Braidplane account and website privacy notice¶
Version: self-service-pre-alpha-v1
Effective date: 14 September 2026
1. Controller and contact¶
The controller is BRAIDPLANE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Leona Heyki 3C/34, 70-631 Szczecin, Poland; KRS 0001253408; NIP 9552596739; REGON 54522148900000 ("Braidplane", "we", "us").
Email privacy@braidplane.com for privacy questions or requests, or write to the address above. We have not appointed a data protection officer. General support is available at contact@braidplane.com and formal legal correspondence at legal@braidplane.com. Contact is by email or post; we do not operate a business telephone support line.
2. Scope and information we use¶
This notice covers website visitors, people who contact us, and personal and business users of Braidplane accounts, workspaces and the staging trial. The trial does not require a business affiliation or payment-card details.
| Information | Why we use it | GDPR legal basis |
|---|---|---|
| Website requests, IP address, request time, route, status and diagnostic identifiers | Deliver the site, detect abuse and diagnose failures | Legitimate interests in a secure and functioning service, Article 6(1)(f) |
| Account name, email, password hash or Google identity, verification and authentication state | Create and operate the account, authenticate you and recover access | Performance of the account agreement, Article 6(1)(b); legitimate interests in account security, Article 6(1)(f) |
| Accepted terms version, acceptance timestamp and agreement-confirmation delivery | Record the agreement and demonstrate which terms apply | Performance of the agreement, Article 6(1)(b); legitimate interests in establishing and defending legal claims, Article 6(1)(f) |
| Workspace membership, invitations, roles, projects, configuration and service activity | Provide the requested workspace and enforce permissions | Performance of the agreement, Article 6(1)(b); legitimate interests in administering a workspace where the contracting party is an organization, Article 6(1)(f) |
| Authentication, access, security/audit and email-delivery records | Prevent misuse, investigate incidents and deliver account messages | Legitimate interests in security and reliable delivery, Article 6(1)(f); compliance with applicable legal obligations, Article 6(1)(c) |
| Support, feedback, complaint and privacy-request correspondence | Answer you, resolve problems and fulfill requests | Requested pre-contractual steps or performance of the agreement, Article 6(1)(b); legitimate interests in support and improvement, Article 6(1)(f); applicable legal obligations, Article 6(1)(c) |
| Business-contact and commercial correspondence you choose to supply | Discuss a separately agreed commercial relationship | Requested pre-contractual steps, Article 6(1)(b); legitimate interests in business correspondence, Article 6(1)(f) |
We receive information from you, your workspace's administrators or inviters, and your use of the service. With Google sign-in, Google supplies your account identifier, name, email, verification status and, where supplied, profile image. We do not receive your Google password. The Google authorization page explains the permissions requested. Other connector authorization is separate from account sign-in.
You need a name, accessible email and an authentication method to operate an account. Email/password signup requires a password; Google uses its identity service instead. We cannot provide an account without the necessary account information. Support and feedback content is optional. Do not send sensitive personal data or unnecessary personal information in queries, feedback or support messages.
We do not sell account information, use it for behavioral advertising or subscribe you to marketing through account acceptance. We do not make solely automated decisions with legal or similarly significant effects about you. Technical security controls can reject authentication attempts or requests; contact us if you believe a control incorrectly prevents access. Processing that requires separate consent will be presented separately, and that consent can be withdrawn without affecting earlier lawful processing.
3. Workflow content and workspace visibility¶
Use synthetic workflow data and non-production resources during this trial. Credentials entered through designated connector fields are used to access the systems you select. Your configuration determines the destinations that receive workflow outputs. Their operators apply their own notices and terms.
Workspace administrators and authorized collaborators can access workspace information according to their roles. Do not assume your configuration, queries, run history or workspace identity is private from those people. Personal-data processing for an organization's own purposes requires a separately approved arrangement where Braidplane acts as its processor; this trial does not authorize uploading customer personal data.
4. Recipients and international processing¶
We use the following services to operate the account and website journey:
| Provider | Purpose and information involved |
|---|---|
| Hetzner Cloud | Hosts the staging application, workers and database in Helsinki, Finland; processes account information, configured service content and operational records |
| Scaleway Object Storage | Stores encrypted database backups in the Warsaw region, Poland; backups can contain account information and service content |
| Scaleway Transactional Email | Sends verification, recovery, authentication, invitation and other service messages through its Paris region, France; processes addresses, message content and delivery metadata |
| Proton Mail | Hosts human correspondence sent to our email contacts; processes addresses, message content and attachments under Proton's Swiss and European infrastructure arrangements |
| Gcore | Delivers and protects the public application through its CDN and network; processes network/request information and the traffic passing through its edge infrastructure |
| Google, when you choose Google sign-in | Authenticates your chosen Google account and supplies identity information; Google also processes sign-in activity under its own privacy notice |
Authorized Braidplane personnel can access information needed for operations and support. We may disclose necessary information to professional advisers under confidentiality, to authorities when legally required, or to protect rights and investigate misuse. We do not give all recipients unrestricted access to every category of data.
The European hosting locations above do not mean all processing stays in the EEA. Proton is based in Switzerland; Google and Gcore operate international infrastructure and may involve access or processing outside the EEA. For transfers requiring GDPR safeguards, we use an applicable adequacy decision or appropriate contractual safeguards, including the European Commission's standard contractual clauses where needed. You can request information about the applicable safeguards and a copy from privacy@braidplane.com; confidential or security-sensitive details may be redacted.
Provider information is available in the Hetzner data-protection information, Scaleway contracts and data-processing terms, Proton privacy policy, Gcore legal documents, and Google privacy policy.
5. Retention and deletion¶
We retain information for its purpose rather than treating the trial expiry as a universal deletion date:
- Account, workspace and configuration records: while the account or workspace remains open and the information is needed to provide it. On closure, we assess and remove information no longer needed, subject to the limited security, claim and legal-obligation purposes below.
- Agreement and request-handling evidence: for the period necessary to establish the agreement, demonstrate how a request was handled, or bring or defend applicable claims. The applicable limitation period, the nature of the record and any actual dispute determine the period. A legal hold is limited to relevant records and reviewed when the matter ends.
- Support and correspondence: while resolving the matter and for necessary follow-up; afterwards only information required for a continuing obligation, security matter or applicable claim is retained.
- Security and diagnostic records: for investigation, prevention and resolution of security or operational incidents, with relevant evidence preserved longer only for an active investigation, obligation or claim.
- Run, query and replay history: according to the workspace retention settings. Administrators can set supported history windows from 1 to 30 days. Scheduled maintenance applies expiry asynchronously. Current source checkpoints and effect records needed to preserve execution correctness are distinct from expiring diagnostic history.
- Backups: deleted data can remain in restricted backup copies until those copies expire or are replaced through the backup rotation. Backups are used for recovery, not ordinary account use. If a backup is restored, applicable deletion decisions must be reapplied before normal processing resumes.
Trial expiry stops changes and new executions; it does not close the account or automatically erase it or every backup at day 60. Account-wide self-service export and deletion are not available. Email us for closure, retrieval or privacy requests; we explain the applicable scope and retention when handling your request. Retention does not override a valid erasure right.
6. Your rights¶
Where applicable, you may request access and a copy, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent to processing that relies on consent. These rights have legal conditions and exceptions; we explain any refusal and the available complaint route.
Send requests to privacy@braidplane.com. We respond without undue delay and normally within one month. If the law permits an extension because of the complexity or number of requests, we explain the reason within the first month. We may request proportionate identity information and protect other people's rights. You do not need a paid plan or a self-service deletion feature to make a request.
You may complain to the President of Poland's Personal Data Protection Office (UODO), uodo.gov.pl, or the competent authority where you live, work or believe an infringement occurred. Additional rights under other applicable privacy laws can be raised through the same contact.
7. Cookies and browser storage¶
The authenticated application uses first-party storage for its requested features. Browser controls let you clear it; disabling necessary storage can prevent sign-in or reset preferences and unsaved work.
| Storage | Purpose | Duration |
|---|---|---|
| Session cookie | Maintain authentication and security state | 24-hour session lifetime; a new sign-in creates a new session |
braidplane_dashboard_project_scope and braidplane_dashboard_environment_scope cookies |
Remember the selected dashboard scope | Up to 30 days, replaced when you change scope |
braidplane.sidebar.collapsed in local storage |
Remember sidebar display preference | Until replaced or you clear browser storage |
braidplane.builder.canvas.state.v5.* in local storage |
Preserve pipeline canvas working state | Until replaced, removed by the application or you clear browser storage |
| Query/detail and preserved-scroll entries in session storage | Restore the position when navigating | Cleared after restoration or when the browser session ends |
The website/contact notice at braidplane.com/privacy covers the passive landing page. It does not describe authenticated app storage. Braidplane does not use this account storage for advertising or cross-site behavioral tracking. Google sign-in and connector authorization may take you to providers' pages, where their own storage disclosures apply.
8. Changes¶
We publish a new version and effective date when this notice changes and give appropriate notice of material changes, including by email where needed. A changed notice does not itself create a new legal basis or obtain consent. The version accepted with an account remains available as an archived document.