Privacy Policy

The controller of your personal data is Piotr Kwak, a sole proprietor trading as Brisk, Polish tax ID (NIP) 8561845213, REGON 380514760 (hereinafter: “we”, “us”, “Controller”).

You can contact the Controller by email: contact@usebrisk.io.

• Brisk is the controller of the data you provide when creating an account or writing to us
• The Organization is the controller of the data it enters into the Platform (e.g. its customers, work orders, and protocols). Brisk processes that data on its behalf as a processor (Art. 28 GDPR)

When you use the Brisk platform (web and mobile app), we process:

• Account data: first and last name, email address, phone number, role in the Organization
• Organization data: company name, tax ID (NIP), address, billing details
• Work order data: order contents, notes, photos and attachments, and the Organization's customer data (entered by the Organization)
• Protocol signatures: the signature image only (details in section 4)
• Technician location: only under the rules described in section 5
• Technical data: system logs, IP address, device identifiers and push notification tokens, application error reports

When you write to us through the form on our site, we collect:

• First and last name: so we know how to address you
• Email address: this is where we reply
• Company name (optional): so the answer is specific
• The message itself
• IP address and the time you sent it: rate limiting and bot protection

Service protocols can be signed on the device screen (drawn signature). We store only the signature image (a PNG file) attached to the protocol.

We collect no biometric data: we do not record the dynamics, pressure, speed, or pace of the signature. The signature image is not used for biometric identification.

The mobile app may process the technician's location so that the coordinator can see the team's position on a map and plan work more efficiently.

• Location is processed only while you are logged in, from the start of travel or work on an order until it ends. This includes when the app runs in the background
• It requires system-level consent (iOS/Android). We only ask for “while using the app” — when tracking continues with the screen off, the phone shows it as a persistent notification (Android) or a blue indicator (iOS). You can revoke consent at any time in your phone settings
• The position is visible only to authorized people in your Organization

We process your data based on:

• Performance of a contract (Art. 6(1)(b) GDPR): providing the Platform services for your account and Organization
• Your consent (Art. 6(1)(a) GDPR): technician location, analytics cookies
• Legal obligation (Art. 6(1)(c) GDPR): accounting and retention of financial records
• Legitimate interest (Art. 6(1)(f) GDPR): replying to a message sent through the contact form, Platform security (bot and abuse protection), error monitoring, statistics, and service improvement

• Providing the Platform services: accounts, work orders, protocols, billing
• Sending notifications about work orders and Organization events (email, push notifications)
• Replying to messages sent through the contact form
• Security: bot protection, rate limiting, error monitoring
• Billing, payments, and invoicing
• Statistics and service quality improvement

We use trusted providers that process data on our behalf:

• Supabase: database, authentication, and file storage (EU-based infrastructure)
• Anthropic: artificial intelligence features, if the Organization enables them (details in section 9)
• Gladia: speech-to-text for dictation, and only in the browsers that cannot do it themselves (details in point 9)
• Vercel: application hosting and cookieless visit statistics
• Cloudflare: bot protection for public forms (Turnstile)
• Sentry: application error monitoring
• Expo: push notification delivery to the mobile app (onward through Apple Push Notification service and Firebase Cloud Messaging)
• PostHog: product analytics (EU servers, cookieless mode)
• Google Analytics: marketing site visit statistics (only after you accept all cookies)
• Mapbox: maps and geocoding of work order addresses
• Stripe: payment processing
• Fakturownia: invoicing
• Email provider: transactional email delivery

The Platform includes features built on a language model: work order summaries, quote drafts, creating a work order from the text of a message, an assistant the coordinator talks to in a chat panel, and tidying up a technician's note and listing the billable items in it. These features are DISABLED by default and are turned on by the Organization's owner or an administrator in the settings.

Once enabled, only the data needed to carry out the instruction is sent to the model provider:

Dictation works separately from the above. In Chrome and Safari the browser itself turns speech into text and the recording does NOT leave the device. In browsers that cannot do it — Brave disables its speech recognition engine, Firefox has none, and the installed app on iOS has one that does not work — the audio is streamed to Gladia SAS (France, infrastructure in the European Union), which returns the text alone. Recordings are stored nowhere: the stream passes through us and only the recognised text remains, which you see in the field before saving it anyway. Dictation is covered by the same AI features switch as the rest of this point.

• Work order content: title, description, notes, costs, dates, status, type, priority and device name
• The Organization's client name and the city of the work order
• Team names and the names of the technicians an instruction concerns
• In the assistant: whatever the user types into the chat panel
• When tidying up a technician's note: the text of that note along with the work order it belongs to
• When creating a work order from a message: the ENTIRE pasted text — if it contains contact details, an address or a tax id, those reach the provider with it
• We do not send photos, attachments, signatures, technician locations or billing data

We keep your data:

• Account data (name, email, phone): deleted 30 days after you ask to delete the Account (Settings → My profile → Delete account); until then the request can be taken back. Operational entries made in the Platform (work orders, notes, costs) remain with the Organization as its history, unlinked from the deleted Account
• Organization data: for the duration of the contract. The owner deletes the whole Organization in Settings → Organization → Delete company; the data is deleted 30 days after the request
• Financial records (invoices, billing data): for the period required by law (as a rule, 5 years)
• Contact form messages: up to 24 months from the last exchange
• Technical logs and error reports: for as long as we need them to keep the service secure and diagnose problems

You have the right to:

• Access your data: request a copy of your personal data
• Rectify your data: request correction of inaccurate data
• Erase your data (“right to be forgotten”): request deletion of your data
• Restrict processing: request limits on how your data is processed
• Data portability: receive your data in a format that allows transfer to another controller
• Object: you can object to processing based on our legitimate interest
• Withdraw consent: at any time, without affecting the lawfulness of processing before the withdrawal
• Lodge a complaint with UODO (the Polish Data Protection Authority, uodo.gov.pl)

Our site and Platform use the following technologies:

• Technical cookies (essential): login session and security; the Platform does not work without them
• Cookieless analytics: PostHog runs in memory-only mode (data is discarded when the tab closes). We do not build cross-session profiles or track you across other sites
• Analytics cookies (optional): Google Analytics 4 on the marketing site, only after you click “Accept all” in the banner. It sets _ga and _ga_* cookies (up to 2 years) that recognize your browser between visits; Google anonymizes the IP address. Without consent the Google script is never loaded.

We apply technical and organizational measures to protect your data:

• Encrypted connections (SSL/TLS)
• Secure storage in the database (Supabase with RLS)
• Regular backups
• Restricted access to personal data

We may update this Privacy Policy. The current version is always available on this page, with the date of the last update shown at the top. We announce material changes through a notice on the site or in the Platform. If a change concerns processing based on your consent, we will ask for your consent again.

If you have questions about personal data protection, email us at contact@usebrisk.io (subject: “GDPR inquiry”).