Privacy Policy
Version 2026-10-07. This policy explains which personal data Bridge Suite (suite.briiidge.dev, the tool subdomains and games.briiidge.dev) processes, why, and what your rights are.
1. Who is responsible
The controller under the GDPR (AVG) is Thom Easix, trading as Bridge Suite, the Netherlands. Privacy questions and requests: [email protected].
2. Which data we process
- Account: username, display name, email address, password (stored only as a scrypt hash), language, profile photo, bio, your "personal style" for the AI, and the record of when you accepted these terms (version, date and the 16+ confirmation). If you sign in with Google, Google gives us your name, email address, profile photo and a permanent Google ID (no password and no access to your Google data).
- Your content: projects in the tools (designs, pages, slides, letters, notes, numbers, pictures, sounds, solids, motions, animations, videos, brand kits), files you upload, recordings, AI chat threads, game saves.
- Talk: your contacts and connections, conversations, the messages and attachments you send, read status, to-dos and calendar items. Messages are stored on our server so they can be delivered to the other participants. Conversations with end-to-end encryption can only be read on the participants' devices.
- Optional connections: if you connect Google Calendar, the access tokens for that connection; if you turn on notifications, the push subscription of your browser or device.
- Your own API keys (Anthropic, OpenAI, Google Gemini, Meshy, Replicate, ElevenLabs, Deepgram): stored encrypted, never shown again in full. We also keep a usage record per AI generation (tool, model, number of tokens, cost) so you can see your usage.
- Moderation: reports you make or that are made about you, and who you blocked.
- Technical data: IP address and browser information in the server and web server logs, the times you logged in and were last active (from your sessions), and error reports.
- Contact: the emails you send us.
We do not use analytics, tracking or advertising, we do not sell data, and we do not make automated decisions about you with legal or similarly significant effects.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|
| Creating and running your account, storing and sharing your content, delivering messages, the features you use | performance of the agreement (b) |
| Sending your requests to an AI or media provider with your own key | performance of the agreement (b), on your instruction |
| Security: preventing abuse, spam and attacks, rate limits, logs, back-ups, handling reports | legitimate interest (f): a safe and working service |
| Push notifications | consent (a), given through your browser or device; you can turn it off at any time |
| Recording your acceptance of the terms; answering your requests; complying with legal obligations | legitimate interest (f) and legal obligation (c) |
4. How long we keep it
- Account and content: for as long as your account exists. When you delete your account, we delete it from the live systems straight away.
- Back-ups: at most 14 days; after that, deleted data is gone from back-ups too.
- Logs: web server logs 14 days, application logs at most 30 days. Rate limits keep IP addresses in memory only, for at most one hour.
- Sessions: at most 30 days, or until you log out.
- Messages you sent to others: when you delete your account, the messages you sent in conversations with other people remain visible to them, without your name (anonymised), and your attachments are deleted. Conversations without other participants are deleted entirely.
- Comments on someone else's Pages project remain, without your name.
5. Who receives data
We only share data where that is needed for the Service:
- Hosting: Contabo GmbH, Germany (servers and storage, in the EU). Processor.
- Network and protection: Cloudflare, Inc. routes and protects the traffic to suite.briiidge.dev and the tool subdomains (CDN/proxy) and therefore processes IP addresses and traffic data. Processor; may involve transfer to the US (see section 6). The QR code library on the dashboard is loaded from Cloudflare's cdnjs.
- Email: Google (Gmail), for the emails you send us.
- Google Fonts: the pages load fonts from Google (fonts.googleapis.com, fonts.gstatic.com), which means your browser sends your IP address to Google.
- Calls and Studio: to connect a call your browser uses our own relay server and a public STUN server from Google (stun.l.google.com), which sees your IP address.
- Push notifications: delivered through the push service of your browser or device (Google, Mozilla or Apple).
- AI and media providers, only with your own key: when you use AI chat, images, 3D, voices or transcription, we send the necessary content directly to the provider whose key you entered: Anthropic, OpenAI, Google (Gemini/Veo), Meshy, Replicate, ElevenLabs or Deepgram. You share that data with the provider yourself, under your own agreement with them; they process it under their own terms and privacy policy, often in the US.
- Other features: stock photo search in Slides sends your search term to Pexels (if available); when you share a link in Talk, our server fetches that page to show a preview (the website sees our server, not you); playing a stock clip in Motions loads YouTube; connecting Google Calendar exchanges calendar data with Google; signing in with Google lets Google see that you sign in to Bridge Suite; Numbers sends invoices through your own mail server.
- The people you choose: other users see what you share with them (profile, projects, messages).
- Authorities: only if we are legally required to.
6. Transfers outside the EU
Cloudflare and Google are US companies. Transfers to them are based on the EU-U.S. Data Privacy Framework and/or the European Commission's standard contractual clauses. The AI and media providers you use with your own key may process data in the US or elsewhere under their own terms.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (in particular against processing based on legitimate interest), and to withdraw consent at any time.
- Export: download all your data as a zip in Settings › Account › Export my data.
- Rectification: change your profile in Settings.
- Erasure: delete your account in Settings › Account › Delete account (with your password). This is immediate and cannot be undone.
- Everything else, or if you can no longer log in: email [email protected]. We respond within one month and may ask you to confirm who you are.
You can also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own EU country.
8. Security
We take appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored only as hashes, your API keys encrypted, login cookies that scripts cannot read, separation between accounts, firewalls and limited administrative access, and daily back-ups. No system is completely secure. If a data breach occurs that is likely to put your rights at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours and inform you without undue delay if the risk is high.
9. Cookies and local storage
We only use functional cookies and local storage that are needed for logging in, your settings and the tools. There is no analytics or tracking. See the cookie and storage notice.
10. Age
The Service is for people aged 16 or older. If we learn that an account belongs to someone younger, we delete it.
11. Changes
We may change this policy. The current version and date are at the top. If a change matters to you, we ask for your agreement again the next time you log in.
12. Contact
Thom Easix, the Netherlands. Email: [email protected].