Privacy Policy
Last updated: September 18, 2026
This policy explains what personal data Rocket Social collects when you use Brigata, why, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and French data protection law.
1. Who is responsible
The controller is Rocket Social, SAS (société par actions simplifiée), RCS Lyon 832 329 445, 26 chemin de Chalin, 69130 Écully, France. For any question about your data, write to support@brigata.co.
When your workspace processes personal data about other people on your behalf (for example your customers’ support messages or your users in an analytics tool), you are the controller of that data and we act as your processor.
2. What we collect
- Account data: your name, email address and password (stored hashed).
- Billing data: your name or company details, billing address, VAT number where you have one, and subscription history. Card details are handled by our payment provider and never stored by us.
- Workspace data: what you tell the agents and what they produce, including the website and business information you provide, chats, tickets, tasks, reports and memory files.
- Credentials you connect: the login credentials of the AI subscriptions (Claude, ChatGPT) and the access tokens of the tools you connect to a workspace. They stay inside that workspace, are used only to run your agents, and are deleted with it.
- Data from connected tools: whatever the agents read in the tools you connect, within the permissions you grant.
- Technical data: server logs, IP addresses, device and browser information, and a push notification token if you use the mobile app.
- Correspondence: the emails you send to support.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the service, including running your agents | Performance of our contract with you |
| Billing, invoicing and accounting | Contract, and our legal obligations |
| Keeping the service secure, preventing abuse and fixing problems | Our legitimate interest in operating a secure, reliable service |
| Answering support requests and telling you about changes to the service | Contract and legitimate interest |
| Responding to legal requests and enforcing our Terms | Legal obligation and legitimate interest |
We do not sell personal data, we do not use it for advertising, and we do not use your workspace data to train AI models.
4. AI providers
Your agents send prompts containing workspace data to the AI provider of the subscription they run on (Anthropic for Claude, OpenAI for ChatGPT). That processing happens under your own account with that provider and is governed by your agreement with them, including their data retention and training settings, which you control from your account with them.
5. Who we share data with
We rely on the following service providers, bound by data processing agreements, to run Brigata:
| Provider | What for | Location |
|---|---|---|
| Vercel Inc. | Hosting of the website and dashboard | United States |
| Hetzner Online GmbH | Hosting of the application server | Germany |
| MongoDB, Inc. (MongoDB Atlas) | Database for accounts and workspace settings | Cloud hosting |
| DigitalOcean, LLC | Hosting for each workspace and its agents | Netherlands |
| Stripe Payments Europe, Ltd. | Payments, invoicing and billing | Ireland |
| 650 Industries, Inc. (Expo) | Delivery of mobile push notifications | United States |
The tools you connect to a workspace receive the data the agents send them at your instruction. We may also disclose data where required by law or to protect our rights.
6. Transfers outside the European Union
Some providers are located in, or may access data from, the United States. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
7. How long we keep it
- Account and workspace data: while your account is active. When a subscription ends, the workspace and its data are deleted 30 days later.
- Invoices and accounting records: 10 years, as required by French commercial law.
- Server logs: up to 12 months.
- Support correspondence: 3 years after our last exchange.
8. Security
Each workspace is isolated from every other one. Access to our systems is restricted and authenticated, connections are encrypted, and passwords are hashed. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
9. Your rights
You can ask to access, correct or delete your personal data, to receive it in a portable format, to restrict or object to its processing, and give instructions about what happens to it after your death. Write to support@brigata.co; we answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
10. Cookies
Brigata does not use advertising or analytics cookies. We only store what is strictly necessary to keep you signed in, which does not require consent.
11. Changes
We may update this policy and will tell you by email about significant changes before they take effect.