ConBRIX Privacy Policy
This is a translation. In case of discrepancy the Estonian version prevails.
Version 1.2 · effective from 7 October 2026
1. Controller
Nordes Engineering OÜ, registry code 12298039, Tallinn, Estonia. Questions about personal data: info@conbrix.eu.
2. Which personal data and why
The ConBRIX Service analyses the public data of companies (legal persons). The financial data of a legal person are not personal data. We process personal data about the User (a natural person), and only to the minimum extent. Where the Client is a consumer, the Account data are personal data about the person themselves and the same table applies.
| Data | Source | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| E-mail address, password hash, role, name (optional) | The User | Account, login, confirmation and password e-mails | contract (b) |
| Company name or registry code and the User's connection with the company (optional); segment, if there is no company | The User | Providing the Service on the basis of the Client's company or segment | contract (b) |
| Two-step authentication secret (if the User switches it on) | The User | Security of the Account | contract (b) |
| Choices of contract partners and the User's assessments | The User | Calculating the Output | contract (b) |
| Conversations: the text of the question, the answer, the conversation identifier | The User | Giving the answer, keeping count of the quota | contract (b) |
| Feedback on an answer (suitable / not suitable) | The User | Measuring the quality of the Service — only as a count, without text | legitimate interest (f) |
| Usage events (views opened, cards, export, timestamps; the number and duration of conversations) | The Service | Operation of the Service, quotas, development, research in pseudonymised form | legitimate interest (f) |
| Technical logs (IP address, browser type, errors); session data (session reference, coarse IP region) | The Service | Security, prevention of misuse, ensuring that the Account is personal, compliance with the terms of the data sources | legitimate interest (f) |
| Billing data (invoice recipient, VAT registration number, status of the subscription and of the trial, status of invoices and payments) | The User, the payment service provider | Trial, billing, accounting | contract (b), legal obligation (c) |
| E-mail notification preferences | The User | Subscription e-mails (start and end of the trial, payment); summary e-mails only if the User subscribes to them | contract (b); summary: consent (a) |
| Connected applications (if the User connects the Service to their own artificial-intelligence application) | The User | Managing and revoking the connection | contract (b) |
We do not ask for or store the Client's margin, price quotations, the full text of contract documents or card data. We do not process special categories of personal data.
The Service is not intended for analysing sole proprietors or other natural persons; from the data of the Business Register we use only the financial lines of legal persons and do not store the names of management board members or other natural persons. We do not query external registers about a Client who is a consumer unless the Client has themselves entered a company.
3. Cookies
We use only a session cookie to keep the User logged in (for up to 30 days if the User chooses “remember me”) and a security cookie (CSRF). We do not use tracking or marketing cookies. For visit statistics of the public pages we use a cookieless solution on our own server in the European Union, which does not store IP addresses or identify the User.
4. Who we transfer data to
Personal data are not sold or transferred to third parties for marketing. We use processors to provide the Service:
| Processor | Role | Location |
|---|---|---|
| Zone Media OÜ | server hosting, database and encrypted backups | Estonia (EU) |
| Brevo (Sendinblue SAS) | sending confirmation, subscription and summary e-mails | France (EU) |
| Stripe Payments Europe Ltd | card payments, management of the trial and of subscriptions in a hosted payment environment; card data are held only by Stripe | Ireland (EU); see 4.1 |
| Merit Tarkvara AS (Merit Aktiva) | preparing and sending sales invoices | Estonia (EU) |
| Anthropic, PBC | language model for wording interpretations and chat answers | USA; see 4.2 |
| GitHub, Inc. | software source-code repository — code only; no client data or personal data are held there | USA (no personal data are transferred) |
4.1. Payments. All the User's personal data and the Client's data are located in the European Union, except for the transfers described in sections 4.1 and 4.2. Companies of the Stripe group may also process payment data outside the European Economic Area; the transfer takes place on the basis of the European Commission's standard contractual clauses and the EU–US Data Privacy Framework, and concerns only the data needed to make a payment (the User's name and e-mail, the invoice recipient, and card data, which the Service itself does not see).
4.2. Language model. To word the interpretations and chat answers we use the language models of Anthropic, PBC, whose servers are located in the United States of America. The transfer takes place on the basis of Anthropic's data processing agreement, which includes the European Commission's standard contractual clauses (GDPR Art. 46). Only the text of the User's question, the earlier messages of the same conversation and the context needed for the answer — the Service's own sentences, numbers and cards that the User sees in the Service — are transmitted to the language model, not the Account data as a whole and not the User's contact details. For one question the Service may ask the model for several candidate answers and have the model compare them; the client is shown one answer, which has passed the Service's own check. Anthropic does not use text transmitted through the API to train models and deletes the inputs and outputs from its systems within 30 days; they are retained for longer only if Anthropic's automated check detects a breach of the terms of use or if the law requires it. The User should not write into a question any personal data that they do not wish to have transmitted. Consent to the use of the language model is given when agreeing to the terms; there is no obligation to use the chat.
4.3. (This section is not in use from version 1.2: the voice function is not offered in the Service and no speech-processing service is used. The numbering is kept so that references stay valid.)
4.4. The Client's own application. If the User connects the Service to their own artificial-intelligence application, the Service transmits to it, at the User's own request, the same sentences and cards that the User sees in the Service. The provider of such an application is a service chosen by the User themselves, and its data protection terms apply between the User and that provider. The connection can be revoked on the Account page at any time.
4.5. The User's personal data are not transmitted to the public data sources (the e-Business Register, the Estonian Tax and Customs Board, Statistics Estonia and others); queries are made about the registry codes of companies.
5. Automated decisions
The language model is used as an interpreter, not as a decision-maker: the numbers and states come from the Service's rule base and from public sources, and the model puts them into words. The Service does not make automated decisions with legally significant effects about the User and does not profile the User (GDPR Art. 22). The content of conversations is not used to train models — neither by the Service Provider nor by the processors.
6. Research
Usage events and feedback are used in pseudonymised and aggregated form to study the methodology of decision support (Tallinn University of Technology and partner universities). In pseudonymisation, the Account identifiers are replaced using a key that exists only in the Service's production environment; the research environment does not have that key. The content of conversations is not used in research. In publications neither the User nor the Client is identifiable, and results are published only for groups of at least five companies. The User may object at any time to use in research by giving notice at the address stated in section 1; the pseudonymised aggregated data collected up to that point cannot technically be re-identified.
7. Retention
Account data — until the Account is closed; after that the User's e-mail, name and password hash are deleted within 30 days and the usage events are pseudonymised. Conversations — in the Analyst package, for no longer than 24 hours after the last message; in the Analyst Pro package, while the Package is valid and for 14 days after it ends (section 8 of the Terms of Service). Feedback — only as a count, without text. Session data and technical logs — 90 days. Unconfirmed account — 30 days. Encrypted backups — 30 days. Accounting data (invoices) — the 7 years required by law, kept separately and not visible in the Service. An administrator sees only the number, duration and cost of conversations, not their content; viewing the content in the course of support requires the User's consent and is logged.
8. The User's rights
The User has the right to access their data (“Download your data” on the Account page), to rectify them, to erase them (by closing the Account), to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw the subscription to summary e-mails at any time using the unsubscribe link in the e-mail or on the Account page. Requests: info@conbrix.eu. We reply within 30 days. A complaint may be lodged with the Estonian Data Protection Inspectorate (www.aki.ee).
9. Security
Passwords are kept only as a hash (argon2id); two-step authentication secrets are encrypted; data traffic is encrypted (HTTPS); the content of conversations is kept encrypted in the database; the data are located in the European Union, except for the transfers referred to in sections 4.1 and 4.2; access is restricted by role; backups are encrypted and the encryption key is not kept on the server; the keys of the language-model service are on the server only and do not reach the User's browser. We notify the supervisory authority and the affected Users of a data breach as provided by law.
10. Changes
We notify Users of changes to the policy by e-mail or in the Service at least 30 days in advance; the version in force is always available at conbrix.eu/privaatsus.
Seller details
Nordes Engineering OÜ, 12298039, Puhma tn 4, 11615 Tallinn, Harju maakond, EE102481608 · info@conbrix.eu