At a glance
- We do not sell your data, show you advertising, or track you across apps.
- Each organisation’s data is walled off from every other’s, and the walls are tested on every release.
- Hosted in Switzerland and France. Two services involve the United States — the Studio AI and our account emails — and we say below exactly what they see.
- You can see what we hold without writing to anyone: sign in and open your account.
- No decision about you is made by an algorithm on our side.
1.Your situation
In short Who is responsible for your data depends on how you meet us. Pick the description that fits; each one answers the same questions in the same order.
1.1 If you use an app built on Bricks
Who is responsible — three answers, because three things are happening. Your BricksID account, the identity you sign in with, is ours: Bricks is the controller. What an app collects about you belongs to the organisation whose app it is — your club, school, employer or supplier: that organisation is the controller, and Bricks is its processor. For the link between the two — using your BricksID to sign in to that organisation’s app — the organisation and Bricks are joint controllers (Article 26 GDPR): Bricks answers for the sign-in and your membership record, the organisation for whom it lets in and in which role.
What Bricks processes about you
| Why | What | Legal basis | How long |
|---|---|---|---|
| Your BricksID account: signing you in and keeping your sessions safe | Email, name if you give one, hashed password, sign-in history, active sessions | Contract — Art. 6(1)(b) | Until you close your account (see below) |
| Knowing which organisations you belong to | Membership, role, when you joined | Contract — Art. 6(1)(b); joint with the organisation | As long as the membership exists |
| Security and abuse investigation | IP address, browser identification, address requested (gateway logs) | Legitimate interest in network security — Art. 6(1)(f), Recital 49 | 30 days (see known gaps) |
| Remembering your language | One cookie holding the language you chose | Strictly necessary for a feature you asked for; no consent needed | 1 year |
Where it comes from: from you, or — for your email address — from the organisation that invited you. An email address is necessary to have an account; nothing else is.
What the organisation’s app processes
Your profile in its system, content you write, your interactions with its service. That organisation decides what is collected and why, and its own notice applies. Two apps run by two organisations are two fully separate sets of records, even if you use the same BricksID for both. Under My organisations, each organisation shows you its processing — the automated steps its apps run on your data, drawn from their actual configuration — and its data protection page, built from its register of processing activities.
Closing your account
You can ask to close your BricksID from /account/close. After you confirm by email, a person at Bricks checks the request. Closing then does three things, in this order: every organisation you belong to receives an erasure request for its own records, on which it decides as their controller; you receive an email listing those organisations and how to reach them; and your identity is scrubbed — name and email removed, every session ended. Records the law obliges us to keep, such as invoices, stay attached to a key that no longer identifies you. The email also carries a one-time recovery key that lets you see what was kept.
1.2 If your organisation builds on Bricks
Who is responsible. It depends on what the data is about. For your own account and your use of the platform, including the Studio AI, Bricks is the controller. For data about the organisation itself — who belongs to it and in which role, its accounting and billing records and its credit wallet — Bricks and the organisation are joint controllers (Article 26 GDPR), sharing responsibility as set out below. The organisation remains the controller of whatever its apps collect from the people who use them; there, we are its processor and the Data Processing Agreement governs us.
What we process about you
| Why | What | Legal basis | How long |
|---|---|---|---|
| Running your account and your organisation | Account, organisation, who holds which role | Contract — Art. 6(1)(b) | For the life of the account |
| Billing, the credit wallet and invoices | Billing name and address, VAT number, purchases, balance, invoices | Contract — Art. 6(1)(b); accounting and tax law — Art. 6(1)(c) | As long as Belgian accounting and tax law requires |
| Measuring and charging Studio AI use | Your conversation, the model that answered, token counts, amount charged | Contract — Art. 6(1)(b): a metered service cannot be billed without being measured | Conversations until you delete them; charges with the billing records |
| Keeping the service secure, intact and restorable | The records above, and security logs | Art. 6(1)(c) — Article 32 requires it; legitimate interest in security, Recital 49 | As for the underlying record |
| Keeping the platform working well | How models, prompts, caches and capacity perform — the system, not you | Part of providing the contracted service — Art. 6(1)(b) | As long as useful for calibration |
| Commercial follow-up, if you contacted us or we met | Name, professional email, company, our exchanges — in our self-hosted CRM | Legitimate interest — Art. 6(1)(f); you can object at any time | At most 3 years after our last contact |
We keep only what those purposes need, and where the link to your identity is not itself the point we pseudonymise: records carry a stable account key rather than your name copied across every table (Articles 4(5) and 32(1)(a)).
Who else receives it
- Mollie (Netherlands) processes payments; Cabai (Raspberry Design SRL, Belgium) issues our invoices.
- Anthropic (United States) answers Studio AI requests — section 2 says exactly what it receives. If you choose the Mistral preset, inference runs at Scaleway in France instead.
- Our hosting and email providers, listed in Annex III of the Data Processing Agreement.
Data about your organisation: who does what
Because Bricks and the organisation decide together why and how these records are kept, the GDPR makes us joint controllers and requires us to tell you how we share that responsibility:
- The organisation decides who its operators are and which roles they hold, and provides its billing details. It keeps them accurate and informs its own operators that these records exist.
- Bricks keeps these records secure, and uses them only to provide, invoice and account for the service and to meet its own legal obligations, including accounting and tax record-keeping.
- You can exercise your rights with either of us. Write to simon@bricks-softwares.com; where a request concerns something only the organisation can decide, such as your role, we pass it on to its administrator.
One account per person, and test accounts
A BricksID belongs to one person, and each person holds one. For server-to-server connections and other access that is not a person’s, the platform provides dedicated access means, so integrations never need extra identities. You may create accounts to test your apps. Once a human check establishes that an account was created for testing and matches no real person, we do not treat it as a person’s account. Test accounts are not linked to your real account: deleting or correcting your own account does not delete or update them, so remove them yourself when you no longer need them. If a test account uses an address that identifies you, that address remains your personal data.
1.3 If we contacted you as an investor
Who is responsible. If we wrote to you about investing in RainbowTop Softwares, we are the controller of that campaign: we decided to run it, and we approve what is sent. Where a contact comes from the existing investor network of our advisor Awake Partners, that network is theirs and remains theirs — for the outreach itself we act as joint controllers with them (Article 26 GDPR), each answering for its own database. The technical provider they work with, By Joliment (Jean-Li Sek), acts as a processor: it sends on our behalf and decides nothing about who is contacted or what is said.
What we process, and why
| Why | What | Legal basis | How long |
|---|---|---|---|
| Finding investors for the Bricks platform | First and last name, professional email, company, role, public LinkedIn profile | Legitimate interest — Art. 6(1)(f), weighed below | The campaign, then at most 3 years after our last contact |
| Following up | Whether a message was opened or a link clicked; your replies and our exchange | ||
| Not contacting you again once you object | Your address on an objection list, and nothing else | Legal obligation to honour the objection — Art. 6(1)(c) | As long as needed to honour it |
Where it comes from: the investor network of Awake Partners and public professional sources. Our provider declares the origin of every list before it is used, and we do not accept data extracted from a platform whose terms forbid it. We process no special categories of data, and nothing about your private life.
Why legitimate interest holds: we write to you in your professional capacity, about a subject that falls within it, at a professional address, and we say who we are and where we got your details. Rules on unsolicited electronic communication also apply, and we ask our provider to comply with those of your country. You can object at any time — a one-line reply is enough, no justification needed, and it is applied immediately across every domain and tool we use.
The sending domain
The emails come from rainbowtop.eu, a domain RainbowTop Softwares SRL owns and keeps in its own registrar account (OVH, France). For the campaign its DNS is operated by By Joliment, which also runs the mailboxes and the sending. We can take the domain back at any time, and it is used for nothing else.
Who operates what, and where your data goes
| Tool | Role | Your data it sees | Where, and under what safeguard |
|---|---|---|---|
| Cloudflare, Inc. | DNS of rainbowtop.eu | None of the campaign data: DNS holds the domain’s technical records. | United States. Cloudflare participates in the EU–US Data Privacy Framework. |
| Google Workspace (Google Ireland Limited, Google LLC) | The mailboxes on the domain | Your address, our messages, your replies | Ireland, with transfers to the United States under Google’s Cloud Data Processing Addendum and the Standard Contractual Clauses. |
| Smartlead (521 PRODUCTS PTY LTD, Australia) | Sending, mailbox warm-up, tracking replies | The contact list and the engagement data above | Outside the EEA — the United States, Australia, Europe and India — under the Standard Contractual Clauses in Smartlead’s data processing addendum. |
This list is the whole of it. Our provider tells us before adding a tool, and this page is updated when one is added.
What we will not do
- We do not sell or rent your details, and we do not pass them to other companies raising money.
- We do not build a profile of you beyond what is described above.
- We do not write in the name of a person who does not exist: a real person signs, and we approve every message before it is sent.
To be removed, reply to any message or write to simon@bricks-softwares.com. Your other rights are in section 5.
2.How your data is protected
In short Whoever you are, these hold. Each is checked, not just promised; the full technical list is Annex II of the Data Processing Agreement.
- Each organisation’s data is isolated from every other’s. Each has its own database area, and the platform cannot construct a query that crosses that boundary. Inside an organisation, who sees which record follows its own role rules, enforced by the database itself. Checked by an automated test over every organisation, on every release.
- Encrypted in transit and at rest. Everything is served over HTTPS; our servers’ disks (Infomaniak, Switzerland) and the managed database and file storage (Scaleway, France) are encrypted at rest.
- No third-party scripts in apps. Apps cannot load code, fonts or stylesheets from other companies. Any outside service an app contacts has to be declared by the organisation — vendor, purpose, data, legal basis — and anything undeclared is blocked by your browser.
- Risky changes are backed up first. Before a destructive change to an app’s database, the platform snapshots that app’s data and shows a maintenance page while the change runs.
- What the Studio AI sees. The AI that helps an organisation build its app works from the app’s structure — tables, workflows, roles, code — and the builder’s own messages. These go to Anthropic (United States), or to Mistral at Scaleway (France) if the organisation chose it. It does not browse the app’s records, with two narrow exceptions: it can read the last few submissions a workflow received, only after telling the builder and waiting for their go-ahead; and in its advanced mode it can open a published page as an anonymous visitor would, seeing only what is public anyway. Anthropic does not train its models on this data, and no identifier of yours is attached to the requests.
- Staff access is logged. Bricks staff cannot sign in as you; access to an organisation’s infrastructure for support is logged and needs a documented reason.
3.What we will never do
- Sell your data, or rent it.
- Track you across apps for advertising or analytics.
- Turn your usage into a behavioural or work-performance profile. The data could technically support it — “how many hours did this person spend”, “how active are they” — and we treat it as an excluded purpose: no dashboard ranks or scores people by activity, and producing such a figure about someone is prohibited internally. The one exception is a figure about yourself, which you can ask for under your right of access. A request about another person is declined, rather than covered by a “consent” that, between an organisation and its people, is rarely freely given.
- Enrol you in AI training. We use Anthropic’s commercial API, whose terms exclude training on customer inputs and outputs by default, and we opt into no programme that would change that.
4.Automated decisions
In short None. Bricks takes no decision about you based solely on automated processing, and does no profiling (Article 22 GDPR).
An organisation may build workflows that act automatically in its own app; those are its decisions, and they are listed on its processing page under My organisations.
5.Your rights
In short Most you can exercise yourself from your account. For the rest, write to simon@bricks-softwares.com: we answer within one month, free of charge.
- See your data Art. 15
Your account data is on /account. For what an organisation holds, open it under My organisations → My data and file an access request.
- Correct it Art. 16
Edit your profile on /account. For an organisation’s records, ask the organisation, or write to us and we pass it on.
- Have it erased Art. 17
Ask one organisation from its My data page, or close your whole account on /account/close.
- Restrict processing Art. 18
Write to us while a question of accuracy or lawfulness is being settled; the data is kept but not used.
- Object Art. 21
Where we rely on legitimate interest (security logs, commercial follow-up, investor outreach). For outreach, one line is enough and no reason is needed.
- Take it with you Art. 20
Ask for a copy in a structured, machine-readable format. Organisations can export everything they hold on the platform.
- Complain Art. 77
To the Belgian Data Protection Authority, or to the authority of the country you live in.
We check, reasonably, that a request is really yours before answering. If the data was collected by an organisation’s app rather than by us, we pass your request to that organisation and help it answer. None of our processing relies on your consent; if one ever does, you will be able to withdraw it at any time.
6.Who answers for data protection
RainbowTop Softwares SRL has not designated a Data Protection Officer, because none of the three cases in Article 37(1) GDPR applies to us: we are not a public body, we do not monitor people on a large scale, and we do not process special categories of data at scale. The function is held personally by Simon Mulquin, CTO and co-founder: the periodic review of our security measures, this notice and the Data Processing Agreement, requests from individuals, and our relations with sub-processors.
A conflict of interest, stated rather than hidden
Holding the function from a senior-management position sits in tension with the independence Article 38(6) requires of a formally designated DPO. At our current scale, and absent any obligation to designate, the tension is accepted: someone has to hold the function, and Simon Mulquin is by role and training the most qualified to do so, having held it in other organisations. It will be revisited as soon as our structure or processing scale crosses a threshold of Article 37(1), or earlier if an independent qualified person joins the company.
7.Known gaps
In short Where we fall short of what this page describes as our aim, we say so here rather than leave it for you to find.
- Account emails pass through the United States. Sign-in, password-reset, invitation and signup emails are still relayed by Brevo, a French company whose sending infrastructure is in the United States. Moving them to Scaleway’s email service in France is decided; the work has not started yet.
- Log retention is not yet enforced automatically. Gateway logs are meant to be kept for 30 days, but no automatic rule deletes them yet.
- This notice is not yet signed. Our Terms of Service carry a cryptographic signature you can verify; this notice and the Data Processing Agreement will follow.
8.Changes to this notice
This page is updated in place — same address, no broken links — and material changes are listed below. It is published in English and in French (version française); the two are kept in sync.
- 2.0 · 29 September 2026 — Restructured: company identifiers, one table per audience (purpose, data, legal basis, retention), rights you can act on, automated decisions, known gaps. Aligned with the v3 Terms: joint controllership for organisation data, test accounts. Corrected: account closure, what the Studio AI can see, the language cookie.
- 18 September 2026 — Investor outreach section added.