, target, duration, calling client	Show you what your agents did; bill; investigate abuse	Contract; legitimate interests
Briq metadata: image, ports, size, TTL, env keys and non-secret values	Run and meter your briqs	Contract
Messages you send with the help button: the text, the email address you give or your account's, the page address without its query string, browser, screen size, time zone, language, and your team when signed in	Answer you and fix what you report	Legitimate interests
Page visits and product events (audience measurement)	Understand what works in briq	Legitimate interests; consent for the analytics cookie, Art. 6(1)(a)
Billing details: billing address, company name and VAT number if you give them, the card's brand and last four digits (the card itself stays with our payment provider)	Take payments, apply VAT, issue invoices	Contract; legal obligation
Invoices	Keep the books	Legal obligation, Art. 6(1)(c)

Our legitimate interests are a service that is not abused, bills correctly and improves. Name and email are required to create an account; the rest follows from using the service.

We never collect the contents of your images, the values of secret environment variables, or anything in a volume after it is destroyed. We do not profile you or make automated decisions about you. For personal data inside your briqs, you are the controller and we are the processor, under the data processing agreement.

Cookies

One cookie needs your consent, the analytics cookie, and we ask with a banner. Everything else we store is strictly necessary or remembers a choice you made. The cookies page lists each item and lets you change your answer.

Audience measurement

Visits, without the cookie (until you answer, or if you refuse): page address without its query string, referring page, utm_* tags, browser, OS, device type, screen size, language, and clicks on the website's links and buttons (not the dashboard's). Our analytics provider counts unique visitors with a hash of your IP address, user agent and a random value renewed daily, then drops the IP address: nothing is stored on your device, and you cannot be recognised from one day to the next. Legitimate interests; exempt from consent as audience measurement for our own use.
Visits, with the cookie: the same, plus a random identifier that recognises you across days and across briq.cloud and app.briq.cloud, and your approximate location (country, region, city) derived from your IP address. Consent, which you can withdraw on the cookies page.
Product events: when your team signs up, connects an agent, creates a key, runs, exposes or forks a briq, creates a stack or sends or accepts an invitation, our servers send the event, your team's id and plan, the channel and the agent's reported name. Never your name, email, IP address or request contents. Legitimate interests; object at privacy@briq.cloud and we exclude your team.

We never link a visit to your account, and we do not record keystrokes, sessions or heatmaps. With Do Not Track, nothing is measured.

Who receives your data

Recipient	Role	Location
Hosting provider	Runs the website, dashboard, API and account database	Amsterdam, Netherlands
Infrastructure provider	Runs your briqs: compute, volumes, logs	Your team's region, Paris by default
Email delivery provider	Sends service email and the messages you send us	United States
Analytics provider	Audience measurement	Frankfurt, Germany
Payment provider	Takes payments, keeps your card, computes VAT and issues invoices	Ireland
Team chat provider	Shows our team the messages you send with the help button (not your email address)	United States

Each is our processor, bound by a data processing agreement; the payment provider is also a controller for its own legal obligations (fraud prevention, financial regulation). Their parent companies are incorporated in the United States, so US authorities could in principle compel access. Where data leaves the EU (service email, or a team region outside the EU), the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We name each provider on request. More in data protection.

If you sign in with Google or GitHub, that provider, as its own controller, learns that you signed in to briq and sends us your account id, name, email and picture. Otherwise we disclose personal data only when the law requires it, and tell you unless the law forbids it.

We do not sell personal data, use it for advertising, share it for others' marketing, or use it to train AI or machine learning models.

Google user data

When you choose Sign in with Google:

What we access: only the openid, email and profile scopes, which give us your Google account id, name, email address, whether Google verified it, and your profile picture URL. No other scope: briq cannot read your Gmail, Drive, Calendar, Contacts or any other Google data, and never acts on your Google account.
How we use it: only to create your account, sign you in, show your name and picture in the dashboard, and send service email.
How we store and protect it: in our account database in the EU, over TLS; the tokens Google issues are encrypted at rest and never used after sign-in; production access is limited to briq's operators.
Who we share it with: nobody but the hosting provider that runs the database, on our behalf, or an authority where the law compels us. Never sold, never given to data brokers or advertisers.
Retention and deletion: kept while your account exists, deleted within 30 days of its deletion. To delete your account or unlink Google, write to privacy@briq.cloud. You can revoke briq's access at any time in your Google Account connections; that stops further data but does not delete your briq account.
Limited Use: briq's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, use it to assess creditworthiness, or use it to develop, improve or train generalised or non-personalised AI or ML models.

Security

TLS for all traffic. Passwords stored as salted hashes, API keys and agent tokens as SHA-256 hashes, so none can be read back, even by us. Provider sign-in tokens encrypted at rest. Secret environment values write-only and masked. Production access limited to briq's operators, and administrative actions on a briq recorded in its team's audit log. If a breach puts your data at risk, we notify the CNIL within 72 hours and you without undue delay (Arts. 33–34).

Retention

Data	Kept for
Account, team and membership records	Life of the account, then deleted within 30 days
Sessions	Until they expire or you sign out
Briq metadata and audit rows	12 months
Audience measurement and product events	12 months
Messages sent with the help button	12 months after our last reply
Logs readable through `briq_logs`	Until the briq is destroyed
Invoices	10 years (French commercial code, Art. L123-22)

Deletion at the end of these periods is manual for now; automatic jobs are on the way.

Your rights

You may ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests (Arts. 15–22), and withdraw consent at any time. Write to privacy@briq.cloud; we answer within one month, free of charge. We cannot recover an API key (we only store its hash) or delete invoices before 10 years.

You can complain to the CNIL, the French supervisory authority.

Changes

We email account holders before any change that affects them. The date above is the version.