This policy explains what Braivo stores when you use it, why, who else handles it, how long it is kept, and what you can do about it. It covers this website, the console at braivo.app, schools’ learning sites at <school>.braivo.app, and Braivo’s connection for AI apps at braivo.app/mcp. It does not cover copies of Braivo’s open-source software that others run: whoever runs one is responsible for it.
Who we are
Braivo is operated by Kriasoft di Konstantin Kutepov, Via Luigi Vanvitelli 14, 63822 Porto San Giorgio (FM), Italy, VAT number IT02560680445. Write to us about privacy at support@braivo.app.
Schools decide about their learners’ data
A school, or any organisation that teaches with Braivo, decides what material it puts in Braivo and who learns there. For that material and its learners’ data, the school is the controller, and Braivo is its processor: we process the data only to provide Braivo to the school, under the data processing terms in our Terms of Service. If you are a learner, your school’s own privacy notice applies too, and you can ask your school or us about your data.
For accounts, for running and securing the service, and for our own messages to you, Braivo is the controller.
What we store
- Your account: your email address and name, and your sign-in sessions, each with the IP address and browser it began from. Sign-in codes are stored hashed, as is the password of an account we set up for an app directory’s reviewer. If you sign in with Google, we store your Google account’s identifier and the tokens Google issues, its access and refresh tokens encrypted.
- Schools: each school’s name and address on Braivo, its members and their roles, its groups, and its domains.
- Teaching material: what a school adds, such as uploaded files, text and transcripts, and the objectives, citations, tasks and courses made from them.
- Learning evidence: learners’ answers to tasks and when they gave them, and what Braivo estimates from them: what each learner knows, struggles with, or should review next.
- AI usage: when a school uses Braivo’s own AI to read a file or draft material, a record of the request: the school, who asked, the kind of request, and when. Not its content.
- Connected AI apps: which app you allowed to act as you, in which school, when, and the tokens that let it.
- Request logs: our hosting provider records each request to Braivo’s servers, with its IP address, which we use to run the service and limit abuse.
- Messages: what you send us when you write for help.
Braivo’s apps set the cookies sign-in needs, and one that remembers whether the console’s sidebar is open. Your browser also keeps your theme and the school you last opened. This website sets no cookies of its own and has no analytics or advertising; it remembers a light or dark theme you choose in your browser alone.
Why we use it, and on what basis
- To provide Braivo: sign you in, keep each school’s data to its own members, turn a school’s material into practice, and adapt each learner’s practice to what they know. For your account, this is necessary to perform our contract with you; for a school’s data, we act on the school’s instructions. An account needs your email address and name: without them we cannot sign you in, so cannot provide Braivo. Signing in with Google is optional.
- To run Braivo’s own AI features when a school uses them, on the same basis, and to count their use per school.
- To keep the service secure and working, limit abuse, and fix faults, using the request logs and sessions: our legitimate interest in a safe, reliable service.
- To answer you when you write to us, and to tell you about changes to Braivo or these policies: our contract with you, or our legitimate interest in replying.
- To meet legal obligations, such as tax records and lawful requests from authorities.
We do not sell personal data, show advertising, or use your data or your school’s material to train AI models, and the AI provider we use does not train on it either.
Who else handles it
These providers process data for us, under data processing terms with each:
- Cloudflare runs Braivo’s servers and this website, carries their traffic, stores uploaded files, and receives email sent to us.
- Neon hosts Braivo’s database.
- Resend delivers sign-in codes, so it receives your email address and the code.
- Anthropic runs the model behind Braivo’s own AI features. When a school uses them, Anthropic receives the material being read or drafted from and does not train on it. It deletes it within 30 days, unless it is flagged for breaking Anthropic’s usage policy, which it may keep for up to two years, or the law requires keeping it longer.
- Google, only if you choose to sign in with Google: it tells us who you are under its own privacy policy.
- Our email provider holds the messages you send us.
We disclose data to anyone else only where the law requires it. If Braivo is ever transferred to another operator, this policy goes with the data, and we will tell you before it changes.
Where it is stored
Schools’ data, accounts included, is stored in the European Union: the database in Frankfurt, and uploaded files in Cloudflare’s EU jurisdiction. Requests may pass through Cloudflare’s network outside the EU on their way, Resend delivers email from the United States, and Anthropic processes material for Braivo’s own AI in the United States. Where data leaves the European Economic Area, or a provider is based outside it, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses in its data processing terms. Write to us for a copy of the safeguards that apply.
AI apps you connect
You can connect an AI app, such as ChatGPT or Claude, to Braivo so it can work with your school’s material. The app acts as you, in one school you manage, with the rights you have there, and only after you allow it.
- What it receives: what it reads from Braivo for you: the school’s name, its material and courses. It cannot read learners’ names or progress.
- Where that goes: to the app’s provider, such as OpenAI or Anthropic, which handles it as its own controller, under its terms and privacy policy, not this one.
- What Braivo receives from it: its requests, made as you, such as material it adds and drafts it writes, which Braivo treats like your own.
- Disconnecting: see Support. To remove what the app already holds, use the app’s own settings.
How long we keep it
- Sign-in codes: until used, and at most ten minutes.
- Your account, its sessions, and its connected apps: until the account is deleted. An app’s access lasts an hour; it renews it while in use, and loses it after 30 days unused or when you disconnect it.
- A school, its material, its learners’ data and its AI usage records: while the school uses Braivo. When the school asks us to delete them, we do so within 30 days.
- Request logs: 7 days.
- Messages to us: as long as we need them to help you, and at most two years.
- Backups: 7 days, so a mistake can be undone for 7 days, and deleted data leaves them within 14 days of being deleted from Braivo.
- Records the law requires us to keep: as long as it requires.
Your rights
You can ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, or for your data in a portable form: see Support. You can change your name yourself under Profile in the console’s settings. We answer within a month. Learners can ask their school, or us; where the school is the controller, we pass the request to it and help it answer.
You can also complain to a data protection authority: in Italy, the Garante per la protezione dei dati personali, or the authority where you live or work.
Children
Braivo is made for schools and teachers. Learners aged 13 to 17 may use it through their school, which manages their access; it is not directed to children under 13. Below the age at which a learner may consent alone where they live (14 in Italy), the school is responsible for any consent from parents the law requires. If we learn that we hold a child’s data without it, we will work with the school to delete it.
Security
Traffic is encrypted, sign-in codes are stored hashed and Google’s access and refresh tokens encrypted, and each request is checked against the person’s role in the school it concerns. No system is perfectly secure: if a breach puts your data at risk, we will tell the schools and people affected, and the authority, as the law requires. To report a vulnerability, see Support.
Changes
We will post changes here, with a new date above, and email account holders about significant ones before they take effect.