Privacy Policy

Last updated: 2026-07-01

What we process

Account data (email, name, billing details), operational metadata (device identifiers, sync timestamps, IP addresses for security logging) and support correspondence. File content and filenames are encrypted client-side and are not readable by us.

Why we process it

To provide the service (contract), to secure it and prevent abuse (legitimate interest), and to meet legal obligations. We do not sell data, run advertising, or build behavioral profiles.

Where it lives

EEA only: Tallinn (primary) and Frankfurt (replica). Sub-processors are listed in our DPA and bound by equivalent obligations.

Retention

Account data for the life of the account plus 60 days. Security logs for 12 months. Billing records as required by Estonian accounting law (7 years).

Your rights

Under GDPR you may access, rectify, export or erase your personal data, and object to processing. Write to privacy@bebralabs.io; we respond within 30 days. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Cookies

The marketing site uses no tracking cookies. The dashboard uses a single session cookie strictly necessary for authentication.