Brello documents
Privacy Policy
Read Brello's Privacy Policy and previous revisions.
Last revised Latest version
View previous versions
Select a revision to read the full document.
1. Who we are
Brello helps developers track and control their AI API spending. This Privacy Policy explains what personal information we collect when you use the Brello website at brello.app, the dashboard, our APIs, and our SDKs (the “Service”), how we use it, and the choices you have.
The Service is operated by Gyuyeon Lee, doing business as Brello, based in the Republic of Korea (“Brello”, “we”, “us”). For the personal information described in this policy about our own users, Brello is the data controller.
The short version: we collect what we need to run the Service, we never collect the content of your prompts or AI responses, we encrypt the Provider keys you connect, and we do not sell your personal information.
Terms used here, such as Provider, Customer Data, and End User, have the meanings given in our Terms of Service.
2. Information we collect
Information you give us
- Account information: your name, email address, and profile picture. If you sign in with GitHub or Google, we receive these from that provider. We do not receive your GitHub or Google password.
- Connected Provider keys: keys you connect so we can read usage and billing data from your Providers, and any backup keys you register. We store these encrypted.
- Messages and feedback: what you send us by email, through support, or through our feedback board.
Information your applications send through the SDK
- Usage metadata: the Provider and model used, token counts, cost, timestamps, and request status.
- End User identifiers: the identifier you choose to pass for each End User of your application. We recommend an internal ID or a hashed value.
The SDK never sends the content of your prompts or the Provider’s responses.
Information from your Providers
- Usage and billing data that your Providers make available through the keys you connect, such as spend by day, model, and project.
Payment information
- Payments are handled by Paddle, our merchant of record. Paddle collects your card or payment details directly; we never see or store your full card number. We receive limited details such as your plan, billing country, and payment status.
Information collected automatically
- Technical data: IP address, browser type, device information, and pages visited, collected through server logs.
- Error data: if the dashboard hits an error, we receive a report with technical details about what went wrong.
3. How we use information
We use the information above to:
- Provide the Service: show your spending, calculate costs per End User, generate forecasts, and send the alerts you set up.
- Reconcile pending costs from SDK events with confirmed billing data from your Providers.
- Create and manage your account, and process subscriptions through Paddle.
- Send you service messages, such as alerts, security notices, billing receipts, and changes to our terms.
- Respond to your questions and feedback.
- Keep the Service secure, detect abuse, and fix errors.
- Create aggregated, de-identified statistics that never identify you, your company, or your End Users.
We do not sell your personal information, use it for third-party advertising, or use your Customer Data to train AI models.
We will only send you marketing emails, such as product news, if you agree to receive them, and you can unsubscribe at any time.
4. Legal bases for processing
If you are in the European Economic Area, the United Kingdom, or another place with similar laws, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service, managing your account and subscription | Performance of our contract with you |
| Security, abuse prevention, error fixing, aggregated statistics | Our legitimate interests in running a safe and reliable Service |
| Billing records and tax | Compliance with legal obligations |
| Marketing emails | Your consent, which you can withdraw at any time |
5. Sharing and subprocessors
We share personal information only with service providers that help us run Brello, and only as much as each one needs. They may use it only to provide their service to us.
| Service | What it does for Brello | Data involved |
|---|---|---|
| Cloudflare | Hosting, network, DNS, and server logs | All Service data in transit and at rest, technical data |
| Database provider (to be confirmed) | Stores account and Customer Data | Account info, encrypted keys, usage metadata, End User identifiers |
| Paddle | Payments, invoicing, and tax as merchant of record | Name, email, billing country, plan, payment details |
| Resend | Sending service and alert emails | Email address, email content |
| Sentry | Error reports from the dashboard | Technical data, account ID |
| Better Stack | Status page, uptime monitoring, and logs | Technical data, server logs |
| Featurebase | Feedback board and feature requests | Name, email, feedback you post |
We keep this list up to date. Before we add a new service that receives Customer Data, we will update this page, and if the change is material, we will notify you as described in Section 11.
Sign-in providers. If you sign in with GitHub or Google, they handle that sign-in under their own privacy policies.
Your Providers. To read your usage and billing data, we send requests to your Providers using the keys you connect. Your Providers handle that data under their own policies.
Other cases. We may disclose information if the law requires it, to protect the rights and safety of Brello or our users, or as part of a transfer of the Service, for example to a company we form to operate it. We will tell you before your information becomes subject to a different privacy policy.
6. International transfers
Brello is operated from the Republic of Korea, and our service providers process data in other countries, including the United States. This means your information may be processed outside the country where you live.
When we transfer personal information from the European Economic Area or the United Kingdom, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses included in our providers’ data processing terms.
7. How long we keep information
| Data | How long |
|---|---|
| Connected Provider keys | Until you remove them or delete your account, then deleted immediately |
| Raw SDK usage events | 30 days on the Free plan, 90 days on paid plans |
| Daily cost summaries (by End User, model, and Provider) | While your account is active |
| Account information and other Customer Data | While your account is active, then 30 days after deletion so you can recover or export it |
| Server logs and error reports | Up to 90 days |
| Billing records | As long as tax and accounting laws require, generally up to 5 years |
| Support emails and feedback | As long as needed to handle your request and improve the Service |
Backups may keep deleted data for up to 30 additional days before it expires. Aggregated, de-identified statistics are not personal information and may be kept longer.
8. Security
We protect your information with measures that fit a service handling API credentials, including:
- Encrypting connected Provider keys at rest, with the encryption key stored separately from the database.
- Encrypting all data in transit with TLS.
- Asking for the narrowest Provider permissions we need, such as read-only usage access.
- Restricting internal access to production data and keeping error reports free of keys and request contents.
No system is perfectly secure. If we learn of a security incident that affects your personal information, we will notify you and the relevant authorities as the law requires. You can report a security issue to privacy@brello.app.
9. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and get a copy of it.
- Correct information that is wrong or incomplete.
- Delete your personal information. You can delete your account yourself in settings, or ask us to do it.
- Export your data in a portable format.
- Object to or restrict certain processing, such as processing based on our legitimate interests.
- Withdraw consent, for example to marketing emails, at any time.
- Complain to your local data protection authority.
California residents. We do not sell or share personal information for cross-context behavioral advertising. You have the right to know, delete, and correct your personal information, and we will not treat you differently for using these rights.
How to make a request. Email privacy@brello.app from the address on your account. We will reply within 30 days. We may need to confirm your identity before acting on a request.
10. Your End Users’ data
When your application sends End User identifiers and usage metadata through the SDK, you decide what is sent and why. For that data, you are the controller and Brello acts as your processor: we process it only to provide the Service to you, following your instructions and these terms.
- We recommend sending an internal ID or a hashed value, not an email address or other directly identifying information.
- You are responsible for giving your End Users any notice and having any legal basis your local law requires.
- If one of your End Users asks us about their data, we will refer them to you. We will help you respond to their requests, for example by deleting data linked to a specific identifier.
If you need a Data Processing Agreement for your use of Brello, contact privacy@brello.app.
11. Cookies, children, changes, and contact
Cookies. We use only cookies that are needed to keep you signed in and to secure the Service. We do not use advertising or cross-site tracking cookies.
Children. The Service is not for anyone under 18, and we do not knowingly collect information from them. If you believe a person under 18 has given us information, contact us and we will delete it.
Changes. We may update this policy. For material changes, we will email you at least 14 days before they take effect. The date at the top shows when it was last updated.
Contact. For privacy questions or requests, email privacy@brello.app. Our privacy officer is Gyuyeon Lee.