Privacy policy

This policy explains what personal data Krokanti Games SL processes when you use Brymio (www.brymio.com), why we process it and what you can do about it. It is written to be understood without help: if anything is unclear, write to us and we will clarify it.

Who processes your data

Krokanti Games SL, a Spanish company, is the data controller for the people who sign up to Brymio. Write to info@krokanti.com about anything to do with data protection; that is also the address for exercising your rights.

What Brymio is

Brymio is a single platform with several modules that each organisation turns on and off as it likes: Invoicing (invoices, quotes, expenses, taxes and bank reconciliation in Spain), Team (the Spanish time register plus basic HR: absences, payslips, calendar), Hiring (job posts and applications), Commerce (store operations for Shopify and WooCommerce: products, orders, stock and customers), Search (the search box of your online store), Projects (tasks, pages and documentation) and Store Health (performance, SEO and accessibility audits of a website). Every plan includes every module, so the data we process depends on what you switch on, not on what you pay.

When we are the controller and when we are a processor

For the data of whoever opens an account — name, email, subscription billing — we are the controller. For the data your organisation uploads, connects or receives — your employees', the people who apply to your job posts, your clients', your store's shoppers', your suppliers' — you are the controller and we act as a processor: we handle it only to provide the service and on your instructions, never for purposes of our own. If you need a signed data processing agreement, ask us at info@krokanti.com.

If your organisation gives third-party tools, such as an AI assistant, access through the API or MCP, that is your decision as controller. You choose and contract those tools, you inform the people whose data they will process and, for the people who apply to your job posts, you take no decision based solely on automated processing. We give the access you instruct and nothing more: what those tools do with the data is outside our control and not our responsibility. In Hiring, MCP access for these tools is off by default and only an administrator of the company can switch it on.

Data we process

Depending on the modules you have enabled, we process these categories:

• Account: name, email address, profile picture if you upload one, language, your password stored irreversibly and, if you enable them, your authenticator app secret and its backup codes.
• Organisation: name, URL identifier, tax number, address, time zone, logo, members with their role, and pending invitations.
• Invoicing: your tax details and those of your clients and suppliers, including their tax numbers and addresses; invoices and their lines, quotes, expenses with their receipts, bank movements you import and tax summaries. An issued invoice can no longer be changed and, if the organisation switches on Veri*factu, it is also chained by a cryptographic hash.
• Team: each employee's punches with the server clock, hash-chained so they cannot be altered (a correction never erases the original — it is stored separately with its author and reason); absences and holidays; contracts and expected hours; payslips and documents the company publishes, with their read receipts; date of birth if the employee gives it; and how they sign in (password, email link, passkey or kiosk PIN).
• Hiring: from whoever applies to a job post, what they write in the form (name, email, phone, their message and the answers to the post's questions) and the files they attach, such as a CV; the exact text of the privacy notice they accepted and when; and, from the company, the stages the application goes through, internal notes and interviews. For people who only visit a job post we count the visits with a code that changes every day, without storing their IP address or browser. The company that publishes the post is the controller of this data and Brymio its processor. Brymio does not hand CVs to any provider to read or interpret them and does not reject any application automatically: decisions are always made by a person.
• Commerce: what we pull from your own Shopify or WooCommerce store — products, stock, orders and customers, including the name, email, phone and addresses of the people who buy from you — plus the store connection credentials, which we store encrypted.
• Projects: pages, databases and tasks, comments, mentions, version history, labels and attachments. Secure notes are encrypted in your browser before they leave it: we only store the ciphertext and cannot read it.
• Store Health: the URLs you ask us to audit, the result of each analysis and the screenshots of those pages.
• Search: what your shoppers type into your store's search, how many results each search returned, and which product they clicked. We do not store their IP address or their browser: to tell one visit from another without identifying anyone, those are only ingredients of a keyed code that changes every day, so yesterday's cannot be linked to today's. Of your catalogue we keep a copy so it can be searched.
• Usage: pages viewed, features used and errors, so we know what gets used and what breaks.
• Payment: the organisation's plan, subscription status and Stripe identifiers. Card details are handled by Stripe directly and never reach our servers.
• Device and security: IP address, browser, sign-in and administrative action logs, and failed login attempts, which we use to stop brute-force attacks.
• Help: what you write to the assistant in the help bubble and, if you use the contact form, your name, your email, your company if you give it, your message and the conversation with the assistant if you choose to attach it. If you would rather your question did not go through an AI model, use the contact form directly or write to info@krokanti.com: a person reads it.
• News and offers: if you subscribe on the public website, your email, your language, when you gave consent, which version of the text you accepted and when you confirmed it.

Location, biometrics and other sensitive data

The Team module touches employment data, so let us be explicit:

• Location: it is stored only at the instant of a punch, and only if the company has it switched on (it is on by default and can be turned off in the Team settings) and the employee also gave consent. There is no continuous tracking and no trace between punches. The employee can withdraw consent at any time from their settings, and from that point their punches are stored without coordinates.
• Biometrics: Brymio processes no biometric data. There is no fingerprint or facial recognition anywhere in the product. Passkeys use your own device's sensor: the biometric data never leaves it and all we receive is a cryptographic signature.
• Kiosk photo: kiosk mode can store a photo taken at the moment of the punch. It is off by default, the company turns it on if it wants to, and the photos are deleted automatically after 90 days.
• Mood pulse: answers are anonymous and only shown in aggregate. If there are fewer than three answers in the period, nothing is shown at all, so nobody can be identified by elimination.

What we use it for

We process the data above for the following purposes, and nothing else:

• Providing the service: issuing invoices, recording working time, publishing job posts and managing applications, syncing your store, running projects and auditing websites.
• Identifying you and protecting the account: sign-in, two-factor authentication, session management and immediate revocation of access.
• Meeting legal obligations, yours and ours: keeping the time register and the tax documentation with the safeguards Spanish law requires.
• Charging the subscription and invoicing the platform itself, through Stripe.
• Sending you service email: account verification, sign-in links, absence notifications, punch reminders, monthly reports and important service notices.
• Running the artificial intelligence features: reading a receipt or an invoice to fill in an expense, answering questions about your figures and tax doubts, proposing product records, summarising or rewriting a page, pulling tasks out of a text, suggesting synonyms for the store search or explaining an audit. Almost all of them run only when you start them. A few run on their own: on plans that include AI, the analysis of each Store Health audit, the monthly Invoicing report and the monthly working-time summary for each employee (the model gets dates and hours, never the name); and on any plan, the paragraph in the monthly Invoicing email (the model only gets the month's totals). In every case only what that task needs is sent.
• Measuring site usage and performance so we can improve it. Google Analytics only loads if you accept analytics cookies.
• Helping you when you write to us through the contact form or by email, answering you from the assistant in the help bubble and resolving incidents.
• Sending you Brymio news and commercial offers, and the welcome code, only if you subscribe and confirm your email with the link we send you.

On what legal basis

Under the General Data Protection Regulation, we process your data on these bases:

• Performance of the contract: everything needed to give you the service you signed up for and to charge for it.
• Consent: analytics cookies, punch geolocation, push notifications, Telegram linking and the subscription to news and offers. You can withdraw it whenever you like, without affecting what was processed before.
• Legitimate interest: platform security, abuse prevention and product improvement.
• Legal obligation: retention of the time register (art. 34.9 of the Spanish Workers' Statute) and of tax and accounting records.

Who we share data with

We rely on these providers to run the service; they process data on our behalf under contract. We do not sell data to anyone, we do not share it for advertising, and we do not use it to train AI models.

• Vercel — hosting and running the application. The functions that process your data run in its Frankfurt (Germany) region. A US company.
• Neon — the PostgreSQL database where everything the platform stores lives, hosted in Frankfurt (Germany). A US company.
• Cloudflare R2 — file storage: payslips and team documents, CVs and application attachments (these in a store located in the European Union), expense receipts, project attachments, audit screenshots, logos, profile photos and the database backups.
• Brevo — delivery of transactional email (verification, sign-in links, notices and reminders), of the contact form messages, which reach us by email, and of news to those who subscribe. A French company, processing in the European Union.
• Cloudflare Turnstile — bot check on the public sign-up, job application, contact and news subscription forms. It looks at technical browser signals to tell a person from an automated program and is not used for advertising or analytics.
• Stripe — subscription payment and management. It handles card details directly, which we neither see nor store.
• Google PageSpeed Insights and Thum.io — Store Health passes them the public address of the website you audit, to measure its performance and take the screenshot, and Google also gives us its icon. They receive no data about you or your customers.
• OpenRouter — the gateway that every Brymio artificial intelligence feature goes through, the assistant in the help bubble included. It routes each request to a model from a provider such as Google, OpenAI or Alibaba (Qwen) and only receives the content of that request. Brymio does not use that content to train models; what OpenRouter and the model provider do with what they receive is governed by their own terms.
• Inngest — coordinates background jobs: store imports and syncing in Commerce, and Store Health audits (scheduled runs and retries). The events we send it carry identifiers, never credentials.
• GitHub — runs the nightly database backup and stores it in Cloudflare R2. The backup passes through its servers while the job runs and is not kept there.
• Telegram — only if an employee or a member links their account to the bot, to punch or to receive notifications. In that case Telegram handles their messages with the bot and their user id. If nobody links it, Telegram is not involved.
• Browser notification services (Google, Mozilla, Apple or Microsoft, depending on the browser) — only if you switch on push notifications. They carry the notice to your device; the content travels encrypted and they cannot read it.
• Your Shopify or WooCommerce store — not our provider but yours, though data flows both ways: we read and write using the credentials you give us, and only for what you ask.
• Google Analytics 4 — analytics for the public site, only if you accept analytics cookies.

The database and the application are in the European Union, but several of these providers are US companies and some, such as OpenRouter and the AI model providers, may process data outside it, so there are international data transfers. These rely on the standard contractual clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework.

Security

Data always travels encrypted over TLS and is stored encrypted at rest. Passwords are never stored in the clear: they are stored with functions designed for that (bcrypt for members, scrypt for employees). API tokens are stored as SHA-256 hashes and your store credentials are encrypted. Changing a password, using "sign out everywhere" or deactivating an account invalidates every open session immediately. Sign-in attempts are rate-limited and the account locks temporarily after several failures in a row. And one honest note: we hold no ISO 27001 or SOC 2 certification, and we are not going to pretend otherwise.

How long we keep it

Each kind of data lives as long as it has to:

• Account and organization: for as long as the account is active. Deleting an organization makes it inaccessible immediately and we can restore it for 30 days. After that it stays deactivated, and we erase it for good when you ask us to, except for what the law requires us to keep (invoices and the time register).
• Invoicing: issued invoices and, if you use Veri*factu, their chained records are not deleted on request, because Spanish tax and commercial law requires them to be kept. They are held for the statutory retention periods — four years for tax purposes and six years for accounting books and records — and deleted afterwards.
• Time register: the law requires punches to be kept for four years (art. 34.9 of the Workers' Statute). They cannot be deleted before that, not even when the employee leaves, and they cannot be edited: corrections are stored separately and leave a trail. Kiosk photos, by contrast, are deleted after 90 days.
• Hiring: each application is kept for twelve months from when it arrives — the company can change the period in its settings — or until the job post closes if it is still open by then, and when it expires it is anonymised automatically: what was written, the files, the notes and the interviews are removed. If the person separately agreed to join the talent pool for future posts, it is kept for another period of the same length, and they can withdraw that consent whenever they like. Applications from people who end up hired are the exception: they become part of the employment relationship. The visit counts on each job post are deleted after 90 days.
• Commerce: imported products, orders and customers are kept while the project exists and deleted when it is deleted. Disconnecting the store stops new data coming in but does not delete what was already imported. We also act on the deletion requests Shopify sends us on a shopper's behalf.
• Projects: tasks and notes live as long as the organisation keeps them. The trash can be emptied at any time.
• Store Health: reports are kept until you delete them; those that stall or fail are removed automatically after 30 days.
• Search: the copy of the catalogue and the search log live for as long as the store keeps search switched on. Deleting the project or the organisation removes them with it.
• News and offers: for as long as you stay subscribed. If you do not confirm the subscription, we delete your email after 30 days; if you unsubscribe, we delete it 30 days later.
• Help: Brymio does not store conversations with the assistant. Your browser keeps the conversation while the tab is open, and for each question we only record its cost, without the text. To curb abuse we count the questions arriving from each IP address, stored only as a fingerprint, and that count is deleted the next day. What you send through the contact form reaches us as an email at info@krokanti.com and stays in that mailbox, not in the database; if you want us to delete it, ask us.
• Backups: every night we back up the database and keep the copy for 35 days. Deleted data disappears from the application at once, but it may remain in a backup until that backup is deleted.

When you delete your account, your user is marked as deleted, all your sessions are closed and the Commerce data of organisations that were yours alone is erased. What the law requires us to keep — issued invoices and the time register — survives that deletion for the statutory period and is used for nothing else. Download your JSON copy from settings first.

When a whole organization is erased, or when an employee exercises their right to erasure, people's records are not kept by name: they become a pseudonym derived from their own identifier. The time entries stay, because the law requires four years and an entry that does not say whose it is is not a register, but they are no longer attached to a name, an address, a date of birth, a location or a photo.

A client's invoice portal opens with a link, and that link expires after 180 days. On expiry it is also invalidated in our database, so an old forwarded email opens nothing; whoever issued it can generate another whenever it is needed.

Your rights

You can exercise these rights over your personal data:

• Access: find out what data we hold about you and ask for a copy. Settings offer an immediate JSON download, with nobody to wait for.
• Rectification: correct anything that is wrong or incomplete.
• Erasure: ask us to delete your data, except what the law requires us to keep.
• Portability: take your data with you in a structured, machine-readable format.
• Restriction: ask us to stop processing certain data while a disagreement is resolved.
• Objection: object to the processing we carry out on the basis of legitimate interest.
• Withdrawal of consent: turn off analytics cookies, punch geolocation, push notifications or Telegram linking, and unsubscribe from the news with the link in every email, whenever you want.

To exercise them, write to info@krokanti.com from your account's address. We answer within one month. If our answer does not satisfy you, you can complain to the Spanish Data Protection Agency (www.aepd.es).

If you are an employee using Brymio because your company subscribed to it, exercise your rights with your company: it decides what is processed and why. We will help it answer you, and if you get no response you can write to us and we will point you in the right direction.

If you applied to a job post published with Brymio, the controller of your data is the company that published it, and its privacy notice sits next to the form. With the link you receive when you apply and a code we send to your email, you can see your application, correct what you wrote, download your data, leave the talent pool or delete it, without waiting for anyone; for anything else, contact the company, and if you get no answer write to us and we will point you in the right direction.

If you clock in with Brymio you do not have to wait: Settings has “Your data”, with a download of everything we hold about you and the request to erase what we are not required to keep.

Minors

Brymio is a work tool and is not aimed at anyone under 16; we do not open accounts for minors. If a company registers a legally employed minor as an employee, it is that company that answers for the lawfulness of the processing.

Changes to this policy

We may update this policy if our practices, our providers or the law change. If the change is significant we will tell you by email or inside the application. The date at the top shows the latest revision.

Contact

For any question about this policy or your data, write to info@krokanti.com or to Krokanti Games SL, Spain.