We last reviewed this page on 19 October 2026.
This page only states what we can back up. At the end you will find a list of things we do not have yet.
We run the application on Hetzner servers in Germany. Encrypted backups are also stored in Germany.
Last verified 3 October 2026.
The connection between your browser and our servers is encrypted.
Last verified 3 October 2026.
Each customer's data is kept in its own database.
Last verified 4 October 2026.
We store integration keys and credentials encrypted. Passwords are stored as hashes, not in readable form.
Last verified 3 October 2026.
We back up the databases daily and encrypt the backups. We keep them for 30 days.
Last verified 4 October 2026.
We limit the number of requests to our public endpoints.
Last verified 3 October 2026.
In a browser, the widget only displays on the domains a customer lists in their settings. If the list is left empty, any site can display it. Direct API calls made outside a browser are not restricted this way, and are limited by rate limits and usage quotas instead.
Last verified 4 October 2026.
Our security headers currently score A on securityheaders.com, measured on 19 October 2026. We do not chase the top score at the cost of things breaking.
Last verified 19 October 2026.
We monitor our dependencies for known vulnerabilities and approve updates by hand.
Last verified 4 October 2026.
These companies process data on our behalf. The list is the same as in our privacy policy.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Stripe | Payments and billing | billing and payment data | USA (SCC) |
| Resend | Sending transactional emails | email address, message content | USA (SCC) |
| Mailgun | Receiving emails from customers (only when the customer uses the email channel) | inbound email content | EU |
| OpenAI | Processing AI chatbot responses. Data sent via the API is not used for model training by default. | conversation and question content, results of tools that were used, and conversation summaries written by an AI model | USA (SCC) |
| Anthropic | Processing AI responses. Only when the customer connects their own Anthropic key. | conversation and question content, results of tools that were used | USA (SCC) |
| Sentry | Application error monitoring (EU region). Technical logs may contain request fragments. | technical logs, may contain request fragments | EU, Germany |
| Cloudflare | Spam and bot protection (Turnstile) | IP address | USA (SCC) |
| Hetzner | Infrastructure hosting and encrypted backups | all stored data | Germany |
| HubSpot | CRM integration. Only when the customer activates this integration themselves. | lead contact data | USA (SCC) |
| Google Calendar | Calendar access via MCP. Only when the customer connects their own Google account. | calendar events | USA (SCC) |
We email account owners about 30 days before we add or replace a sub-processor. Customers can object to a change or end the contract.
If you find a security issue, write to security@bridgeai.sk. We will confirm receipt within 5 business days. We do not run a bounty program and we do not promise a fix date.
You can find the same contact details in machine-readable form at /.well-known/security.txt.
We provide our data processing agreement on request. It is written in Slovak, and article 8 of our terms already refers to it. If your procurement process needs a signed copy, we will send one.
Request the DPAIf your email app does not open, write to hello@bridgeai.sk. hello@bridgeai.sk
We do not have these yet. We would rather say so than let you assume.
Our privacy policy and terms are available in Slovak only.