Privacy and Cookies Policy

The publisher identified in the legal notices is responsible for the processing necessary for the management of Brunel: accounts, commercial relationship, billing, security, and operation. For any question relating to personal data, contact contact@brunel.cloud.

When a company uses Brunel to analyze content containing personal data for which it determines the purposes, it remains responsible for these processing operations. Brunel then acts as a processor within the agreed scope. The corporate data processing framework specifies the clauses to be incorporated into the contract.

This policy covers the application, its APIs, its support interfaces, and its commercial requests. The third-party services you use directly retain their own responsibilities and policies.

• Identity and access: GitHub identifiers, profile provided by GitHub, sessions, devices, and connection activity. This information is used to authenticate users and manage their access. The legal basis is the execution of the contract with the user or the legitimate interest in providing and securing the service for users of a client organization.
• Integrations: GitHub authorizations, encrypted tokens, single sign-on settings, notification secrets, and parameters of the AI provider chosen by the client. They allow the execution of the requested functions, within the framework of the contract and the instructions of the organization.
• Analyses and conversations : repository references, technical characteristics, useful extracts, messages, findings, architectures, and generated files. They are used to produce and retain the requested results. Personal data contained in a company's content is processed on its behalf.
• Teams and APIs: members, roles, invitations, team logs, API key rights, key fingerprints, notification usage, and deliveries. The purposes are administration, traceability, usage billing, and security, on a contractual or legitimate interest basis depending on the processing.
• Billing : Stripe references, offer, subscription status, due dates, counters, and proof of consent. Order management is covered by the contract; accounting documents are subject to legal obligations. Complete card data is processed by Stripe.
• Commercial requests and programs : professional contact details, organization, needs, and messages communicated. This data is used to respond to the request and prepare a possible contractual relationship; relevant professional follow-up may be a legitimate interest, with the possibility of opposition.
• Discord Support : link between accounts, technical server and ticket identifiers, status, and dates. The purposes are assistance, verification of the link, and prevention of abuse. The details are in the Discord retention policy.
• Operation and security : technical events, errors, and network information that may include an IP address. This data is used to prevent abuse, diagnose incidents, and protect the service, based on legitimate interest. Logging rules differ from network controls performed without retention by the application.

The data requested for authentication, ordering, or executing a function is necessary for that function. Without it, the relevant access or service may not be available. You should only transmit the information useful for your request.

Selected repositories are downloaded into a temporary space for static analysis. Brunel does not execute the repository code for this analysis. The temporary folder is deleted at the end of processing; necessary results and extracts may remain associated with the conversation.

Filters aim to remove secrets and environment values from retained and transmitted extracts. These filters do not exempt the client from removing unnecessary secrets and personal data before submission. A repository may contain sensitive information that automatic detection alone cannot identify.

Depending on the offer and configuration, technical characteristics, necessary extracts, and messages may be transmitted to an AI provider to produce a recommendation. The chosen provider and its location must be examined before submitting data subject to special constraints. A deterministic processing can function without calling an external model.

Brunel does not use client repositories to train its own model. This statement does not constitute a guarantee of zero retention by all providers: the provider's conditions and applicable contractual commitments must be verified. Recommendations require human review; the service is not designed to make automated decisions producing legal effects on a person.

An audit may address resource configuration, IAM policies, role and user names, labels, and security findings. Access must be temporary, limited to read, and bounded to the accounts, regions, and permissions defined in the contract. Reading the business content of databases, stored objects, and secrets is excluded from the standard audit scope.

An AI analysis of findings requires the processing policy agreed with the client. With Amazon Bedrock, the region of the access point is not sufficient to determine all processing locations: an inference profile can route to other regions. A residency requirement must therefore apply to the model and its actual routing.

To transmit audit data to OpenAI, a Zero Data Retention approval applicable to the organization, project, model, and access point used must be established. An API key, local setting, or credit program does not constitute approval. Modified Abuse Monitoring alone does not constitute zero retention. Brunel does not assume any ZDR or MAM approval by default.

Access is limited to persons and service providers who need it for their functions. Data is not sold to advertisers. Recipients may include the client organization, its administrators, the integrations it activates, and the service providers detailed on the page Providers and data localization.

Primary hosting on AWS in the Paris region does not imply that all processing takes place in France. GitHub, Stripe, Discord, certain AI providers, and their group services may involve processing outside the European Economic Area.

When a transfer requires it, the applicable mechanism must be documented: adequacy decision in force or appropriate safeguards, including standard contractual clauses, supplemented if necessary by additional measures. A mention of these mechanisms does not prove their applicability to each service provider. Companies may request relevant information before contracting.

For vulnerability scanning of dependencies, component names and versions may be transmitted to OSV, operated by Google. Source code and secrets are not required for these requests; however, private dependencies or their names may constitute confidential information to be reviewed before use.

• Conversations from an account : until their deletion or that of the account, subject to data to be retained for a legal obligation or litigation.
• Guest conversations : thirty days after the last activity, with scheduled cleanup.
• Sessions : thirty days at most, with the possibility of early revocation.
• Account security activity : ninety days. Notification delivery logs: thirty days.
• API usage measurement : thirty days for detailed events and thirteen months for billing and usage aggregates.
• Invoices and accounting documents : ten years when the law imposes this duration. Account closure does not erase supporting documents subject to legal retention.
• Commercial requests : during the processing of the request and, when follow-up is justified, up to three years after the last contact, unless objection, contractual relationship, or different retention obligation.
• Audits : contractual templates provide for ninety days for inventory and evidence after delivery of the report, and three hundred sixty-five days for the report and audit trail. The durations and modalities of deletion must be confirmed in the accepted contract; this presentation does not constitute an attestation of executed purge.
• Discord : thirty days after ticket closure, with a maximum of one hundred eighty days since its creation. Account links persist until dissociation or deletion.
• Operation logs : according to the retention policies configured for each flow and security requirements. A targeted freeze may be necessary to examine an incident or defend a right.

Scheduled cleanup is not instant deletion: its next execution and any incident may affect the delay. Data deleted from the active database may persist in its encrypted backups, whose current retention is seven days.

Archives and the old Vercel environment kept for migration rollback follow a separate cycle. Deletion in AWS does not retroactively erase them. They must remain restricted access and their removal must be organized upon completion of migration validation. Restoration requires reapplying already received deletion requests.

Measures include encryption of connections, encryption of integration secrets, access restriction, authorization controls, and logging mechanisms. GitHub tokens and integration secrets are protected server-side; Brunel API keys are verified from their fingerprint.

Deleting an account, revoking a key, and withdrawing third-party authorization are distinct operations. Data retained by a third-party provider may require a request or revocation from that provider. Any additional security requirement must be examined and agreed upon in the contract.

Depending on the processing and legal conditions, you can request access, rectification, deletion, portability, limitation, and objection. If processing is based on consent, it can be withdrawn for the future. Certain data may remain necessary for a legal obligation or the defense of a right.

Account functions include exporting conversations, deleting data, and revoking sessions. For a complementary request, contact contact@brunel.cloud1. A proportionate verification of your identity may be necessary; no identity document should be sent spontaneously in a support chat.

A response is provided within the timeframe stipulated by the GDPR, in principle one month. This timeframe may be extended by two months due to the complexity or number of requests, with notification within the first month. For the contents of a client organization, the request may be forwarded to the relevant data controller.

You can lodge a complaint with the CNIL or the competent supervisory authority in your country.

Brunel uses cookies necessary for authentication, security, and guest access retention. The application does not add any advertising cookie or audience measurement tool. Third-party services you access directly apply their own rules.

• Login session: cookie __Host-authjs.session-token, thirty days at most.
• Connection security: CSRF verification, redirection, and OAuth exchange cookies, for the session or a short duration adapted to their function.
• Guest access: cookie __Host-brunel_guest, up to one year. This duration does not extend the retention period of guest conversations.
• Single sign-on: proof and transaction cookies; twelve hours by default for proof, according to the team's policy, and ten minutes for the transaction.
• Local preferences: theme, currency, and display settings, stored in the browser until reset.

Strictly necessary cookies are used without prior consent under the conditions provided by the regulations. You can delete or block them in your browser, with a possible effect on the operation of the service. The future addition of a non-necessary tracker requires information and, when required by law, prior consent.

A sharing link allows those who hold it to read the concerned conversation. Links can be revoked; only public repositories are eligible for sharing. The client must verify the information contained in the messages and results before making them accessible.

The Discord link is optional. Brunel retains account links and ticket metadata, without archiving messages or attachments. A problem description may be temporarily processed by Bedrock to prepare a response. Messages remaining in Discord are also subject to Discord's policy.

The version of the document appears at the top of the page. A substantial evolution of the purposes, recipients, or processing conditions is subject to appropriate information; it does not allow retroactive processing of data for an incompatible purpose.

Contact for data protection: contact@brunel.cloud. Companies can request the additional elements necessary for their supplier review before transmitting their data.