Brymio
Back to home

Data processing agreement

Last updated: 10 October 2026

When your organisation uses Brymio to store other people's data — your clients and suppliers, your employees, the people who apply to your job posts, the people who buy from your store — your organisation is the controller of that data, and Krokanti Games SL processes it on its behalf as a processor. This agreement sets out how we do it, as required by Article 28 of the General Data Protection Regulation (GDPR) and Article 33 of the Spanish Data Protection Act, Organic Law 3/2018 (LOPDGDD).

It is part of the terms of service and is accepted with them: by creating an account or using Brymio on behalf of an organisation, you accept it on that organisation's behalf, without signing anything else. If your company needs a signed copy, ask for it at info@brymio.com and we will send it to you signed, with this same text.

1. Parties

  • Controller: the organisation — a company or a self-employed professional — that uses Brymio, represented by whoever accepts the terms of service on its behalf. In this agreement, "you".
  • Processor: Krokanti Games SL (tax ID B22786248, Avenida Costera 6, 46185 La Pobla de Vallbona, Valencia, Spain), the Spanish company that provides the Brymio service (www.brymio.com). In this agreement, "we".

2. Subject matter

This agreement governs the processing we carry out on your behalf of the personal data your organisation uploads to Brymio, connects to Brymio or receives through Brymio, while we provide the service to you.

It does not cover the data for which we are the controller — user accounts, subscription billing, the public website, support and the newsletter — which is governed by the privacy policy.

3. Duration

It lasts as long as your organisation uses Brymio: it starts when the organisation starts using it and ends when the organisation is deleted. The provisions for the end — return, deletion and the retention the law requires — and the duty of confidentiality remain in force for as long as we keep any of your data.

4. Nature and purpose

We process the data only to provide the service, with the modules you have switched on: we collect it through the forms, imports and integrations you connect; we store it, organise it and show it to the people in your organisation according to their role; we calculate with it (taxes, hour balances, search results); we send it to whoever you indicate (emails to your clients, employees and applicants, your store, the integrations you configure and, if you switch on Veri*factu, the Spanish Tax Agency); and we delete it. We also process it to the extent strictly needed to keep the service secure and running: backups, error diagnosis, abuse prevention and enforcing plan limits.

We do not use it for anything of our own: we do not sell it, we do not share it with third parties for commercial or advertising purposes, we do not build profiles with it and we do not use it to train artificial intelligence models.

The artificial intelligence features receive only what each task needs — reading a receipt, summarising a page, suggesting a product listing, explaining an audit — as the privacy policy explains. Hiring does not use artificial intelligence: it does not hand CVs to any provider to read or interpret them. And Brymio makes no automated decisions about people: it does not reject applications or decide anything about an employee; your team decides that.

5. What data we process and whose

Depending on the modules you switch on, we process these categories of data about these people on your behalf:

  • Invoicing — your clients and suppliers and their contact people: name or company name, tax ID, address, email and phone; invoices, quotes and expenses with their receipts; and bank data: the accounts that appear on them and the transactions in the statements you import, with their description and who pays or is paid.
  • Team — your employees and contractors: identification and contact details; contract and planned working hours; the working-time record, with every clock-in at the server's time; the location at the moment of clocking in, if you have it switched on and the employee has consented; absences and holidays with their reason; the payslips and documents you publish, with their acknowledgement of receipt; date of birth, if the employee provides it; the kiosk photo, if you switch that option on; and their means of access (a password stored irreversibly, passkeys, kiosk PIN, Telegram link and browser notifications). Answers to the mood pulse are anonymous.
  • Hiring — the people who apply to your job posts: what they write in the form (name, email, phone, message and answers), their CV and other attachments, and the privacy notice they accepted and when; and what your team does with each application: stages, notes, ratings and interviews.
  • Commerce — the people who buy from your store: name, email, phone, shipping and billing addresses, orders and refunds, as they arrive from your Shopify or WooCommerce.
  • Search — the people who visit your store: what they search for, how many results they get and which product they click. We do not store their IP address or their browser, only a keyed code that changes every day.
  • Projects — whatever the people in your organisation write or upload: pages, tasks, comments, mentions, history and attachments. It can contain any data, and that is your decision. Secure notes are encrypted in the browser and we cannot read them.
  • Store Health — the public addresses of the websites you audit, the results and the screenshots of those pages. It does not normally contain personal data.
  • In every module — the people in your organisation, as regards what they do in it: who created or changed each item, comments, assignments and the activity log. We process their user accounts as controller, under the privacy policy.

Brymio does not need special categories of data (health, trade union membership, ethnic origin and the others in Article 9 GDPR) or criminal data, and does not ask you for any. But they may appear if you enter them: an absence for illness, a payslip with a union fee, a CV or document with health data. In that case it is you who must have a legal basis for processing them, and we apply the same measures to them as to everything else.

6. Your instructions

We process the data on your documented instructions: this agreement, the terms of service and what you and your team configure and do in Brymio — the modules you switch on, the settings, each person's permissions, the stores, the API tokens, the webhooks and the integrations you connect. If you need a different instruction, write to us at info@brymio.com.

We would only depart from your instructions if European Union or Spanish law required us to; in that case we would tell you beforehand, unless that same law prohibits it. If we believe an instruction of yours infringes the GDPR or another data protection rule, we will tell you immediately.

As controller, it is up to you to have a legal basis for processing the data you upload; to inform the people concerned (for example, your employees about working-time recording and geolocation, and your applicants through the privacy notice you edit in Hiring); to collect any consents needed; to decide who in your organisation can access what; and to choose and contract the third-party tools you connect through the API, MCP or webhooks, which are not our sub-processors.

7. Confidentiality

Only the people at Krokanti Games SL who maintain the service access the data, and only when needed to maintain it, resolve an incident or handle a request from you. All of them are bound by the duty of confidentiality in Article 5 of the LOPDGDD, which remains in force after their relationship with us ends. We do not look at your organisation's content for any purpose of our own.

8. Security measures

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR). These are the ones in place today, described as they are:

  • Location: the database and the running application are in Frankfurt (Germany). Files are stored in Cloudflare R2; CVs and Hiring attachments in a separate store under European Union jurisdiction.
  • Encryption in transit: every connection to Brymio goes over HTTPS (TLS), with HSTS so the browser does not accept an unencrypted connection, and the application connects to the database over an encrypted channel. Security headers prevent the application from being embedded in another website.
  • Encryption at rest: the database and storage providers encrypt everything they store on disk. In addition, we encrypt the connection credentials of Commerce stores and the Shopify app secrets ourselves with AES-256-GCM before storing them.
  • Access credentials: passwords are never stored in clear (bcrypt for members, scrypt for employees), and API tokens, sign-in links and kiosk PINs are stored only as a cryptographic hash. Projects' secure notes are encrypted in the browser and we cannot read them.
  • Separation and permissions: every piece of data belongs to an organisation and every query is filtered by it, with an automated check in the code that watches over this. Within your organisation, each person sees what their role allows (owner, admin, member, accountant or viewer), the modules you have opened to them and, in Team and Hiring, the specific HR or recruiting permission. An API token never has more power than whoever created it, and cannot manage members, the subscription or the account.
  • People's access: temporary lockout after five failed attempts, optional two-factor authentication, single-use sign-in links that expire, and sessions that expire. Resetting the password, signing out on all devices or deleting the account immediately invalidates every open session. Public forms have usage limits and a bot check.
  • Files: Team payslips and documents, CVs and expense receipts can only be downloaded through the application, with a session and permission, and not from a public address.
  • Traceability: sensitive actions — changes to members, roles and modules, account security actions, downloads of invoices, receipts and CVs, reconciliations and exports — are recorded in an audit log with who and when. Each clock-in is chained by hash to the previous one, so any alteration is detected, and each correction is kept separately with its author and reason.
  • Backups: a full copy of the database every night, in separate storage, and another before each update of the service, on Krokanti Games SL equipment; both kinds are deleted after 35 days. Files are not included in those copies; they rely on the redundancy of the storage itself.
  • Error diagnosis: error reports carry only the internal identifiers of the person and the organisation; before they leave, emails, tokens, access codes in web addresses, cookies and request contents are removed.
  • Team: the location is only stored at the moment of clocking in, if the company has it switched on and the employee has consented; there is no continuous tracking. The kiosk photo is off by default and, if switched on, is deleted after 90 days.

We do not hold ISO 27001 or SOC 2 certification, and we do not claim otherwise. We review the security of the code periodically and fix what we find; if any of these measures changes materially, we will reflect it here.

9. Sub-processors

You give us a general authorisation to engage the sub-processors on this list. We undertake that each of them is bound by contract to protect the data with safeguards equivalent to those in this agreement as regards its part, and we remain liable to you for their compliance (Article 28(4) GDPR).

The current list, the same one the privacy policy publishes:

  • Vercel — hosting and running the application, plus cookie-free visit and speed measurement (addresses that carry an access key are sent with it removed). The functions that process your data run in its Frankfurt (Germany) region. A US company.
  • Neon — the PostgreSQL database where everything the platform stores lives, hosted in Frankfurt (Germany). A US company.
  • Cloudflare R2 — file storage: payslips, documents and kiosk photos of the team, CVs and application attachments (these in a store located in the European Union), expense receipts, invoice ZIP exports (seven days), project attachments, audit screenshots, logos, profile photos and the database backups. A US company.
  • Brevo — email delivery: the email about your account and the service (verification, sign-in links, notices and reminders), the email your organisation sends from Brymio to its clients, employees and applicants (invoices and quotes with their PDF, payment reminders, notices about payslips, absences and applications, access codes), the contact form messages, which reach us by email, and news to those who subscribe. A French company, processing in the European Union.
  • Cloudflare Turnstile — bot check on the public sign-up, job application, contact and news subscription forms. It looks at technical browser signals to tell a person from an automated program and is not used for advertising or analytics. A US company.
  • OpenRouter — the gateway that every Brymio artificial intelligence feature goes through, the assistant in the help bubble included. It routes each request to a model from a provider such as Google or OpenAI (on Microsoft Azure) and only receives the content of that request. On every request Brymio requires providers that neither keep what they receive nor train on it (zero retention); a model without such a provider is not used. Brymio does not use that content to train models either. A US company.
  • Inngest — coordinates background jobs: in Commerce, catalogue, order and customer imports, store syncing, bulk changes to the store and issuing invoices for orders (including the automatic one when an order is paid); in Invoicing, the invoice ZIP export; building the Search index; and Store Health audits (scheduled runs and retries). The events we send it carry identifiers (and, in Store Health, the public address audited), never credentials; for each step it keeps a technical result (states, counters and identifiers and, in Store Health, the measurements of the audited website). A US company.
  • Sentry (Functional Software, Inc.) — error diagnostics: when something fails in the application it receives the technical report of the failure (where it happened, the browser and the call stack) so we can fix it. The data is stored in its European Union region (Frankfurt, Germany). It only carries the internal identifiers of the person and of the company, never their name, email or IP address, and access codes and personal data are stripped from web addresses before anything is sent. A US company.
  • GitHub — runs the nightly database backup and stores it in Cloudflare R2. The backup passes through its servers while the job runs and is not kept there. A US company.
  • Telegram — only if an employee or a member links their account to the bot, to punch or to receive notifications. In that case Telegram handles their messages with the bot, their user id and the text of the notifications we send them (an assignment, a mention, the answer to an absence request). If nobody links it, Telegram is not involved.
  • Browser notification services (Google, Mozilla, Apple or Microsoft, depending on the browser) — only if you switch on push notifications. They carry the notice to your device; the content travels encrypted and they cannot read it.

These are not sub-processors: Stripe, which charges your subscription (we are the controller for that); Google Analytics, which measures the use of Brymio for us and only if the visitor accepts analytics cookies; Google sign-in, which is only involved if the person signing in chooses it; Google PageSpeed Insights, Thum.io and the public GitHub API, which only receive the public address of the website you audit or the name of a public repository; nor your Shopify or WooCommerce store, which is your provider and not ours. Nor are the tools you connect through the API, MCP or webhooks.

Before adding or replacing a sub-processor we will notify the owner of your organisation by email at least 30 days in advance, and we will update this list and its date. If the change is urgent to keep the service running or secure, we will notify you as soon as we know. If you object on reasonable data protection grounds, write to us within that period: we will look for an alternative and, if there is none, you may cancel before the change takes effect and we will refund the proportional part of what you have paid in advance and will not get to use.

10. International transfers

The database and the application are in the European Union, but several sub-processors are US companies and some — such as OpenRouter and the artificial intelligence model providers, Inngest and GitHub, whose servers the nightly database backup passes through — may process data outside the European Economic Area. Those transfers rely on the standard contractual clauses approved by the European Commission and, where the provider participates in it, on the EU-US Data Privacy Framework. If you need the details for a specific provider, ask us.

11. Data subjects' rights

Handling the rights of access, rectification, erasure, portability, restriction and objection is your responsibility, and Brymio gives you tools to do it without going through us:

  • Team: each employee has "Your data" in their settings, where they download what we hold about them and request the erasure of what does not have to be kept, which applies immediately: their record becomes a pseudonym and their clock-ins lose location and photo.
  • Hiring: applicants can, with the link to their application and a code sent to their email, view it, correct what they wrote while the process is still open, download their data, leave the talent pool or delete it. When the retention period you set expires, each application is anonymised automatically, except while its job post is still open and those of the people you end up hiring.
  • Commerce: we act on the access and erasure requests Shopify sends on behalf of your buyers; erasure deletes their customer record and removes what identifies them from their orders, and leaves the amounts and the issued invoices, which have to be kept. If you need another buyer erased, ask us.
  • In every module you can view and correct what you store, delete what the law does not require you to keep, and export it in the formats listed in section 13.

If someone contacts us to exercise a right over your organisation's data, we will not answer them on the substance: we will forward the request to you without undue delay and tell them to contact you. If something cannot be solved with the product's tools, we will help you as far as we can.

We will also give you the information we have for your data protection impact assessments and prior consultations (Articles 35 and 36 GDPR) and to demonstrate your compliance.

12. Security breaches

If we suffer a security breach affecting your organisation's data, we will notify you without undue delay and in any case within 48 hours of becoming aware of it, by email to the owner and the admins. We will tell you what we know — what happened, which data and how many people may be affected, the likely consequences, what we have done and what we recommend — and we will complete it as we find out more. We will document every breach, its effects and the measures taken.

Notifying the supervisory authority and, where appropriate, the people affected is your responsibility as controller (Articles 33 and 34 GDPR); we will help you with whatever you need.

13. At the end: return and deletion

When your organisation stops using Brymio:

  • Return: before deleting it you can take the data with each module's exports: invoices and quotes as PDF, receipts as ZIP and tax summaries as CSV; the working-time record as PDF or CSV; applications as CSV; Projects pages and databases in a ZIP with HTML and CSV; the catalogue as CSV and, with the data download in settings, Commerce products, orders and customers as JSON; and Store Health reports. If you need something those exports do not cover, ask us at info@brymio.com before deleting it and we will deliver it in a structured format.
  • Deletion: when you delete the organisation it immediately becomes inaccessible to its members, employees and applicants, and for 30 days we can restore it if you ask. After that we delete it permanently when the owner asks us by email: the data of every module, its files, the tokens, the store connections and the integrations. We carry out that deletion ourselves, it is not automatic, and we will confirm in writing when it is done.
  • What the law requires your organisation to keep is not deleted with it: issued invoices with their clients' data and, if you use Veri*factu, their chained records (four years for tax purposes and six for accounting books and documents), and the working-time record with its corrections, contracts and payslips (four years). We keep it blocked, on your behalf and without using it for anything else, so that you can meet that obligation and deal with an inspection, and we delete it when those periods expire. The people on your staff become pseudonyms and their clock-ins lose location and photo. If you would rather keep it yourself, ask us to hand it over and we will delete it as soon as you have it.
  • Backups: what is deleted disappears from the application immediately, but may remain in backups until they expire, after 35 days. Those copies are only used to restore the service.

The user accounts of the people in your organisation are not deleted with it: each belongs to its holder, who keeps it or deletes it, as the privacy policy explains.

14. Audits

We will make available to you the information needed to demonstrate that we comply with this agreement: this document, the security measures, the list of sub-processors and written answers to your reasonable questions. If that is not enough, you or an independent auditor bound by confidentiality may audit us, with at least 30 days' notice, at most once a year unless required by an authority or justified by a security breach, at your expense, during working hours and without accessing other customers' data or compromising the security of the service.

15. Liability

Each party is liable for the damage it causes by breaching the GDPR or this agreement, under Article 82 GDPR. Between us, the limitation of liability in the terms of service applies to the extent the law allows; that limitation does not affect the rights of the people whose data is processed or any liability that cannot be excluded.

16. Governing law

This agreement is governed by Spanish law, the GDPR and the LOPDGDD. The courts of Spain have jurisdiction over any dispute.

17. Acceptance, precedence and changes

This agreement is accepted with the terms of service, without signing anything else, and binds both parties from when your organisation starts using Brymio. If you need a signed copy, ask for it at info@brymio.com.

If the terms of service say something different about our processing of personal data, this agreement prevails.

We may update this agreement, for example when adding a module or changing a sub-processor. If the change is material, we will notify you by email or in the application before it takes effect. The date at the top shows the latest revision.

Contact

For any question about this agreement or the data we process on your behalf, write to us at info@brymio.com.