Privacy Policy
Learn how we handle your data through our comprehensive privacy policies.
Last updated: September 23, 2025
This privacy policy (the "Policy") describes how Polyware processes personal data in connection with the use of the BromeAI service available at https://brome.ai (the "Service").
1. Preamble and definitions
Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and French law No. 78-17 of January 6, 1978, as amended (Loi Informatique et Libertes).
For the purposes of this Policy:
- Personal data:
- any information relating to an identified or identifiable natural person (Art. 4.1 GDPR).
- Processing:
- any operation performed on personal data (Art. 4.2 GDPR).
- Data controller:
- the entity that determines the purposes and means of processing (Polyware).
- Processor:
- a service provider processing data on behalf of the data controller.
- EEA:
- European Economic Area.
2. Data controller and Data Protection Officer (DPO)
Data controller
Polyware, SAS with share capital of EUR 500. SIREN: 103 977 302. Registered office: 47 rue Vivienne, 75002 Paris, France. General contact: [email protected]
Data Protection Officer (DPO)
Name: Cédric Thierry. DPO contact: [email protected]
3. Categories of data processed
Polyware processes data that is strictly necessary for providing and improving the Service.
3.1. Identity and contact
- Last name, first name, email address.
- IP address.
3.2. Account and authentication
- Passwordless authentication (magic link via email) or OAuth (Google, Microsoft, GitHub).
- Data received via OAuth: last name, first name, email address, profile picture (avatar).
3.3. Content and history
- Prompts/messages, images, and files submitted.
- Generated responses.
- Usage history.
3.4. Payments and billing
- Credit card data processed and stored exclusively by Stripe (we do not have access to it).
- Payment/subscription metadata: Stripe customer ID, subscription ID, plan, status.
- Information necessary for issuing invoices and receipts in the personal area.
3.5. Telemetry and usage metrics
- Technical and usage data: browser (user agent), operating system, language, referring site, pages viewed, interaction events (clicks, etc.), timestamps, IP address, and approximate geolocation (inferred from IP, or more precise location if authorized).
- Measurement primarily via PostHog (product analytics), subject to your consent where required (see Section 10).
Important note: Polyware does not require and does not wish to receive sensitive data (Art. 9 GDPR). Please do not include such information in your prompts.
4. Purposes and legal bases
| Purpose | Examples of operations | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Providing the Service | Account creation/management, routing prompts to AI services, delivering responses, history | Performance of a contract — Art. 6(1)(b) |
| Payment & subscriptions | Billing, receipts, plan changes, fraud prevention | Performance of a contract — Art. 6(1)(b) / Legal obligation — Art. 6(1)(c) |
| Support & communications | Assistance, account security, important information | Performance of a contract — Art. 6(1)(b) / Legitimate interest — Art. 6(1)(f) |
| Security & continuity | Preventing abuse, spam, incidents, and ensuring availability | Legitimate interest — Art. 6(1)(f) |
| Measurement, analytics & attribution | PostHog (events), Refport (referral attribution), product improvement | Consent — Art. 6(1)(a) |
| Marketing / newsletter | Sending marketing information, product news | Consent — Art. 6(1)(a) or Legitimate interest — Art. 6(1)(f) |
| Legal obligations | Accounting, taxation, responses to authorities | Legal obligation — Art. 6(1)(c) |
Polyware does not sell personal data.
5. Recipients and processors
Processing may involve the following service providers (acting as processors — Art. 28 GDPR).
5.1. Hosting & network
- OVH SAS (application and database hosting, France)
- Cloudflare (R2 object storage, CDN, network security, anti-bot)
5.2. Payments & subscriptions
- Stripe Payments Europe, Ltd. (payment processing)
- Rebase, Inc. (d/b/a Autumn) (billing and subscription orchestration)
5.3. Authentication
- Google, Microsoft, GitHub
5.4. Attribution & analytics
- Refport (refport.co) (referral and affiliate programme management)
- PostHog (PostHog Cloud EU)
5.5. AI routing and inference
- OpenRouter, Inc. (routing of prompts to model providers)
- Mistral AI SAS (model inference, France)
5.6. Model providers
Reached through the routing provider and selected by you at the time of the request. They act as sub-processors.
- OpenAI
- Anthropic
- xAI
- Groq
- Cerebras
- Alibaba Cloud (Qwen)
- DeepSeek AI
- Black Forest Labs
- Perplexity
5.7. Search and media services
- Firecrawl (web search and page retrieval)
- fal.ai (image and video generation)
The canonical, maintained list of sub-processors — with the purpose, processing location, entity country and transfer mechanism for each — is published at brome.ai/legal/subprocessors together with a dated record of every change to it. That page is Annex III of the data processing agreement; the list above is indicative and may lag behind it.
Privacy note — AI services: To provide Service features (generation, comprehension, augmented search), prompts, search terms, images, files and instructions are transmitted to the relevant providers, for the sole purpose of producing the output you asked for. Polyware does not use your data to train, fine-tune or improve AI models, whether its own or a third party's, and configures its accounts with its inference and routing providers so that your data is not used for training, fine-tuning or product improvement. For every request sent to a compatible model, zero data retention is applied, so that neither the routing provider nor the model provider keeps the prompt or the response. Some models are not compatible with that mode; they are flagged as such in the interface before use, and on plans that allow it your organisation's administrator decides whether they can be used at all. Please do not include sensitive data in your prompts or searches.
6. Transfers outside the EEA
Data is hosted and processed within the European Union by default: the application and the main database at OVH SAS in France, object storage in Cloudflare's EU jurisdiction, Mistral AI inference in France, and product analytics in PostHog Cloud EU.
Some providers are established outside the EEA, or may process data there, particularly in the United States: OpenRouter and the model providers reached through it, Stripe (Ireland and the United States), Rebase (Autumn), and the search and media services. Polyware frames those transfers with the European Commission's standard contractual clauses, with the EU–US Data Privacy Framework where the entity is certified, and with the UK Addendum where it applies.
The mechanism relied on for each provider is stated, provider by provider, at brome.ai/legal/subprocessors. Further information is available from the DPO.
7. Retention periods
- Account, content, and history: for the duration of the account's activity.
- Account deletion, or end of the Service: data deleted within 30 days, or returned on written request made before that period expires.
- Encrypted backups: kept 30 days on a rolling basis, and deleted in any event within 90 days.
- Technical logs (administrative access and security events): 12 months.
- Accounting records: up to 10 years for legal obligations.
8. Security
Polyware implements appropriate technical and organizational measures: TLS 1.2 or above for all external traffic; encryption at rest for the database, object storage and backups; individual authentication with multi-factor authentication for administrative access; principle of least privilege with periodic review of entitlements; logical tenant isolation; separation of production and development environments, with no production data in test environments; denial-of-service and malicious traffic protection at CDN level; logging of administrative access and security events; automated daily encrypted backups with periodic restore testing; code review and dependency integrity checks; and patching according to severity.
No passwords are stored (authentication via magic link or OAuth).
A documented procedure covers detection, assessment, containment and notification. In the event of a high-risk data breach, Polyware will notify the competent authority and affected individuals in accordance with Articles 33 and 34 of the GDPR, and will notify affected business clients within 72 hours of becoming aware of it.
9. Marketing and communications
Polyware may send:
- Service communications (security, notifications, receipts, invoices).
- Marketing communications (newsletter, product news) with consent or on the basis of legitimate interest (soft opt-in).
You can unsubscribe at any time via the link at the bottom of each email.
11. Automated decisions
BromeAI does not make automated decisions producing legal effects within the meaning of Article 22 of the GDPR. AI-generated results require user judgment.
12. Rights of data subjects
You have the rights provided for in Articles 15 to 22 of the GDPR: access, rectification, erasure, restriction, objection, portability, withdrawal of consent (where applicable).
- Deletion: possible directly from the application.
- Portability: requests processed upon solicitation.
Exercising your rights: [email protected] (identity verification may be required). You may also file a complaint with the CNIL (https://www.cnil.fr).
13. Minors
In France, the Service is primarily intended for users aged 15 and over (or the legal age of digital consent applicable in the EEA). Outside the EEA, it is not intended for children under 13. Polyware may terminate any non-compliant account.
14. Amendments
Polyware may amend this Policy in the event of legal, technical, or organizational changes. In the event of a substantial change, information will be provided (notice in the application and/or email). The update date appears at the top of the document.
15. Contact
- General contact: [email protected]
- DPO: [email protected] (Cédric Thierry)
- Postal address: Polyware — 47 rue Vivienne, 75002 Paris, France