Privacy & Cookies Policy
Last updated: 3 November 2026
BYO Bridge is run by Byobridge, an individual sole trader in England. I am the "controller" of your personal data.
Contact: Rashwaab@gmail.com · Postal address: evelyn street · ICO registration number: TBC
The short version: we store as little as possible, your keys are encrypted, we never store your page content, and we use no analytics or tracking.
What we store, and why
| Data | Why | How it's kept |
|---|---|---|
| Email address | To send sign-in links and contact you about your account or billing | Plain text |
| AI provider API key and Notion integration token | To run edits you start | Encrypted (Fernet: AES with an HMAC integrity check). Decrypted only in server memory while a run you started is in progress. The dashboard only ever shows the last 4 characters. |
| Provider, model name, up to 3 prompt templates | To remember your settings | Plain text |
| Usage counts and run history | Your dashboard statistics and the free-run limit | Number of runs, blocks edited, estimated cost and credits saved, plus for each run: Notion page ID, template name, status, any error message, and the time |
| Plan status and Stripe customer ID | To know whether you're on Premium | Plain text. We never see or store card details. |
| Sign-in link records | Single-use email login | Your email and a hashed (not reversible) token |
| IP addresses | Rate-limiting and abuse prevention | Short-term only (see below) |
What we don't store
Your Notion page content and the AI's output are never saved. During a run, text from your page passes through our server's memory, goes to the AI provider you chose, is written back to your Notion page, and is shown to you. It is not written to our database or logs. We don't read, sell or analyse your data, and we don't use it to train AI models.
Who else handles your data
- Your AI provider (OpenAI or OpenRouter) receives the text of the blocks you edit. This happens under your own account with them, and their privacy policy applies.
- Notion receives our API requests, made with your token.
- Stripe processes payments as an independent controller under its own privacy policy.
- Resend, Inc. (USA) delivers sign-in emails.
- Render Services, Inc. (servers in Frankfurt, Germany) runs our server.
- Tailwind CSS CDN (cdn.tailwindcss.com): our pages load styling from it, so it receives your IP address and browser details, as with any web request.
Some of these companies are based in the US. Where your data goes outside the UK, it is protected by the safeguards those companies use, such as the UK–US data bridge or standard contractual clauses.
We use zero analytics, zero marketing pixels, zero advertising networks, and we never sell or share your data for marketing.
Our legal reasons for using your data
- Contract: running your account, your edits and your subscription.
- Legitimate interests: keeping the service secure, rate-limiting and preventing fraud.
- Legal obligation: keeping payment records for tax purposes.
How long we keep it
- Account data: until you delete your account.
- Sign-in link records: deleted within 24 hours.
- IP addresses used for rate limiting: deleted within 24 hours (normally within about an hour).
- Server backups: our host keeps daily disk snapshots for a limited period, after which they are overwritten.
- Payment records held by Stripe: as long as tax law requires (normally 6 years).
Delete Account: the right to be forgotten
Pressing Dashboard → Account → Delete account cancels any active subscription and permanently deletes your account from our live database straight away, including your encrypted API key and Notion token, templates, run history and usage counts. Nothing is kept in a "deactivated" state, and deleted data is overwritten in the database file rather than just marked as free. Copies in our host's disk snapshots are overwritten when those snapshots expire. Deleting your account doesn't erase the payment records Stripe must keep by law.
To be extra safe, we also suggest rotating your AI provider key and removing our integration in Notion (Settings → Connections).
Your rights
You can ask us for a copy of your data, or to correct, delete, restrict or transfer it, or object to how we use it. Email Rashwaab@gmail.com and we'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
Our site sets one cookie:
| Cookie | Purpose | Lasts |
|---|---|---|
session | Keeps you signed in and protects forms against forgery (CSRF) | 7 days, or until you sign out |
This cookie is strictly necessary for the service to work, so the law doesn't require consent for it and we don't show a cookie banner. We use no analytics, advertising or tracking cookies.
When you upgrade or manage your subscription, you're taken to Stripe's pages on stripe.com, which set their own fraud-prevention cookies under Stripe's cookie policy. Our own site doesn't load any Stripe scripts.
Children
The service isn't intended for anyone under 18.
Changes
If we make significant changes to this policy, we'll email you before they apply.