Privacy Policy

1. The short version

Not a substitute for the detail below, but the shape of it:

• Your conversations are not stored on our servers. Our usage records contain counts: tokens used, credits charged, which model and when. They hold no conversation content.
• Your conversations are sent to AI providers in order to produce an answer. That includes output from commands run on your servers. This is unavoidable for the product to work, and it is the thing to weigh most carefully.
• Your chat history lives on your own machine, not with us.
• Server credentials stay on your machine, encrypted at rest. We never receive them.
• We never send private key material to any AI provider, under any setting.
• Other secrets are redacted on a best-effort basis using pattern matching, which can miss things. See section 6. We would rather you knew.

2. Who is responsible

Brynko Technologies is the controller for the personal data described here. For privacy questions, contact [email protected]. Full contact details are at the foot of this page.

3. What we collect

Account data

• Your name and email address.
• A password, stored only as a one-way hash, so we cannot read it.
• If you sign in with Google: your Google account identifier, name, email address and profile picture URL, taken from the signed token Google issues. We do not receive your Google password, and we request no access to your Gmail, Drive or other Google data.
• Your workspace type (individual or organisation) and organisation name, if you give one.

Usage and billing data

• Per request: the model used, the number of input and output tokens, the credits charged, and the time. Not the text of the request or the response.
• Credit purchases, grants and balance history.
• A machine identifier and device name for each workstation you activate, so licensing works and so you can see which machines are active.

Technical data

• IP address and standard server log data when you use the website or our APIs, including for rate limiting and abuse prevention.
• Website analytics, see section 9.
• When you download the desktop app we record the download: the version, the time, your browser's user-agent string, the page you came from, and a one-way hash of your IP address rather than the address itself. The hash changes daily, so it lets us count downloads without identifying you or following you over time. No account or sign-in is involved, and we do not link a download to a customer.

Anything you send us

• Messages you submit through the contact form or by email, and their content.

4. Your sessions and your servers

This is what people most want to know, so it is stated directly.

• Conversation history is stored locally, in the application's data folder on your own computer. Deleting it there deletes it.
• Server and database credentials are stored locally and encrypted at rest on your machine. They are never transmitted to us. We could not produce them if asked.
• Connections to your servers are direct, from your machine to your server over SSH. Your server traffic does not pass through us.
• We do not store the content of your conversations on our servers. Our metering record has no field for it.

5. AI providers and what they receive

To answer a question, the application sends context to an AI model provider. That context can include your messages, details of the systems you have connected, and the output of commands run on your servers: for example configuration file contents, log excerpts, container listings and error messages. This is how the product produces answers grounded in real system state rather than guesswork, and it is the main privacy trade-off in using it.

Requests are routed to one of the following providers, depending on the task and model selected:

• OpenAI
• Anthropic
• DeepSeek

These providers process the content in order to return a response, under their own terms and privacy policies. Their handling of that data, including any retention for abuse monitoring, is governed by their agreements with us, and we recommend reviewing their policies if this matters to your compliance position. We do not control their infrastructure.

If sending system output to an AI model provider is not acceptable for a particular system, do not connect that system.

6. Secrets and redaction, and what it does not cover

The application tries to keep secrets out of what it sends. Being precise about how well:

• Private key material is never sent to a model provider under any setting.
• Credential directories and files are refused wherever they appear on disk, for example .ssh, .aws, .gnupg, .kube, .netrc, .pgpass and .git-credentials, plus any additional paths you restrict per server.
• Other secret values are redacted by pattern matching. This is best-effort. A secret in an unusual format, or one that does not look like a secret, can be missed. We do not claim otherwise.
• By default the agent can read configuration and environment values so that it can diagnose problems. An account-wide strict mode masks those values as well, at the cost of some diagnostic ability.

Because redaction cannot be guaranteed, the stronger control is access: connect with a dedicated user that holds only the permissions it needs, and set restricted paths for anything that must never be read. Our Security page explains how.

7. Why we process it

• To provide the Service: authenticate you, meter credits, run the features you use. (Performance of a contract.)
• To bill accurately and keep financial records. (Contract, and legal obligation.)
• To keep the Service secure: rate limiting, fraud and abuse prevention. (Legitimate interests.)
• To support you when you contact us. (Contract, and legitimate interests.)
• To improve the product using aggregate usage patterns, not conversation content. (Legitimate interests.)
• Analytics cookies, where you consent or where permitted in your jurisdiction. (Consent.)

We do not sell personal data, and we do not use your data to train AI models.

8. Who we share it with

We share personal data only with service providers who help us run the Service:

• AI model providers (OpenAI, Anthropic, DeepSeek), as described in section 5.
• Payment processor: to take payment. We do not receive or store your full card details.
• Hosting and infrastructure: for our servers and databases.
• Email delivery: to send transactional email.
• Analytics: Google Analytics, on this website.

We may also disclose data where legally required, or to establish or defend legal claims. If our business is transferred, data may transfer with it, subject to this policy.

9. Cookies and analytics

This website uses Google Analytics to understand which pages are useful. It sets cookies that collect information such as pages viewed, approximate location derived from IP, and the referring site. You can block cookies in your browser, or use Google's opt-out add-on, without losing access to the site.

We also use strictly necessary cookies and local storage to keep you signed in to the customer portal. These cannot be disabled without breaking sign-in. The desktop application does not use advertising cookies.

10. How long we keep it

• Account data: while your account is open, and for a reasonable period afterwards.
• Usage and billing records: as long as required for tax and accounting purposes.
• Server logs: a short period, for security and troubleshooting.
• Support correspondence: while needed to handle the matter and any follow-up.
• Conversation content: not retained by us at all; it lives on your machine and with the AI provider under their retention terms.

11. How we protect it

• Traffic to our services is encrypted in transit using TLS.
• Passwords are stored as one-way hashes.
• Sessions use short-lived access tokens with refresh tokens that can be revoked; changing your password or being blocked invalidates existing sessions.
• Server and database credentials are encrypted at rest on your machine, using the operating system's protection facilities where available.
• Access to production systems is limited to people who need it.

No system is perfectly secure, and we do not claim ours is. If you believe you have found a vulnerability, please report it to [email protected].

12. International transfers

We operate internationally, and our service providers (particularly the AI model providers) process data in countries that may differ from yours, including the United States. Where data is transferred out of a region with transfer restrictions, we rely on appropriate safeguards such as the European Commission's standard contractual clauses, or an equivalent mechanism.

13. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to processing, to receive it in a portable form, and to withdraw consent where processing relies on consent.

Exercise any of these by writing to [email protected]. We may need to verify your identity first. We aim to respond within 30 days.

Note that we cannot delete conversation content on your behalf, because we do not hold it, you can delete it directly in the application, and requests to AI providers are subject to their retention terms. If you are in the EEA or UK you also have the right to complain to your local data protection authority.

14. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We will update this policy as the product changes, in particular, if we add an AI provider or change what is stored, this page changes with it. The current version is always at https://cloudagent.brynko.in/privacy with the date it took effect. Material changes will be notified by email or in the application.

Other policies: Terms of Service · Privacy Policy · Refunds & Cancellation · Delivery · Contact us