privacy policy

last updated 2026-08-17 · briven.tech

This Privacy Policy explains what personal data the briven Service (briven.tech and any subdomain) collects, why, and what you can do about it. The Service is operated by flndrn Limited (the “Operator”, also the data controller for the purposes of the EU General Data Protection Regulation), a company registered at Arch. Makariou III 171, Vanezis Business Center 4th floor, 3027 Limassol, Cyprus. Day-to-day development takes place in Flanders, Belgium. For brand and legal context see the Terms of Service.

1. what we collect

We process the following categories of personal data:

• Account data — email address (required) and display name (optional). Sign-in to the dashboard is email and password, plus one-time codes sent to that email address. There are no social sign-in providers, so we hold no third-party identity or avatar for you.
• Project and database metadata — the names you give organisations, projects and databases, which plan a database runs on, its region and status, and an audit log of actions taken in your organisation (who did what, when).
• Stored credentials — the connection credentials for the databases we create for you, encrypted at rest with AES-256-GCM. API keys are never stored at all: we keep only a SHA-256 hash and a short display suffix, so a key you lose cannot be read back out of our database by anyone, including us.
• Operational telemetry — request paths, response codes, and latency on the API and dashboard. We use these to debug, and to record the metering samples that usage is billed from: storage GB-months, compute unit hours, and egress bytes.
• IP-derived identifiers — your IP address is hashed with a server-side pepper at the moment a request is logged. The plaintext IP is never written to disk. The hash is what appears in the audit log; it lets us correlate sessions for security investigations without de-anonymising you.
• Billing data (when you use a paid plan) — your billing email address. No payment processor is engaged yet, so no card token exists today; when one is engaged (see subprocessors) the processor will hold the card data and we will store only its token. We do not store card or bank-account details on briven infrastructure.

2. what we do not collect

• The contents of your database. We operate the PostgreSQL instances, the connection pooler and the object storage; we do not read your tables, your rows, or your objects outside of the support paths you explicitly authenticate.
• Third-party advertising cookies, marketing trackers, or session-replay tools. briven.tech ships zero analytics scripts to your browser.
• Plaintext IP addresses, browser fingerprints, or device identifiers for advertising purposes.

3. why we process it

The legal bases for processing under GDPR Article 6 are:

• Contract (Art. 6(1)(b)) — to provide you the Service you signed up for: hosting your PostgreSQL databases, pooling the connections to them, serving your object storage and your dashboard.
• Legitimate interests (Art. 6(1)(f)) — security, abuse prevention, and operational debugging. The audit log and IP hashing fall under this basis.
• Legal obligation (Art. 6(1)(c)) — when a court order, regulatory subpoena, or DSA/DMA disclosure requirement compels us.
• Consent (Art. 6(1)(a)) — currently used only for optional product announcements; you can decline at sign-up and withdraw any time without affecting your access to the Service.

4. who we share with

We share data only with the third-party processors listed at briven.tech/subprocessors. Each one is bound by a data-processing agreement that limits them to the purpose for which we engage them. We do not sell personal data and do not rent it to advertisers. We disclose data to law enforcement only when required by binding legal process and we challenge over-broad demands where we can.

5. retention

• Account data — kept while your account is active. After account closure: 30-day soft-delete window during which you can restore, then permanent erasure.
• Project and database data — same: 30-day soft-delete after you close the project, then permanent erasure from the live store.
• Audit logs — 13 months, then rotated. Required so we can investigate security incidents that surface late.
• Metering samples — the storage GB-months, compute unit hours and egress bytes recorded per database are kept for 13 months, so an invoice can be reconstructed and disputed, then rotated.
• Backups — the Operator does not currently operate customer-facing backups of customer databases. A deletion request therefore runs against the live store and there is no backup copy waiting to age out. It also means recovery is your responsibility: take your own pg_dump over your normal connection. See the Trust page for what the platform does and does not offer.

6. security

TLS on every public endpoint; AES-256-GCM for stored database credentials at rest; passwords hashed with a memory-hard key-derivation function and never stored in plaintext; SHA-256 for API key hashes, compared in constant time so a comparison cannot be timed to recover a key. SSH access to the host is key-only; root-password authentication is disabled. Dependency updates roll weekly. No system is ever fully secure; if you discover a vulnerability, please email security@flndrn.com rather than disclosing publicly.

7. international transfers

Your data is hosted on a single EU-hosted server. Some of our subprocessors are located outside the EU; transfers to those processors rely on Standard Contractual Clauses approved by the European Commission, supplemented where appropriate by additional technical and organisational measures (encryption at rest and in transit, minimisation of data shared with each processor). The subprocessors page notes the location of each processor.

8. your rights

Under GDPR and equivalent laws, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data — organisation and profile fields are editable in the dashboard under Settings; anything else, ask us;
• erase your data — email privacy@flndrn.com from the address on the account. We confirm receipt, soft-delete your projects, databases and sole-owner organisations, revoke your API keys, and clear your personal details from our control plane. After the 30-day reversal window the record is hard-deleted and the data is unrecoverable. Multi-owner team organisations survive (you are removed from membership instead);
• port your data — your data is in standard PostgreSQL, so a standard pg_dump over the same connection string your application already uses produces a complete, portable copy. There is no proprietary format to escape from;
• restrict or object to a specific processing purpose;
• withdraw any consent you previously gave;
• complain to your local data protection authority. The Operator’s lead supervisory authority is the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).

To exercise any of these rights, email privacy@flndrn.com. We answer within 72 hours and resolve within 30 days, extendable by 60 days for complex requests (we will tell you).

9. cookies

briven.tech sets first-party cookies only, and only to keep you signed in:

• briven.session_token — your sign-in session, HTTP-only and sent only to briven.tech and its subdomains. Cleared on sign-out or when the session expires.
• plus the short-lived cookies Better Auth sets to complete a sign-in, which are cleared once the sign-in finishes.

We do not set advertising or analytics cookies. There is no consent banner because there is nothing to consent to that we don’t already need to operate the Service.

10. children

briven is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has signed up, contact us and we will erase the account.

11. updates

Material changes to this policy will be announced on this page and emailed to the address on your account at least 30 days before they take effect. The “last updated” date at the top of this page reflects the most recent version.

12. contact

Privacy questions and rights requests: privacy@flndrn.com. We answer within 72 hours.