Privacy policy

This policy explains what personal data Krokanti Games SL processes when you use Brymio (www.brymio.com), why we process it and what you can do about it. It is written to be understood without help: if anything is unclear, write to us and we will clarify it.

Who processes your data

Krokanti Games SL (tax ID B22786248, Avenida Costera 6, 46185 La Pobla de Vallbona, Valencia, Spain) is the data controller for the people who sign up to Brymio. Write to info@krokanti.com about anything to do with data protection; that is also the address for exercising your rights.

What Brymio is

Brymio is a single platform with several modules that each organisation turns on and off as it likes: Invoicing (invoices, quotes, expenses, taxes and bank reconciliation in Spain), Team (the Spanish time register plus basic HR: absences, payslips, calendar), Hiring (job posts and applications), Commerce (store operations for Shopify and WooCommerce: products, orders, stock and customers), Search (the search box of your online store), Projects (tasks, pages and documentation) and Store Health (performance, SEO and accessibility audits of a website). Every plan includes every module, so the data we process depends on what you switch on, not on what you pay.

When we are the controller and when we are a processor

For the data of whoever opens an account — name, email, subscription billing — we are the controller. For the data your organisation uploads, connects or receives — your employees', the people who apply to your job posts, your clients', your store's shoppers', your suppliers' — you are the controller and we act as a processor: we handle it only to provide the service and on your instructions, never for purposes of our own. That relationship is governed by our data processing agreement, which you accept with the terms of service; if you need a signed copy, ask for it at info@brymio.com.

If your organisation gives third-party tools, such as an AI assistant, access through the API or MCP, that is your decision as controller. You choose and contract those tools, you inform the people whose data they will process and, for the people who apply to your job posts, you take no decision based solely on automated processing. We give the access you instruct and nothing more: what those tools do with the data is outside our control and not our responsibility. In Hiring, MCP access for these tools is off by default and only an administrator of the company can switch it on.

Data we process

Depending on the modules you have enabled, we process these categories:

• Account: name, email address, profile picture (the one you upload or, if you sign in with Google, your Google account's), language, your password stored irreversibly and, if you enable them, your authenticator app secret and its backup codes.
• Organisation: name, URL identifier, tax number, address, time zone, logo, members with their role, and pending invitations.
• Invoicing: your tax details and those of your clients and suppliers, including their tax numbers and addresses; invoices and their lines, quotes, expenses with their receipts, bank movements you import and tax summaries. An issued invoice can no longer be changed and, if the organisation switches on Veri*factu, it is also chained by a cryptographic hash and its record, with the client's tax number and name, is sent to the Spanish Tax Agency (for now, to its test environment).
• Team: each employee's punches with the server clock, hash-chained so they cannot be altered (a correction never erases the original — it is stored separately with its author and reason); absences and holidays; contracts and expected hours; payslips and documents the company publishes, with their read receipts; date of birth if the employee gives it; and how they sign in (password, email link, passkey or kiosk PIN).
• Hiring: from whoever applies to a job post, what they write in the form (name, email, phone, their message and the answers to the post's questions) and the files they attach, such as a CV; the exact text of the privacy notice they accepted and when; and, from the company, the stages the application goes through, internal notes and interviews. For people who only visit a job post we count the visits with a code that changes every day, without storing their IP address or browser. The company that publishes the post is the controller of this data and Brymio its processor. Brymio does not hand CVs to any provider to read or interpret them and does not reject any application automatically: decisions are always made by a person.
• Commerce: what we pull from your own Shopify or WooCommerce store — products, stock, orders and customers, including the name, email, phone and addresses of the people who buy from you — plus the store connection credentials, which we store encrypted.
• Projects: pages, databases and tasks, comments, mentions, version history, labels and attachments. Secure notes are encrypted in your browser before they leave it: we only store the ciphertext and cannot read it.
• Store Health: the URLs you ask us to audit, the result of each analysis and the screenshots of those pages.
• Search: what your shoppers type into your store's search, how many results each search returned, and which product they clicked. We do not store their IP address or their browser: to tell one visit from another without identifying anyone, those are only ingredients of a keyed code that changes every day, so yesterday's cannot be linked to today's. Of your catalogue we keep a copy so it can be searched.
• Usage: pages viewed, features used and errors, so we know what gets used and what breaks.
• Payment: the organisation's plan, subscription status and Stripe identifiers. Card details are handled by Stripe directly and never reach our servers.
• Device and security: IP address, browser, sign-in and administrative action logs, and failed login attempts, which we use to stop brute-force attacks.
• Help: what you write to the assistant in the help bubble and, if you use the contact form, your name, your email, your company if you give it, your message and the conversation with the assistant if you choose to attach it. If you would rather your question did not go through an AI model, use the contact form directly or write to info@krokanti.com: a person reads it.
• News and offers: if you subscribe on the public website, your email, your language, when you gave consent, which version of the text you accepted and when you confirmed it.

Location, biometrics and other sensitive data

The Team module touches employment data, so let us be explicit:

• Location: it is stored only at the instant of a punch, and only if the company has it switched on (it is on by default and can be turned off in the Team settings) and the employee also gave consent. There is no continuous tracking and no trace between punches. The employee can withdraw consent at any time from their settings, and from that point their punches are stored without coordinates.
• Biometrics: Brymio processes no biometric data. There is no fingerprint or facial recognition anywhere in the product. Passkeys use your own device's sensor: the biometric data never leaves it and all we receive is a cryptographic signature.
• Kiosk photo: kiosk mode can store a photo taken at the moment of the punch. It is off by default, the company turns it on if it wants to, and the photos are deleted automatically after 90 days.
• Mood pulse: answers are anonymous and only shown in aggregate. If there are fewer than three answers in the period, nothing is shown at all, so nobody can be identified by elimination.

What we use it for

We process the data above for the following purposes, and nothing else:

• Providing the service: issuing invoices, recording working time, publishing job posts and managing applications, syncing your store, running projects and auditing websites.
• Identifying you and protecting the account: sign-in, two-factor authentication, session management and immediate revocation of access.
• Meeting legal obligations, yours and ours: keeping the time register and the tax documentation with the safeguards Spanish law requires.
• Charging the subscription and invoicing the platform itself, through Stripe.
• Sending you service email: account verification, sign-in links, absence notifications, punch reminders, monthly reports and important service notices.
• Running the artificial intelligence features: reading a receipt or an invoice to fill in an expense, answering questions about your figures and tax doubts, proposing product records, summarising or rewriting a page, pulling tasks out of a text, suggesting synonyms for the store search or explaining an audit. Almost all of them run only when you start them. A few run on their own, and only on plans that include AI: the analysis of each Store Health audit, the monthly Invoicing report (the model gets the month's figures and the names of your main clients), the paragraph in the monthly Invoicing email (only the month's totals) and the monthly working-time summary for each employee (dates and hours, never the name). In every case only what that task needs is sent.
• Measuring site usage and performance so we can improve it. Google Analytics and HeyCatch only measure if you accept analytics cookies, and only on the public site, never inside the application.
• Helping you when you write to us through the contact form or by email, answering you from the assistant in the help bubble and resolving incidents.
• Sending you Brymio news and commercial offers, and the welcome code, only if you subscribe and confirm your email with the link we send you.

On what legal basis

Under the General Data Protection Regulation, we process your data on these bases:

• Performance of the contract: everything needed to give you the service you signed up for and to charge for it.
• Consent: analytics cookies, punch geolocation, push notifications, Telegram linking and the subscription to news and offers. You can withdraw it whenever you like, without affecting what was processed before.
• Legitimate interest: platform security, abuse prevention and product improvement.
• Legal obligation: retention of the time register (art. 34.9 of the Spanish Workers' Statute) and of tax and accounting records.

Who we share data with

We rely on these providers to run the service; they process data on our behalf under contract. We do not sell data to anyone, we do not share it for advertising, and we do not use it to train AI models.

• Vercel — hosting and running the application, plus cookie-free visit and speed measurement (addresses that carry an access key are sent with it removed). The functions that process your data run in its Frankfurt (Germany) region. A US company.
• Neon — the PostgreSQL database where everything the platform stores lives, hosted in Frankfurt (Germany). A US company.
• Cloudflare R2 — file storage: payslips, documents and kiosk photos of the team, CVs and application attachments (these in a store located in the European Union), expense receipts, invoice ZIP exports (seven days), project attachments, audit screenshots, logos, profile photos and the database backups. A US company.
• Brevo — email delivery: the email about your account and the service (verification, sign-in links, notices and reminders), the email your organisation sends from Brymio to its clients, employees and applicants (invoices and quotes with their PDF, payment reminders, notices about payslips, absences and applications, access codes), the contact form messages, which reach us by email, and news to those who subscribe. A French company, processing in the European Union.
• Cloudflare Turnstile — bot check on the public sign-up, job application, contact and news subscription forms. It looks at technical browser signals to tell a person from an automated program and is not used for advertising or analytics. A US company.
• Stripe — subscription payment and management. It handles card details directly, which we neither see nor store.
• Google PageSpeed Insights, Thum.io and GitHub — Store Health passes them the public address of the website you audit, to measure its performance and take the screenshot (and Google also gives us its icon) and, on the plans that include it, the name of the public GitHub repository you enter, to review its dependencies. They receive no data about you or your customers.
• OpenRouter — the gateway that every Brymio artificial intelligence feature goes through, the assistant in the help bubble included. It routes each request to a model from a provider such as Google or OpenAI (on Microsoft Azure) and only receives the content of that request. On every request Brymio requires providers that neither keep what they receive nor train on it (zero retention); a model without such a provider is not used. Brymio does not use that content to train models either. A US company.
• Inngest — coordinates background jobs: in Commerce, catalogue, order and customer imports, store syncing, bulk changes to the store and issuing invoices for orders (including the automatic one when an order is paid); in Invoicing, the invoice ZIP export; building the Search index; and Store Health audits (scheduled runs and retries). The events we send it carry identifiers (and, in Store Health, the public address audited), never credentials; for each step it keeps a technical result (states, counters and identifiers and, in Store Health, the measurements of the audited website). A US company.
• Sentry (Functional Software, Inc.) — error diagnostics: when something fails in the application it receives the technical report of the failure (where it happened, the browser and the call stack) so we can fix it. The data is stored in its European Union region (Frankfurt, Germany). It only carries the internal identifiers of the person and of the company, never their name, email or IP address, and access codes and personal data are stripped from web addresses before anything is sent. A US company.
• GitHub — runs the nightly database backup and stores it in Cloudflare R2. The backup passes through its servers while the job runs and is not kept there. A US company.
• Telegram — only if an employee or a member links their account to the bot, to punch or to receive notifications. In that case Telegram handles their messages with the bot, their user id and the text of the notifications we send them (an assignment, a mention, the answer to an absence request). If nobody links it, Telegram is not involved.
• Browser notification services (Google, Mozilla, Apple or Microsoft, depending on the browser) — only if you switch on push notifications. They carry the notice to your device; the content travels encrypted and they cannot read it.
• Your Shopify or WooCommerce store — not our provider but yours, though data flows both ways: we read and write using the credentials you give us, and only for what you ask.
• Google Analytics 4 — analytics for the public site, only if you accept analytics cookies.
• HeyCatch (HeyCatch, Inc.) — analytics for the public site, only if you accept analytics cookies and never inside the application. It receives the pages you visit, clicks (not what you type into a form), the submission of the sign-up form, your IP address and browser and device data, with a random identifier; never your name or email, and it does not record the session. It keeps the data while we use the service and for two more months. For some of its analysis features it passes this data through OpenRouter to AI model providers, which may keep it for a limited period but may not use it for training. US company.
• Google (sign-in) — only if you choose to sign in with your Google account, employees included: it confirms who you are and gives us your name, your email and your profile picture. A US company.

The database and the application are in the European Union, but several of these providers are US companies and some, such as OpenRouter and the AI model providers, Inngest, HeyCatch and GitHub — whose servers the nightly database backup passes through — may process data outside it, so there are international data transfers. These rely on the standard contractual clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework.

Security

Data always travels encrypted over TLS and is stored encrypted at rest. Passwords are never stored in the clear: they are stored with functions designed for that (bcrypt for members, scrypt for employees). API tokens are stored as SHA-256 hashes and your store credentials are encrypted. Resetting a password, using "sign out everywhere" or deactivating an account invalidates every open session immediately; so does changing your password from settings, unless you untick that option. Sign-in attempts are rate-limited and the account locks temporarily after several failures in a row. And one honest note: we hold no ISO 27001 or SOC 2 certification, and we are not going to pretend otherwise.

How long we keep it

Each kind of data lives as long as it has to:

• Account and organization: for as long as the account is active. Deleting an organization makes it inaccessible immediately and we can restore it for 30 days. After that it stays deactivated, and we erase it for good when you ask us to, except for what the law requires us to keep (invoices and the time register).
• Invoicing: issued invoices and, if you use Veri*factu, their chained records are not deleted on request, because Spanish tax and commercial law requires them to be kept: four years for tax purposes and six years for accounting books and records. Brymio does not delete them on its own when those periods end: they stay in your organisation for as long as it exists.
• Time register: the law requires punches to be kept for four years (art. 34.9 of the Workers' Statute). They cannot be deleted before that, not even when the employee leaves, and they cannot be edited: corrections are stored separately and leave a trail. Kiosk photos, by contrast, are deleted after 90 days.
• Hiring: each application is kept for twelve months from when it arrives — the company can change the period in its settings — or until the job post closes if it is still open by then, and when it expires it is anonymised automatically: what was written, the files, the notes and the interviews are removed. If the person separately agreed to join the talent pool for future posts, it is kept for another period of the same length, and they can withdraw that consent whenever they like. Applications from people who end up hired are the exception: they become part of the employment relationship. The visit counts on each job post are deleted after 90 days.
• Commerce: imported products, orders and customers are kept while the project exists and deleted when it is deleted. Disconnecting the store stops new data coming in but does not delete what was already imported; if you uninstall the Brymio app in Shopify, Shopify asks us 48 hours later to delete that store's data and we delete it (issued invoices stay in Invoicing). We also act on the deletion requests Shopify sends us on a shopper's behalf: we delete their customer record and remove their name, email, addresses and notes from their orders.
• Projects: pages, tasks and notes live as long as the organisation keeps them. The trash is not emptied on its own: what is in it can be deleted permanently whenever you like.
• Store Health: reports are kept until you delete them; those that stall or fail are removed automatically after 30 days.
• Search: the log of searches and clicks is deleted after 90 days. The copy of the catalogue lives as long as the project exists, even if you switch search off, and goes when the project or the organisation is deleted.
• News and offers: for as long as you stay subscribed. If you do not confirm the subscription, we delete your email after 30 days; if you unsubscribe, we delete it 30 days later.
• Help: Brymio does not store conversations with the assistant. Your browser keeps the conversation while the tab is open, and for each question we only record its cost, without the text. To curb abuse we count the questions arriving from each IP address, stored only as a fingerprint, and that count is deleted after 24 to 36 hours. What you send through the contact form reaches us as an email at info@krokanti.com and stays in that mailbox, not in the database; if you want us to delete it, ask us.
• Backups: every night we back up the database, and again before every update of the service, and we keep the copies for 35 days. Deleted data disappears from the application at once, but it may remain in a backup until that backup is deleted.
• Security and activity logs: what we record about sign-ins and administrative actions — who did what and when and, in some cases, the IP address and browser it was done from — is deleted after two years. Only the record that an organisation was permanently deleted is kept longer, and it holds no personal data.

When you delete your account, all your sessions are closed, your tokens and assistant connections are revoked, you leave other people's organisations and the organisations that were yours alone are deleted: their Commerce data is erased at once and the rest follows what is explained above for a deleted organisation. Your name, email, picture, password and two-factor settings do not survive, only an internal identifier marked as deleted, and your email address is free to sign up again. What the law requires us to keep — issued invoices and the time register — survives that deletion for the statutory period and is used for nothing else. Download your JSON copy from settings first.

When a whole organization is erased, or when an employee exercises their right to erasure, people's records are not kept by name: they become a pseudonym derived from their own identifier. The time entries stay, because the law requires four years and an entry that does not say whose it is is not a register, but they are no longer attached to a name, an address, a date of birth, a location or a photo.

A client's invoice portal opens with a link, and that link expires after 180 days. On expiry it is also invalidated in our database, so an old forwarded email opens nothing; whoever issued it can generate another whenever it is needed.

Your rights

You can exercise these rights over your personal data:

• Access: find out what data we hold about you and ask for a copy. Settings offer an immediate JSON download with your account data and the Commerce data of your organisations; the rest comes from each module's exports, or we give it to you if you ask.
• Rectification: correct anything that is wrong or incomplete.
• Erasure: ask us to delete your data, except what the law requires us to keep.
• Portability: take your data with you in a structured, machine-readable format.
• Restriction: ask us to stop processing certain data while a disagreement is resolved.
• Objection: object to the processing we carry out on the basis of legitimate interest.
• Withdrawal of consent: turn off analytics cookies, punch geolocation, push notifications or Telegram linking, and unsubscribe from the news with the link in every email, whenever you want.

To exercise them, write to info@krokanti.com from your account's address. We answer within one month. If our answer does not satisfy you, you can complain to the Spanish Data Protection Agency (www.aepd.es).

If you are an employee using Brymio because your company subscribed to it, exercise your rights with your company: it decides what is processed and why. We will help it answer you, and if you get no response you can write to us and we will point you in the right direction.

If you applied to a job post published with Brymio, the controller of your data is the company that published it, and its privacy notice sits next to the form. With the link you receive when you apply and a code we send to your email, you can see your application, correct what you wrote while the process is still open, download your data, leave the talent pool or delete it, without waiting for anyone; for anything else, contact the company, and if you get no answer write to us and we will point you in the right direction.

If you clock in with Brymio you do not have to wait: Settings has “Your data”, with a download of everything we hold about you and the request to erase what we are not required to keep.

Minors

Brymio is a work tool and is not aimed at anyone under 16; we do not open accounts for minors. If a company registers a legally employed minor as an employee, it is that company that answers for the lawfulness of the processing.

Changes to this policy

We may update this policy if our practices, our providers or the law change. If the change is significant we will tell you by email or inside the application. The date at the top shows the latest revision.

Contact

For any question about this policy or your data, write to info@krokanti.com or by post to Krokanti Games SL, Avenida Costera 6, 46185 La Pobla de Vallbona (Valencia), Spain.