Privacy Policy

Effective Date: November 2025
Last Updated: November 2025

Beresol BV ("we," "us," or "our") operates Brubru (https://brubru.beresol.eu), an AI-powered strategic advocacy assistant for EU policy professionals. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

Beresol BV
Brussels, Belgium
European Union
Email: hello@beresol.eu

2. Information We Collect

2.1 Information You Provide Directly

Account Information: Email address, full name, organization, country
Authentication: Password (encrypted), OAuth tokens from Google or LinkedIn
Profile Settings: Policy interests, language preference, timezone, background preferences
Payment Information: Billing details processed securely through Stripe (we do not store credit card numbers)
User Content: Chat messages, amendments, uploaded documents (PDF, DOCX), saved RSS entries, feedback submissions

2.2 Information Collected Automatically

Usage Data: Pages visited, features used, time spent, amendment creation/editing activity
Technical Data: IP address, browser type, device information, operating system
Authentication Logs: Login timestamps, session duration
API Usage: Number of AI requests, tokens consumed, rate limiting data

2.3 Information from Third Parties

OAuth Providers: Profile information from Google or LinkedIn when you use social login
Payment Processor: Subscription status and payment events from Stripe

3. How We Use Your Information

We process your personal data for the following purposes:

3.1 Service Provision (Legal Basis: Contract Performance)

Provide access to Brubru's features (chat, amendator, compliance checking, RSS feeds)
Process AI requests and generate responses
Store and retrieve your amendments, documents, and chat history
Manage subscriptions and billing
Provide customer support

3.2 Service Improvement (Legal Basis: Legitimate Interest)

Analyze usage patterns to improve features and user experience
Develop new features based on user needs
Conduct research and analytics
Train and improve AI models (anonymized data only)

3.3 Communication (Legal Basis: Consent / Legitimate Interest)

Send service-related notifications (downtime, updates, policy changes)
Respond to your inquiries and support requests
Send marketing communications (with your consent, opt-out available)

3.4 Legal Compliance (Legal Basis: Legal Obligation)

Comply with applicable laws and regulations
Respond to legal requests and prevent fraud
Enforce our Terms of Service

4. How We Share Your Information

We do not sell your personal data. We may share your information with:

4.1 Service Providers (Data Processors)

We use third-party service providers to help us operate our business. These providers process data only on our behalf and are contractually obligated to protect your data.

Supabase: Database hosting, authentication, file storage (EU/US servers)
Anthropic: AI model processing for chat responses (US)
OpenAI: Backup AI model processing (US)
Hugging Face: Specialized legal AI models and embeddings (EU/US)
Stripe: Payment processing (EU/US)
Railway: Backend infrastructure hosting (EU/US)
SiteGround: Frontend hosting and CDN (EU)
Google Cloud: Optional translation services (EU/US)

For a complete list of subprocessors, see our Subprocessors page.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights or the safety of users.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email if this occurs.

5. AI Processing and Your Content

5.1 Chat Messages

Your chat messages are sent to AI providers (Anthropic Claude, OpenAI GPT-4) for processing. These providers use your messages solely to generate responses and do not train their models on your data (per our contracts with them). However, content sent to AI APIs leaves the EU.

5.2 Documents

Documents you upload for compliance checking or chat context are processed on our secure backend servers (Railway, EU/US). Text extracted from documents may be sent to AI APIs for analysis.

5.3 Amendments

Amendments created using the Amendator are stored in our EU-based database and are not shared with third parties unless you explicitly export and share them.

6. Data Retention

We retain your personal data as follows:

Account Data: Until you delete your account, plus 90 days for backup recovery
Chat History: Indefinitely until you delete conversations
Amendments: Indefinitely until you delete them
Uploaded Documents: Until you delete them, or when your subscription lapses (30-day grace period)
Payment Records: 7 years (legal requirement for accounting)
Usage Logs: 90 days for operational purposes
Marketing Communications: Until you unsubscribe, plus 3 years for compliance

7. Your Rights Under GDPR

As an EU data subject, you have the following rights:

7.1 Right of Access

You can request a copy of all personal data we hold about you.

7.2 Right to Rectification

You can update your account information in your Profile settings.

7.3 Right to Erasure ("Right to be Forgotten")

You can delete your account at any time in Profile → Account Settings → Delete Account.

7.4 Right to Restrict Processing

You can request that we limit how we use your data.

7.5 Right to Data Portability

You can export your data (chat history, amendments, documents) in machine-readable formats (JSON, XML).

7.6 Right to Object

You can object to processing based on legitimate interest, including marketing communications.

7.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with your national data protection authority if you believe we have violated GDPR. In Belgium, this is the Data Protection Authority (dataprotectionauthority.be).

To exercise any of these rights, contact us at hello@beresol.eu. We will respond within 30 days.

8. Data Security

We implement industry-standard security measures to protect your data:

Encryption in Transit: HTTPS/TLS 1.3+ for all communications
Encryption at Rest: Database encryption via Supabase
Authentication: JWT tokens with secure storage, bcrypt password hashing
Access Control: Role-based access control (RBAC), principle of least privilege
Infrastructure Security: Firewalls, regular security updates, DDoS protection
Monitoring: Real-time error tracking, suspicious activity detection

Despite our best efforts, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States, where some of our service providers are located (Anthropic, OpenAI, Stripe).

We ensure adequate protection for these transfers through:

Standard Contractual Clauses (SCCs): EU-approved data transfer agreements with processors
Adequacy Decisions: Transfers to countries deemed adequate by the European Commission
Data Processing Agreements (DPAs): Binding contracts with all processors

10. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience. For detailed information, see our Cookie Policy.

11. Children's Privacy

Brubru is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately, and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email (to your registered address) and by posting a notice on our website at least 30 days before the changes take effect.

Your continued use of Brubru after the effective date constitutes acceptance of the updated policy.

13. Contact Information

For privacy-related questions, concerns, or to exercise your rights under GDPR:

Email: hello@beresol.eu
Subject Line: "Privacy Inquiry" or "GDPR Request"

We will respond to all legitimate requests within 30 days.