# Privacy notice URL: https://briq.cloud/legal/privacy > What personal data briq collects, why, for how long, and your rights over it. Last updated: 7 October 2026. This notice covers briq: the website [briq.cloud](https://briq.cloud), the dashboard [app.briq.cloud](https://app.briq.cloud), and the REST API and MCP server at `api.briq.cloud`. ## Who is responsible Uplab SAS, RCS Lyon 823 752 175, VAT FR50823752175, 254 rue Vendôme, 69003 Lyon, France. Contact: [privacy@briq.cloud](mailto:privacy@briq.cloud). We have no Data Protection Officer; the thresholds of Article 37 are not met. ## What we collect and why | Data | Why | Legal basis | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | -------------------------------------------------------------------- | | Name, email address | Create your account; send service email (security notices, invitations) | Contract, Art. 6(1)(b) | | Password hash, if you use a password | Authenticate you | Contract | | With Google or GitHub sign-in: account id, profile picture URL, the provider's sign-in tokens (encrypted, never used) | Authenticate you | Contract | | Session token, IP address, user agent | Keep you signed in; detect session abuse | Contract; legitimate interests, Art. 6(1)(f) | | Team name, slug, member roles | Decide who may see and change what | Contract | | API keys and connected agents: name, prefix, hash, policy, the client's reported name | Authenticate agents and enforce their limits | Contract | | Audit rows: key, action, target, duration, calling client | Show you what your agents did; bill; investigate abuse | Contract; legitimate interests | | Briq metadata: image, ports, size, TTL, env keys and non-secret values | Run and meter your briqs | Contract | | Messages you send with the help button: the text, the email address you give or your account's, the page address without its query string, browser, screen size, time zone, language, and your team when signed in | Answer you and fix what you report | Legitimate interests | | Page visits and product events ([audience measurement](#audience-measurement)) | Understand what works in briq | Legitimate interests; consent for the analytics cookie, Art. 6(1)(a) | | Billing details: billing address, company name and VAT number if you give them, the card's brand and last four digits (the card itself stays with our payment provider) | Take payments, apply VAT, issue invoices | Contract; legal obligation | | Invoices | Keep the books | Legal obligation, Art. 6(1)(c) | Our legitimate interests are a service that is not abused, bills correctly and improves. Name and email are required to create an account; the rest follows from using the service. We never collect the contents of your images, the values of secret environment variables, or anything in a volume after it is destroyed. We do not profile you or make automated decisions about you. For personal data inside your briqs, you are the controller and we are the processor, under the [data processing agreement](https://briq.cloud/legal/dpa). ## Cookies One cookie needs your consent, the analytics cookie, and we ask with a banner. Everything else we store is strictly necessary or remembers a choice you made. The [cookies page](https://briq.cloud/legal/cookies) lists each item and lets you change your answer. ## Audience measurement * **Visits, without the cookie** (until you answer, or if you refuse): page address without its query string, referring page, `utm_*` tags, browser, OS, device type, screen size, language, and clicks on the website's links and buttons (not the dashboard's). Our analytics provider counts unique visitors with a hash of your IP address, user agent and a random value renewed daily, then drops the IP address: nothing is stored on your device, and you cannot be recognised from one day to the next. Legitimate interests; exempt from consent as audience measurement for our own use. * **Visits, with the cookie**: the same, plus a random identifier that recognises you across days and across briq.cloud and app.briq.cloud, and your approximate location (country, region, city) derived from your IP address. Consent, which you can withdraw on the [cookies page](https://briq.cloud/legal/cookies). * **Product events**: when your team signs up, connects an agent, creates a key, runs, exposes or forks a briq, creates a stack or sends or accepts an invitation, our servers send the event, your team's id and plan, the channel and the agent's reported name. Never your name, email, IP address or request contents. Legitimate interests; object at [privacy@briq.cloud](mailto:privacy@briq.cloud) and we exclude your team. We never link a visit to your account, and we do not record keystrokes, sessions or heatmaps. With Do Not Track, nothing is measured. ## Who receives your data | Recipient | Role | Location | | ----------------------- | ---------------------------------------------------------------------------------- | ------------------------------------ | | Hosting provider | Runs the website, dashboard, API and account database | Amsterdam, Netherlands | | Infrastructure provider | Runs your briqs: compute, volumes, logs | Your team's region, Paris by default | | Email delivery provider | Sends service email and the messages you send us | United States | | Analytics provider | [Audience measurement](#audience-measurement) | Frankfurt, Germany | | Payment provider | Takes payments, keeps your card, computes VAT and issues invoices | Ireland | | Team chat provider | Shows our team the messages you send with the help button (not your email address) | United States | Each is our processor, bound by a data processing agreement; the payment provider is also a controller for its own legal obligations (fraud prevention, financial regulation). Their parent companies are incorporated in the United States, so US authorities could in principle compel access. Where data leaves the EU (service email, or a team region outside the EU), the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We name each provider on request. More in [data protection](https://briq.cloud/legal/data-protection). If you sign in with Google or GitHub, that provider, as its own controller, learns that you signed in to briq and sends us your account id, name, email and picture. Otherwise we disclose personal data only when the law requires it, and tell you unless the law forbids it. We do not sell personal data, use it for advertising, share it for others' marketing, or use it to train AI or machine learning models. ## Google user data When you choose **Sign in with Google**: * **What we access**: only the `openid`, `email` and `profile` scopes, which give us your Google account id, name, email address, whether Google verified it, and your profile picture URL. No other scope: briq cannot read your Gmail, Drive, Calendar, Contacts or any other Google data, and never acts on your Google account. * **How we use it**: only to create your account, sign you in, show your name and picture in the dashboard, and send service email. * **How we store and protect it**: in our account database in the EU, over TLS; the tokens Google issues are encrypted at rest and never used after sign-in; production access is limited to briq's operators. * **Who we share it with**: nobody but the hosting provider that runs the database, on our behalf, or an authority where the law compels us. Never sold, never given to data brokers or advertisers. * **Retention and deletion**: kept while your account exists, deleted within 30 days of its deletion. To delete your account or unlink Google, write to [privacy@briq.cloud](mailto:privacy@briq.cloud). You can revoke briq's access at any time in your [Google Account connections](https://myaccount.google.com/connections); that stops further data but does not delete your briq account. * **Limited Use**: briq's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data for advertising, sell it, use it to assess creditworthiness, or use it to develop, improve or train generalised or non-personalised AI or ML models. ## Security TLS for all traffic. Passwords stored as salted hashes, API keys and agent tokens as SHA-256 hashes, so none can be read back, even by us. Provider sign-in tokens encrypted at rest. Secret environment values write-only and masked. Production access limited to briq's operators, and administrative actions on a briq recorded in its team's audit log. If a breach puts your data at risk, we notify the CNIL within 72 hours and you without undue delay (Arts. 33–34). ## Retention | Data | Kept for | | --------------------------------------- | ------------------------------------------------ | | Account, team and membership records | Life of the account, then deleted within 30 days | | Sessions | Until they expire or you sign out | | Briq metadata and audit rows | 12 months | | Audience measurement and product events | 12 months | | Messages sent with the help button | 12 months after our last reply | | Logs readable through `briq_logs` | Until the briq is destroyed | | Invoices | 10 years (French commercial code, Art. L123-22) | Deletion at the end of these periods is manual for now; automatic jobs are on the way. ## Your rights You may ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests (Arts. 15–22), and withdraw consent at any time. Write to [privacy@briq.cloud](mailto:privacy@briq.cloud); we answer within one month, free of charge. We cannot recover an API key (we only store its hash) or delete invoices before 10 years. You can complain to the [CNIL](https://www.cnil.fr/fr/plaintes), the French supervisory authority. ## Changes We email account holders before any change that affects them. The date above is the version.