Privacy Notice

Who is responsible for your data

Breno is software that can be run by anyone. Who controls the data therefore depends on which instance you are using, and the answer is the same for everyone in a workspace:

• An instance your organization operates — on its own servers, or on infrastructure it rents. Your organization is the data controller. It decides what is stored, who can reach it and how long it is kept, and it is the party to ask about access, export and deletion.
• An instance operated as a hosted service by [to be supplied], of No 6A, Old CBN Road, After House Of Assembly, Jos, Plateau State, Nigeria. In the language of the Nigeria Data Protection Act 2023, that entity is the data controller for this instance, and this notice is its notice.

If you are not sure which applies to you, the administrator of your workspace can tell you. The distinction matters, because it decides who you write to in order to exercise a right.

Data Protection Officer. Where the Act requires the operator to appoint one, the officer can be reached at [to be supplied]. Until that is filled in, write to contact@breno.ng and say that the message is for the Data Protection Officer.

What this site collects

The site you are reading is the marketing site. It collects very little, and most of what it does collect is described in the cookie notice rather than repeated here:

• Cookies. Four, all of them strictly necessary — three that hold a signed-in session and one that remembers the cookie choice you made. There is no analytics cookie, and no third-party cookie unless you load the map on the contact page (see below).
• What you type into the sign-up or sign-in form. Your name, email address and password, plus an organization name if you ask for an organization workspace. That form posts to this site’s own server, which forwards it to the API and never writes your password anywhere but the request in flight.
• What you type into the contact form. Your name, email address, an organization if you give one, what the message is about, and the message. The form posts to this site’s own server, which emails it to the contact address through an email provider and does not keep a copy of it. It is used to reply to you and for nothing else.
• The map on the contact page. It is not requested until you press “Load the interactive map”. Doing so connects your browser to Google Maps, which receives the usual details of a request (your IP address and browser information) and may set its own cookies. If you never press the button, nothing is sent to Google.
• Server logs. As on any web service, the server records the requests it answers: path, status, timing, the address the request came from, and a trace identifier for correlating them. These exist to keep the service up and to investigate abuse.

This site writes nothing to localStorage or sessionStorage, runs no analytics and no session recording, and loads no third-party script, font or embed other than the contact page’s map, which you have to ask for. Its own runtime dependencies are the web framework and that framework’s view library; there is no vendor code in the page at all.

What the product stores

Once you have an account, the application stores what it needs to be a memory layer. The list is not short, because the product is one that keeps things:

• Account details. Name, email address, workspace membership and role. Passwords are stored only as a salted hash. Where you sign in through a provider, the identifier that provider returns is stored and your password there is not.
• Content you put in. Documents you upload, notes captured through the API, and the derived data built from them: text chunks, embeddings, extracted entities and relationships, citations, and the questions you have asked.
• Content from sources you connect. When you connect a source such as Slack, GitHub, Notion or Drive, the instance reads what that source makes available to the credentials you granted, and keeps a copy with its provenance so the material can be searched and cited. You choose the sources. Disconnecting one stops future reads and leaves what was already ingested until you delete it.
• Connection credentials. OAuth tokens and API keys for connected sources, encrypted at rest. They are used only to read from the source you connected.
• Usage records. Which answers were generated, what they consumed, and which model provider served them — needed to know what the instance has spent.
• Audit records. An append-only log of administrative actions such as permission changes and deletions, so that those events survive the thing they describe.

What leaves an instance

This is the part worth reading closely, and it is the answer to the question people actually have: who else sees what I put in?

An instance keeps everything on its own infrastructure — documents, embeddings, the graph, memory records, audit logs. Exactly one class of traffic leaves it: the text needed to answer a question, and the text needed to compute an embedding, are sent to the model provider that the operator of that instance has configured.

• For a search or an answer, the retrieved passages the answer is built from are sent to that provider so it can generate the response and cite them.
• For ingestion, the text of an item is sent to that provider to compute the embedding that makes it searchable.
• Which provider that is — a hosted service, or a model running on the operator’s own infrastructure — is a configuration decision made by the operator. A self-hosted model means nothing leaves at all.

Your content is not used to train or fine-tune a model, and providers are not permitted to do so. Where a provider is used, material is sent for the purpose of answering that one request. If the instance has connectors, it also makes ordinary outbound requests to those providers’ APIs to read the sources you connected — that is the product working, and their own terms and privacy notices govern their side of it.

Why we may process it

The Nigeria Data Protection Act 2023 permits personal data to be processed only on one of six lawful bases, set out in section 25. The bases relied on here are these:

Whether you have to provide it. A name, an email address and a password are needed to make an account, because the service cannot be provided to someone who cannot be identified; without them you cannot use it. Everything you put into a workspace is your choice. Nothing here is collected because a law obliges you to give it.

Where a lawful basis is consent, you may withdraw it at any time and the processing stops — see your rights below. Withdrawing consent does not make unlawful anything done before it was withdrawn.

Under the Nigeria Data Protection Regulation 2019, whose principles the Act carries forward, processing is also bound by the ordinary rules: it must be for a specific and lawful purpose, adequate and not excessive for that purpose, accurate, kept no longer than necessary, and secured. The rest of this notice is largely an account of how each of those is met.

How long we keep it

• Items you delete go to the trash and are purged, along with everything derived from them, 30 days later. You can purge an individual item immediately instead of waiting.
• Sync history — the record of what each connection fetched and when — is kept for 30 days by default, and the most recent run for each connection is always kept.
• Finished sync jobs are kept for 90 days by default.
• Search history, answer traces and memory records are not swept on a timer. They stay until you delete them or delete the workspace, because they are what makes an answer reproducible.
• Audit records are kept for the period the operator sets. Their whole purpose is to survive the events they describe.
• A workspace under legal hold is exempt from the scheduled purges above until the hold is lifted.

The two windows marked “by default” are configuration, not constants: the operator of an instance can set them, so an instance you use may keep sync history for longer or shorter than this. The 30-day trash window and the exemption for legal hold are not configurable.

Deleting your account erases your personal data. Where you are the last owner of a workspace, the workspace and its content go with it. Content you shared into a workspace stays with the workspace, attributed to nobody, because deleting your account should not destroy other people’s records.

Who we share it with

Personal data is not sold, and it is not shared for advertising or for anyone else’s marketing. Beyond that:

• Model providers, as described under what leaves an instance — only the text needed for the request in hand.
• Sources you connect, in the ordinary course of reading from them. You chose each one.
• Infrastructure providers the operator uses to run the instance — hosting, object storage, database, and an email provider where account email is enabled and for delivering what you send through the contact form. The operator of your instance can tell you which.
• Where the law requires it. If a competent authority compels disclosure, the minimum necessary is disclosed, and the operator will tell you unless it is legally barred from doing so.

There is no third-party analytics processor, no advertising processor and no data broker in that list, because there are none in the product.

Sending data outside Nigeria

Everything an instance stores stays wherever that instance was deployed; a hosted instance runs in [to be supplied]. A self-hosted instance does not move anything across a border as a result of using Breno.

Two things can still cross a border, and both are the operator’s decision rather than a property of the software. The first is the model provider: if it is a hosted service outside Nigeria, the text of your request goes there. The second is a connected source whose own infrastructure sits elsewhere. Where that happens, the transfer is made on one of the grounds the Act allows — an adequacy finding, or safeguards such as a contract imposing the Act’s standards on the recipient — and the operator of your instance is the party that has to have put them in place. Ask them which provider and which sources are configured before you put material in that you would not want to leave the country.

Your rights

The Nigeria Data Protection Act 2023 gives you rights over your personal data, and they apply to this service. You have the right to:

• Be told what is being done with your data — which is what this notice is.
• See it. Ask whether your data is being processed and get a copy of it.
• Correct it where it is wrong or incomplete.
• Have it erased where there is no good reason for it to keep being held.
• Restrict or object to processing, including processing for direct marketing.
• Take it with you — receive your data in a portable, structured form, and have it sent to another service where that is technically possible.
• Withdraw consent at any time, where consent is the basis relied on.
• Not be subject to a decision made only by a machine where that decision has legal or similarly significant effects on you.

Section numbers are left out deliberately. Commentaries on the Act disagree about which section gives which right, and telling you the wrong number is worse than telling you none: the Act itself is the authority, and it is public.

Two of these you can exercise without asking anyone. Export is self-service and complete: a workspace export produces a file with your items, their sources and their relationships. Deletion is self-service too — individual items, or your whole account, from the product. For the rest, write to the contact below and expect an answer within 30 days, which is the period the Act sets. If a request is complex, that period can be extended, and you will be told why.

These rights are not absolute. A request can be refused where the law requires the data to be kept, or where granting it would override somebody else’s rights — the obvious case being a document in a shared workspace that is not yours alone. Where a request is refused, you will be told which ground was relied on.

How it is protected

• Passwords are stored as salted hashes, never as text.
• Session tokens live in cookies the page’s own scripts cannot read, so a script injected into a page cannot take a session by reading one.
• Connector credentials are encrypted at rest with AES-GCM, under a key the operator holds.
• Tenancy is enforced in the database itself with row-level security, not only in application code — so a query that forgot to scope itself to a workspace still cannot return another workspace’s rows.
• Every read path goes through one shared access rule and every mutation through one shared write rule. Access decisions are never made by a language model.

No system is perfect, and no honest notice claims otherwise. If a breach occurs that is likely to result in a risk to your rights, the operator will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the Act requires, and will tell you without undue delay where the risk to you is high.

Children

Breno is a workplace product and is not directed at children. It is not intended for anyone under 18, and personal data from anyone under 18 is not knowingly collected. If you believe a child’s data has been put into an instance, contact the operator and it will be removed.

Changes to this notice

When this notice changes materially, the date at the top changes and workspace administrators are told before the change takes effect. Continuing to use the instance after that means you accept the updated notice. Earlier versions are not published; the change and its date are, and you can ask for what changed.

How to complain

Start with the operator — for an instance your organization runs, that is your workspace administrator; for a hosted instance, it is the address below. Most problems are solved there, and the Act expects you to give the controller the chance.

If that does not resolve it, you have the right to lodge a complaint with the Nigeria Data Protection Commission, the regulator established by the Act. Its site is ndpc.gov.ng. You may also have a remedy in court. Nothing in this notice takes either of those away.

Contact

Privacy questions and requests to exercise a right: contact@breno.ng. If your organization operates the instance you are using, write to your workspace administrator first — they can answer most questions about what that instance stores and who can reach it, and they are the controller.

The application’s own notices, which cover the interface rather than this site, are at app.breno.ng/privacy.