Privacy policy

• Your account: email address, workspace name, the plan and number of agents you chose, and your team members' emails if you invite them.
• Billing: handled by Stripe. We keep your Stripe customer and subscription IDs and your plan; we never see or store your card number.
• Your agents' activity: for every action an agent asks TryBrake about, the action name, its details (for example an amount or an order number), the decision, and, if your connector sends them, the agent's reasoning and the result. This is what lets TryBrake apply your rules, ask you for approval and replay what happened.
• Connections you set up: the address and API key of your n8n or Make account, encrypted (AES-256-GCM) before they are stored, and the original steps of workflows you protect, so protection can be removed exactly.
• The free website check: the domain you type and what your public homepage shows. Your IP address is kept in memory for at most one hour to limit abuse, never stored.
• Audience measurement: only if you accept it, see cookies.

We never ask for sensitive data. Don't send health, banking or identity documents through your agents' action details unless your rules need them.

• Providing the service you signed up for (account, rules, approvals, history, billing): performance of the contract.
• Keeping the service secure and preventing abuse (rate limits, audit log): our legitimate interest.
• Invoices and accounting records: legal obligation.
• Audience measurement: your consent, which you can withdraw at any time.

When your agents' actions contain personal data about your own customers (a name, an email, an order), you are the data controller and [company name to complete] acts as your processor: we only process it to run TryBrake for you, under your instructions, and delete it when your history period ends or when you close your account. A data processing agreement is available on request at [contact email to complete].

Some features use Anthropic's Claude models: analysing a workflow to suggest rules, turning a sentence into rules, and the free website check. For these, we send Anthropic only what the feature needs: the structure of the workflow, its actions and fields and the instructions given to your agent, the sentence you typed, or the public text of a homepage. Under Anthropic's commercial terms, this data isn't used to train their models. The AI only suggests rules; the decisions on your agents' actions are made by your saved rules, without AI.

• Supabase: database and sign-in (servers in Paris, France).
• Vercel: website hosting (United States).
• Stripe: payments and invoices.
• Anthropic: the AI features above (United States).
• Google Analytics: audience measurement, only with your consent.
• thum.io and Google: a screenshot and the icon of the homepage you check with the free website check.

When data leaves the European Union, the transfer relies on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. We never sell or rent your data.

• Agents' activity: 30 days on the Essential plan, 1 year on the Pro plan, then deleted.
• Account data: as long as your account is open, then deleted within 30 days of closing it.
• Invoices: 10 years, as French law requires.
• Analytics data: 14 months at most.

Data is encrypted in transit and at rest. Each workspace can only read its own data (row-level security), agent keys are stored as hashes, and connection keys are encrypted with a key that never leaves our servers.

Under the GDPR you can access, correct, delete or export your data, restrict or object to its processing, and withdraw your consent at any time. Write to [contact email to complete]; we answer within one month. You can also file a complaint with the CNIL (www.cnil.fr).

We may update this policy. The online version is the one that applies, and we will tell account holders by email about any important change.