Privacy Policy

1. Who's responsible for your data

The data controller is DATA SWEEP S.R.L., EUID ROONRC.J2024022622006, registered office at Piața Emanuil Gojdu 41, Building I, ground floor, Oradea, Bihor County, Romania.

For any question, or to exercise your rights, email cosmin.botoroga@datasweep.app. We haven't appointed a Data Protection Officer (we're not required to), so the team answers you directly at this address.

2. What data we process

• Account data: name, email address, date of birth (to check the minimum age), preferred language, password (stored only in encrypted form) and, if you sign in with Google or Apple, the name and email from that account.
• Profile: your photo, leaderboard name, status (high school, university…), school and faculty if you add them, and your settings (for example, whether classmates can see your scores).
• What you upload and do on Brioly: materials (PDFs, text, photos of pages, figures from books), handwritten papers you photograph during practice exams, generated tests, summaries, maps, flashcards, podcasts and plans, your answers, scores, XP, coins, streak, study plan, flashcard reviews, groups, assignments, challenges, communities and My World.
• National practice exams: your sign-up, participant code and result.
• Talking to us: messages you send the team ("Talk to a human"), suggestions, feedback form answers and questions you report. We use messages to the Brioly assistant in the chat only to answer you and don't keep them.
• Notifications and emails: in-app notifications, your device token (if you allow push notifications in the mobile app) and a log of emails sent, so you never get the same email twice.
• Invites: your invite code and who signed up with it, so we can give out the bonuses.
• Consents: when you accepted the terms and acknowledged this policy, your newsletter choice, your cookie choice and any unsubscribes.
• Competition winners: name, email and the details the law requires to pay prizes and report the tax on them.
• Technical data: IP address, browser and device type, security logs, the anti-bot check (Cloudflare Turnstile) and strictly necessary cookies. Browser errors are counted without anything that identifies you (only the error message, the page without its parameters and the browser type).
• Usage data: key steps in the app (like "opened the upload" or "picked a file"), logged once a day, with no content. Only if you accept analytics cookies: pages visited, clicks, scrolling and device type, through Google Analytics, Microsoft Clarity and PostHog; your text is masked in these recordings.

3. Why we process it and on what legal basis

• Your account, AI generation, practice exams and paper grading, groups, communities, in-app notifications, emails about your account and activity, downloads and progress: performing our contract with you (GDPR Article 6(1)(b)).
• Checking the minimum age, security, preventing abuse and cheating (for example, multiple accounts), automatically checking content shared with your school and our internal stats on app steps, to see where people get stuck: our legitimate interest (Article 6(1)(f)). You can object at any time.
• Download marks: PDF and Word files you download or print from Brioly carry your profile name, the date and a download code in the footer; the code is also hidden in the text. It's derived from your account ID, so we don't store any extra data about your downloads. We only use it to find which account a copy published without permission came from – our legitimate interest in protecting our content (Art. 6(1)(f)). You can object, but downloads stay marked.
• Option order and copy monitoring: in questions from our banks, the order of the options differs from one account to another, and the explanations carry the same hidden code; the order is derived from your account ID and isn't stored. To spot bulk copying, we keep a log of downloads (account, type, material, date) for 12 months, and an automated check sends the team any accounts that answer, start tests or download far more than someone studying would. No automated decision is taken: a person on the team reviews every case. The legal basis is our legitimate interest in protecting our content (Art. 6(1)(f)).
• Onboarding emails (getting started, your weekly summary, streak reminders): our legitimate interest in helping you use the service; you can unsubscribe in one click from any email.
• The newsletter with Brioly and DATA SWEEP news, resources and events, and push notifications on your phone: your consent, which you can withdraw at any time (Article 6(1)(a)).
• Stats through Google Analytics, Microsoft Clarity and PostHog: your consent to analytics cookies (GDPR Article 6(1)(a) and Article 4 of Romanian Law 506/2004).
• The monthly competition and prizes: joining is optional and based on your sign-up (Article 6(1)(b)); winners' tax details: legal obligation (Article 6(1)(c)).
• Legal, tax and accounting obligations and replies to authorities: legal obligation (Article 6(1)(c)).

We don't sell your data, use it for targeted ads or use it to train AI models.

4. AI and automated decisions

To create tests, summaries and podcasts and to grade papers, we send AI providers only the text of the pages you picked (or the photos of your paper or of scanned pages), without your name or email. Under their contracts, the providers don't use this data to train their models and may keep it only briefly, to prevent abuse.

Grades for written papers and the automatic check of content shared with your school are decided by AI. They have no legal effect on you, but if you disagree with a result you can ask for a second grading or contact the team, and a person on our team will look into it.

We use your results to suggest what to review (your study plan, the daily recap, questions you got wrong). We don't profile you for marketing.

Every morning, AI looks at aggregate numbers on how Brioly is used and at feedback answers (without people's names or emails, and excluding the team) to suggest improvements that the team then approves.

5. Who sees and who receives your data

Your group members see your name and photo, what you share in the group and, unless you hide them in your profile, your scores on group tests. A teacher who gives you an assignment sees whether you did it and your score. On leaderboards you appear only under your leaderboard name or participant code, if you join. Classmates can visit your world only if you make it public.

We use providers that process data only on our behalf, under contract (processors):

• Supabase: database, sign-in and files (servers in the EU, in Frankfurt).
• Vercel: hosting the app (functions run in Frankfurt).
• Anthropic and OpenAI: AI for tests, summaries, grading, reading scanned pages, content checks and the chat assistant (OpenAI also as a backup when Anthropic is unavailable).
• ElevenLabs and OpenAI: podcast voices (they receive only the podcast script).
• Resend: sending emails.
• Cloudflare: the anti-bot check (Turnstile) and file backups (R2, in the EU).
• Apple (APNs) and Google (Firebase Cloud Messaging): delivering push notifications, if you allow them.
• Google and Apple: sign-in, if you choose to use them.
• Google (Analytics), Microsoft (Clarity) and PostHog (EU): stats, only if you accept analytics cookies.

We share data with authorities only when the law requires it.

6. Transfers outside the EU

Some providers (such as Anthropic, OpenAI, ElevenLabs, Resend, Vercel, Google, Apple and Microsoft) may process data outside the European Economic Area, mainly in the US. We rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses, together with extra safeguards (encryption, sending only the data that's needed).

7. How long we keep data

• Your account, content and progress: for as long as you have an account. When you delete your account from your profile, we delete them right away, including files, photos and podcasts.
• Backups: Supabase copies the database daily (copies are kept for 7 days) and files are copied every night to Cloudflare R2, in the EU. Anything you delete is gone from the backups within 30 days.
• Photos of scanned pages: deleted as soon as the AI has read them (we keep only the text).
• Messages to the team, suggestions and reports: as long as needed to handle them, then up to 2 years, so we can show what happened.
• Push notification tokens: until you uninstall the app or the token stops working; they're deleted with your account in any case.
• App steps and the email log: up to 2 years. Technical errors: aggregated, with nothing that identifies you.
• Newsletter consent: until you withdraw it; proof of consent, for as long as we may need to show it.
• Winners' tax details: as long as tax and accounting law requires.
• Security logs: for a short time, as long as needed for security.

8. Minimum age

Brioly is for people aged 16 and over, the age at which you can consent to online services yourself in Romania. We don't knowingly create accounts for younger people; if we learn of one, we delete it.

9. Your rights

You have the right to access, correct and delete your data, to restrict processing, to data portability and to object (including to processing based on our legitimate interest), the right not to be subject to a decision based solely on automated processing that significantly affects you, and the right to withdraw your consent at any time, without affecting processing that happened before.

You can do a lot of this right in the app: edit your details and settings in your profile, unsubscribe from any email, change your cookie choice from the page footer, download what you've made (the Download button) and delete your account. For anything else, email us; we reply within one month.

You can also complain to Romania's data protection authority, ANSPDCP (www.dataprotection.ro).

10. Security

We use encrypted connections (HTTPS), encrypted passwords, per-user data access (Row Level Security), private files reachable only through temporary links, an anti-bot check and restricted internal access. If there's a data breach, we notify ANSPDCP within 72 hours and tell you if there's a high risk to your rights.

11. Cookies

We use cookies that are strictly needed for the app to work and, only with your consent, analytics cookies. You can change your choice anytime from "Cookie settings" in the page footer. See the Cookie Policy for details.

12. Changes

If we change this policy, we'll update the date above and tell you about important changes in the app or by email before they apply.