Security & Data
Last updated: October 25, 2026
For companies that want to know what happens with their team's data in Bruno AI. Short version, in tables.
1. Who we are and what we do with your data
| Question | Answer |
|---|---|
| Service provider | Jakub Chodakowski, sole proprietor registered in Poland (EU), tax ID (NIP) 6711845485 |
| Role under GDPR for team accounts | Processor. Your company is the controller of its sales reps' data. |
| Role for individual accounts | Controller |
| What the data is used for | Running the practice call, scoring it, showing progress, solving support tickets. Nothing else. |
| Do we sell data or share it for ads | No |
| Contact for data matters | hello@jakubchodakowski.com |
2. Sub-processors: who processes what
Every provider runs on our business account. Each one gets only the data it needs for its job.
| Provider | Country | What it does | What data it gets |
|---|---|---|---|
| ElevenLabs (Eleven Labs Poland sp. z o.o. for EEA users) | Poland / USA (processing in USA, EU or Singapore) | Bruno's voice, speech recognition, running the live call | Audio of the call, transcript |
| Anthropic PBC | USA | Scoring the call and the drill cards (the coach) | Transcript, call settings, drill answers, your offer data from Customize Bruno |
| OpenAI, L.L.C. | USA | The language model gpt-5.5 that plays the customer in every call (called through ElevenLabs). Backup voice call (gpt-realtime) and its transcription when ElevenLabs is down. | Every call: the text of the call and the call setup (including your offer data). Backup call only: audio of the call. |
| Supabase Inc. | USA (data region: us-east-1, N. Virginia) | Database and private storage for recordings | Account data, transcripts, scores, audio files |
| Vercel Inc. | USA | Hosting of the website and the app | Request logs, data passing through the app |
| Resend Inc. | USA | Sending emails (login, reminders, reports) | Email address, first name, email content |
| Stripe, Inc. | USA | Payments | Payment data. We never see card numbers. |
| Google LLC | USA | Sign in with Google, our mailbox | First name and email address from your Google account; emails you send us |
Transfers to the USA rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. We give 14 days' notice before adding or changing a sub-processor. Your company may object and terminate the contract.
3. Where the data is stored
| Data | Where |
|---|---|
| Accounts, transcripts, scores, stats | Supabase database on our account (region: us-east-1, USA) |
| Audio recordings | Private Supabase storage bucket, no public links |
| Copy of the call at the voice provider | ElevenLabs, deleted after 1 day |
| Copy at the AI coach | Anthropic, deleted within 30 days |
| Copy at the model that plays the customer | OpenAI, security logs deleted within 30 days |
| Card data | Stripe only |
4. How long we keep it (retention)
| Data | How long |
|---|---|
| Account | As long as the account is in use |
| Recordings and transcripts of practice calls | 12 months from the call. When a company contract ends: 14 days after the end. |
| Scores and stats without audio | As long as the service is in use (to show progress) |
| Copy at ElevenLabs | 1 day |
| Copies at Anthropic and OpenAI | Up to 30 days |
| Contact form data | Up to 12 months from the last contact |
| Test account with no contract | Deleted within 3 months after access ends |
| After a company contract ends | All data deleted or returned to the company within 14 days, your choice |
| Confidential mode (on company request) | No audio is saved. The transcript is deleted right after the call is scored. Only the score, metrics and stats remain. |
| A sales rep leaves the company | Account turned off within 1 business day of the company's email. Recordings and transcripts of that rep deleted after 14 days. |
One email to hello@jakubchodakowski.com deletes a single recording or all recordings of an account earlier.
Confidential mode. Your company can ask for it by email to hello@jakubchodakowski.com. We turn it on by hand for all of your team accounts. It applies from the next call after it is on.
When a sales rep leaves. The company (the team lead) emails hello@jakubchodakowski.com. We turn off the account within 1 business day. Before the recordings and transcripts are deleted (14 days), the company can ask for an export of that rep's scores and stats. The license moves to a new sales rep.
5. Model training: no
| Provider | Trains on your data? | Why |
|---|---|---|
| Bruno AI (us) | No | Recordings are used only to score the call and show progress. Training would need your company's separate written consent. |
| ElevenLabs | No | Training on our data was switched off in the account settings on October 3, 2026. |
| Anthropic | No | Anthropic's commercial terms: no training on customer content sent through the API. |
| OpenAI | No | OpenAI API: data sent through the API is not used for training by default. |
6. Who can see the data
| Who | What they see |
|---|---|
| The sales rep | Own calls, recordings, scores and drill cards |
| The team lead named by the company (full access plan) | Calls and scores of the team |
| The service provider (Jakub Chodakowski) | All data, only to run the service and solve tickets |
| Sub-processors | Only what is listed in section 2 |
| Anyone else | Nobody, unless the law requires it |
7. Encryption and security
| Area | Measure |
|---|---|
| Connection | HTTPS everywhere. Voice calls over WebRTC or WebSocket on TLS. |
| Passwords | Stored only as a scrypt hash with a random salt. Never in plain text. |
| Google sign-in | We get only first name and email. Never your Google password. |
| Sessions | Signed token in an httpOnly cookie, 30 days or until logout |
| Login protection | 5 failed attempts lock the login for 15 minutes |
| Recordings | Private storage, no public links |
| Data separation | Every query is filtered by account. One account never sees another's data. |
| Limits | Minute and call limits checked on the server, not in the browser |
| Payments | Card data goes to Stripe only |
| Breach notification | To your company without undue delay, no later than 7 days after discovery. To the authority and the people affected within the GDPR deadlines (Art. 33-34). |
8. Consent to recording
- Every practice call is recorded from start to end. The user agrees to this when accepting the Terms of Service (section 7).
- Practice calls are fictional. Users must not say real customers' names or sensitive data (Terms, section 8).
- We do not build a voice profile and do not use the voice to identify anyone.
- If a user uploads a recording of a real call, they confirm they have consent from everyone heard on it.
9. Your rights (GDPR)
| Right | How |
|---|---|
| Access and a copy of the data | Email hello@jakubchodakowski.com |
| Correction | Email hello@jakubchodakowski.com |
| Deletion (one recording, all recordings or the whole account) | Email hello@jakubchodakowski.com |
| Export (data portability) | Email hello@jakubchodakowski.com. You get recordings, transcripts and scores. |
| Restriction and objection | Email hello@jakubchodakowski.com |
| Complaint | President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland |
| Response time | Within 30 days |
For team accounts, send the request through your company (the controller). We help the company answer it.
10. Data Processing Agreement (Art. 28 GDPR)
A standard DPA is already part of our Terms of Service (section 12): subject, duration, data types, our duties, sub-processors, deletion after the contract, audit once a year. We send our DPA template together with the contract. If your legal team prefers its own template, send it to us. We sign before the first team account goes live.
See also: Terms of Service, Privacy Policy