Legal
Privacy policy
Last updated: 7 July 2026
This policy explains what personal data berwick.ai, a service operated by Berwick IT ("we", "us"), collects, why we collect it, and the rights you have over it. It is written to comply with Regulation (EU) 2016/679 (the GDPR) and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus).
1. Data controller
The data controller is Berwick IT, represented by Flavien Berwick. Its registered address is . For any question about this policy or your data, contact us at [email protected].
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email address, password (stored hashed, never in clear) | Creating and securing your account, signing you in, sending verification and password-reset emails | Performance of a contract (Art. 6(1)(b)) |
| Organization and billing data: organization name, company name, VAT ID, credit balance and transaction history | Managing your workspace, metering credits, invoicing | Performance of a contract; legal obligation for accounting records (Art. 6(1)(b) and (c)) |
| Project data: project descriptions, chat messages, requests, attachments, repository URLs | Reviewing, estimating, and delivering your project; keeping an auditable history of the engagement | Performance of a contract (Art. 6(1)(b)) |
| Project Memory entries, including credentials you choose to share | Allowing the build agent to complete tasks that need them; entries are encrypted at rest | Performance of a contract (Art. 6(1)(b)) |
| Payment data | Processing credit top-ups and quote payments. Payments are handled by Stripe; we never see or store your card number, only payment references | Performance of a contract; legal obligation (Art. 6(1)(b) and (c)) |
| Technical data: IP address, server and proxy logs, essential cookies | Keeping the platform secure, preventing abuse and fraud, rate limiting, diagnosing incidents | Legitimate interest in securing the service (Art. 6(1)(f)) |
We collect nothing beyond the table above. In particular, we do not use third-party analytics, advertising trackers, or marketing databases, we do not send marketing emails, and we never sell or rent personal data.
3. Cookies
The platform uses strictly necessary cookies only: a session cookie to keep you signed in and a CSRF token to protect forms. These are exempt from consent under the ePrivacy rules, which is why you see no cookie banner. We set no analytics, advertising, or cross-site tracking cookies. The signup captcha (Altcha) is self-hosted and sends nothing to third parties.
4. AI processing of your project content
To deliver an AI-curated build, your project description, chat messages, and relevant Memory entries are processed by our AI model provider, acting as a processor on our instructions, strictly to review, estimate, and generate your deliverables. This content is not used to train models. Builds run in an isolated, sandboxed environment; secrets you store in Memory reach only that sandbox, never demo containers or logs.
No decision producing legal effects on you is made by automated means alone: every project is reviewed by a human (Flavien Berwick) before and during delivery (no processing within the meaning of Art. 22 GDPR).
5. Who receives your data
Your data is shared only with the processors needed to run the service:
- Our hosting provider, which operates the servers the platform runs on.
- Stripe, for payment processing (credit top-ups and quotes).
- Our AI model provider, for the processing described in section 4.
- GitHub or our self-hosted GitLab, to deliver code: if you connect your own GitHub repository, code and pull requests are pushed there under GitHub's own terms; otherwise delivery happens on our self-hosted GitLab.
- Our email delivery provider, for transactional emails only (verification, password reset, project status notifications).
Each processor is bound by a data-processing agreement under Art. 28 GDPR. We may also disclose data where the law requires it (for example to competent authorities on a valid request).
6. International transfers
The platform is designed to keep data under European jurisdiction. Where a processor transfers data outside the EU/EEA (for example Stripe), the transfer is covered by an adequacy decision or the European Commission's Standard Contractual Clauses.
7. How long we keep your data
- Account, organization, and project data: for as long as your account is active, then deleted or anonymized within 90 days of account closure.
- Billing records and invoices: 7 years, as required by the Estonian Accounting Act.
- Memory entries and stored credentials: until you delete them (they are editable and deletable at any time) or your account is closed.
- Technical logs: up to 12 months.
8. How we protect your data
- All traffic is encrypted in transit (TLS).
- Passwords are stored hashed; sensitive values (credentials, tokens, Memory secrets) are envelope-encrypted at rest.
- AI builds run in isolated, hardened sandboxes; an automated scan blocks any publication that would leak a stored secret.
- Access to production data is restricted to the operator of the service.
If a personal-data breach is likely to result in a risk to your rights, we will notify the Estonian Data Protection Inspectorate within 72 hours and inform you as required by Art. 33 and 34 GDPR.
9. Your rights
Under the GDPR you can, at any time:
- Access the personal data we hold about you (Art. 15);
- Rectify inaccurate or incomplete data (Art. 16);
- Erase your data ("right to be forgotten", Art. 17);
- Restrict processing (Art. 18);
- Receive your data in a portable format (Art. 20);
- Object to processing based on legitimate interest (Art. 21).
To exercise any of these rights, write to [email protected]. We answer within one month. If you believe your rights are not respected, you can lodge a complaint with the Estonian supervisory authority, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, Tatari 39, 10134 Tallinn, Estonia), or with the supervisory authority of your country of residence.
10. Changes to this policy
We may update this policy as the service evolves. Material changes are announced on the platform or by email before they take effect. The date at the top of this page always reflects the latest version.