Privacy Policy

1. Controller and roles

OLLYN, a French simplified joint-stock company with a sole shareholder and share capital of EUR 1,000, Strasbourg RCS 932 407 729, 7 rue Joseph Schmitt, 67500 Weitbruch, France, is controller for website, account, billing, support, security and its own business-relationship processing.

For data imported or processed under a customer's criteria and instructions, that customer is generally controller and Ollyn is processor. Where Ollyn determines the purposes and means of collection or enrichment from public sources, it is controller for that operation. Individuals may always contact Ollyn, which will route the request where needed.

2. People and data covered

• Visitors: IP address, technical logs, browser, device, requested pages, language and strictly necessary cookies.
• Users and customers: email, company or workspace, hashed password, preferences, settings, support requests, login and usage history, billing identifiers, plan and credit movements. Braisely does not store full payment-card numbers.
• Prospects and professional contacts: name, role, employer, business location, business email or phone where available, profile and website URLs, public posts and interactions, professional events, detected signals, source, date, scores, analyses and outreach drafts.
• Customer-supplied data: imported lists, domains, targeting criteria, keywords, instructions, notes, export destinations, webhooks and technical credentials for enabled integrations.

3. Data sources

Data comes directly from users and customers, from publicly accessible or open sources, and from technical providers. Depending on enabled features, sources may include company websites, public professional profiles or content, news and press feeds, job postings, public-procurement notices, advertising libraries, domain-name data, and results supplied by collection or enrichment services.

Public availability does not remove a person's rights. Where possible, Braisely keeps the source or URL used to verify origin and limits collection to information relevant to the configured professional purpose.

4. Purposes and legal bases

• Contract: create and administer accounts; provide analyses, exports, alerts and integrations; manage support, credits, subscriptions and payments.
• Legal obligations: accounting, tax, data-subject requests and cooperation with competent authorities.
• Legitimate interests of Ollyn or its customers: secure and diagnose the Service, prevent abuse, improve quality, manage B2B relationships and identify relevant professional opportunities from lawful sources after balancing the rights and interests involved.
• Consent where the law requires it: optional communications, non-essential trackers, or outreach on a channel or in a context requiring prior permission. Consent may be withdrawn at any time.

5. Qualification, AI and decisions

Braisely may use rules and AI models to summarise public content, search for business context, qualify contact relevance, assign scores and draft messages. Data sent to an AI provider is limited to what the operation needs.

Outputs assist a professional user. Braisely is not intended to make decisions on its own that produce legal or similarly significant effects on an individual. The customer must conduct human review before outreach or action.

6. Recipients and providers

Data is available to authorised Ollyn personnel and the relevant Customer. Depending on the features used, the following provider categories may process it:

• Infrastructure providers for application, database, backup and technical-log hosting.
• AI-model, search, collection and enrichment providers, limited to the data needed for the requested operation.
• Payment, service-email, error-diagnosis, media-delivery and business-email-verification providers.
• AI assistant providers that you choose to connect to Braisely, limited to the data returned by the requests you ask the assistant to make (see section 13) and, only if a workspace owner has enabled LinkedIn signals in the connector, the names, profile links and public posts of third parties contained in those signals.
• When enabled by the Customer, outreach, customer-relationship-management and content-audit tools, webhooks or other destinations selected by the Customer. Those recipients then process data under their own terms and the Customer's configuration.
• Authorities, advisers and potential acquirers only where legally required or within a secured restructuring process. Data is not sold for advertising.

7. Transfers outside the EEA

The primary infrastructure hosting the application and its database is configured in a European region. Some providers may nevertheless process data in the United States or other countries outside the EEA. Depending on the recipient, transfers are covered by an adequacy decision, the EU-US Data Privacy Framework for certified entities, European Commission Standard Contractual Clauses and appropriate supplementary measures.

The Customer must ensure that integrations it chooses provide safeguards appropriate to its processing. Further information about applicable safeguards may be requested from Ollyn.

8. Retention

• Customer account and operational data: for the contract term. You can delete your account yourself from your profile settings (if you have an active subscription, cancel it first from Billing): access is disabled and all connected AI assistants are disconnected immediately, and your data is erased 30 days later. You can also ask us to close your account by writing to beforethefire@braisely.co; we process these requests manually, within 30 days of verifying your request.
• After erasure, the workspace record is kept only in pseudonymized form: its name and content are removed and replaced by a technical identifier, and it retains the billing identifiers and credit movements needed for accounting.
• Signals, leads and prospect data (including sourced contacts, outbound candidates and crawl results): erased automatically three years after their last relevant update, such as collection, contact or edit, unless you or we erase them earlier.
• Contacts published in domain-registration data (name, organisation and email of the registrant or administrative contact, and their telephone number and postal address where published) used to detect new businesses: erased 12 months after collection. The domain name and non-personal registration data (registrar, name servers, dates) are kept.
• Contracts, invoices, credit movements and accounting evidence: ten years where legally required. These records are detached from the personal data erased above.
• AI assistant connector tokens: access tokens expire after one hour; refresh tokens remain valid until you disconnect the connector or delete your account, and both are revoked immediately in either case. Tokens are stored hashed.
• Technical logs of AI calls (duration, model, token counts, error messages): erased with the related record or the workspace and, when not tied to a record, 12 months after creation.
• Application and security logs and error reports: kept by our hosting and monitoring providers according to their own retention policies.
• Backups: scheduled database backups are rotated by our hosting provider (daily backups are kept 7 days and weekly backups 1 week, according to its documentation for our plan); manual backups, limited by the provider to five, are removed when we no longer need them. Deleted data may therefore remain in access-restricted backups until they rotate.

9. Notice for indirectly collected data

Where professional data is not collected from the individual, notice must be given as soon as possible and no later than one month, at first contact or before first disclosure to a third party, whichever happens first, unless a documented legal exception applies.

Where the Customer determines the campaign, it must give this notice, including its identity, purpose, legal basis, data categories and sources, recipients, retention, rights and the right to complain to the relevant supervisory authority.

10. Your rights

Depending on the processing, you may request access, correction, deletion, restriction and portability, withdraw consent and object to processing. You may object to direct marketing at any time, free of charge and without giving a reason. French law also allows instructions for data after death.

To exercise rights, email beforethefire@braisely.co with enough information to locate your data. Identity evidence is requested only where reasonable doubt exists. You may complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.

11. Cookies and trackers

Braisely uses cookies strictly necessary for authentication, security, CSRF protection and language preferences. Consent is not required where they remain limited to those purposes. As of this Policy date, the site uses no advertising cookie or audience-measurement tool requiring consent.

If non-essential trackers are added, Braisely will present a choice tool before placing them and update this Policy. Requests to media-delivery providers may create technical logs at those providers.

12. Security

Ollyn uses risk-appropriate measures including HTTPS transport encryption, password and token hashing, logical workspace separation, access controls, scheduled database backups and error monitoring. No system is completely invulnerable; suspected incidents may be reported to beforethefire@braisely.co.

13. AI assistant connector

Braisely offers an optional connector, based on the Model Context Protocol (MCP) and secured by OAuth 2.1 with PKCE, that lets an AI assistant you choose read your Braisely workspace data on your behalf. You authorise it on a consent screen and can disconnect it at any time from the assistant's connector settings. Deleting your account disconnects it immediately.

The connector is read-only. It returns only signals about organisations from open sources (Google News articles, BOAMP French public tenders, the Meta Ad Library and France Travail job offers), your credit balance, workspace-level counts, and the outreach leads generated from those signals. Signals collected from marketplaces, signals that identify individuals, and prospect contact lists are not available through the connector. Signals collected from social networks are not available either, except the optional LinkedIn signals described below.

Optional LinkedIn signals. Where this option is offered in the Braisely settings, a workspace owner may enable the sharing of LinkedIn post signals with the connector. These signals, and the outreach leads generated from them, contain the names, profile links and public posts of third parties. Once enabled, they are transmitted to the AI assistant provider you have chosen, which acts as an independent recipient and processes them under its own terms and privacy policy. The option is off by default; it requires an explicit confirmation by an owner, recorded with the account and the date and time; and it can be switched off at any time, with immediate effect for subsequent requests. Data already delivered to an assistant provider is governed by that provider's terms; Braisely cannot recall it.

Each request is attributed to your workspace only through your OAuth token, so the connector cannot reach another customer's data. It does not read or store your conversations with the assistant. The data returned by a request is delivered to the assistant provider you chose, which processes it under its own terms and privacy policy. Technical logs may record the request time, IP address and tool name; they are kept as described in section 8.

14. Changes

This Policy may change with the Service or law. Its date and version appear above. Customers will receive appropriate notice of a material change affecting existing processing.