Privacy Policy — CheckUp
Version: 1.0 — Last updated: 29 June 2026.
BRAIKE — CheckUp tool (checkup.braike.com)
This policy describes how BRAIKE (“we”) processes your personal data as data controller when you use CheckUp, our automated advertising-account audit service. It is drawn up in accordance with Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act No. 78-17 as amended.
1. Who are we?
Data controller: BRAIKE, a SAS with share capital of €20,000, 18 bis rue de Villiers, 92300 Levallois-Perret, Nanterre RCS 106 573 983. Personal-data contact: Edris PAIKAN — contact@braike.com.
Where data is processed for the purpose of providing the Service to our clients, including the audience data contained in the audited accounts, you (or your client where you act as a processor for a third party) remain the data controller and we act as a processor (Art. 28 GDPR), under our Data Processing Agreement (DPA).
2. What data do we collect?
2.1 Account data. Email address (unique identifier), name, preferred language; workspace(s), role (owner, member, viewer) and invitations.
2.2 Platform connection data. OAuth access and refresh tokens for the connected platforms (Google Ads, Meta, TikTok), encrypted with AES-GCM-256.
2.3 Audit and AI data. Audit results (findings, scores, recommendations) and vector representations (embeddings) generated for the conversational assistant, retained to provide the Service and the comparison history.
2.4 Billing data. Upon payment activation: the payment provider’s customer and subscription identifiers, status, quantity and billing period.
2.5 Usage data and logs. Activity and notification-delivery logs (recipient, status), synchronisation statuses.
2.6 Technical and connection data. IP addresses, session identifiers and technical metadata generated by the server logs of our hosting providers (Vercel, Supabase).
We do not collect special-category data within the meaning of Article 9 of the GDPR.
3. Why do we collect your data?
| Purpose | Legal basis (Art. 6 GDPR) | Data concerned |
|---|---|---|
| Creation and management of the account and workspaces | Performance of the contract | Account, profile, invitations |
| Auditing accounts and producing recommendations | Performance of the contract | Campaign data, audit results |
| Connection to advertising accounts | Performance of the contract | OAuth tokens |
| Assistance via the AI copilot | Performance of the contract | Audit context, embeddings |
| Email notifications | Performance of the contract | Email, delivery logs |
| Billing (upcoming) | Performance of the contract / legal obligation | Billing data |
| Security and abuse prevention | Performance of the contract / legitimate interest | Logs, connection data |
| Service improvement (aggregated, anonymous statistics) | Legitimate interest | Logs, aggregated statistics, feedback |
4. Automated decision-making and profiling
CheckUp does not carry out any solely automated decision producing legal effects concerning you within the meaning of Article 22 of the GDPR. The AI copilot provides analyses and recommendations subject to your validation; as the Service is read-only, no action is applied to your accounts without your intervention.
5. With whom do we share your data?
| Recipient | Role | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication, real-time, vectors (pgvector), storage | European Union (AWS infrastructure) | No transfer outside the EU |
| Vercel Inc. | Application hosting | United States | DPF where certified, otherwise SCCs |
| Inngest Inc. | Scheduled tasks (audits) | United States | DPF where certified, otherwise SCCs |
| Google LLC (Gemini) | Recommendations and AI assistant (RAG) | United States | DPF where certified, otherwise SCCs |
| Resend Inc. | Email delivery | United States | DPF where certified, otherwise SCCs |
6. Are your data transferred outside the European Union?
Our databases (Supabase) are hosted within the European Union: your account and audit data reside there. Some providers are located outside the EEA: United States (Vercel, Inngest, Google, Resend, as well as the Google and Meta ad platforms) — transfers based on the “EU–US Data Privacy Framework” where the provider is certified, otherwise on Standard Contractual Clauses (EU Decision 2021/914); China (TikTok) — SCCs supplemented by an impact assessment and additional measures.
7. How long do we keep your data?
| Type of data | Retention period |
|---|---|
| Account and workspaces | Duration of the contract, then deletion within 30 days of termination (subject to legal obligations) |
| OAuth tokens | As long as the connection is active; deleted upon disconnection |
| Audit results and embeddings | Duration of the contract; deleted on request or at the end of the relationship |
| Billing data | 10 years (accounting obligation, Art. L.123-22 of the French Commercial Code) |
| Logs and connection data | 12 months |
8. Artificial intelligence and data transmitted
The recommendations and the conversational assistant rely on an AI model (Google — Gemini) to which audit data is transmitted; embeddings are generated to enable the contextual assistant. The data transmitted is minimised to what is necessary for the purpose.
9. What are your rights?
You have the rights of access, rectification, erasure, restriction, portability, objection and the right to withdraw your consent at any time, as well as the right to set guidelines for the fate of your data after your death. You may exercise them with contact@braike.com; we respond within one month. You may lodge a complaint with the CNIL (www.cnil.fr).
10. Cookies and trackers
CheckUp uses only strictly necessary cookies (an authentication session cookie). No audience-measurement tracker or marketing pixel is used. See the Cookie Policy.
11. Security
Read-only access, encryption of OAuth tokens (AES-GCM-256), HTTPS/TLS, data isolation per workspace (PostgreSQL Row-Level Security), signing of inbound webhooks (Inngest) and rotation of session tokens.
12. Changes to this policy
In the event of a material change, you will be informed by an appropriate means at least 30 days before it takes effect, consistent with our Terms of Use. The update date appears at the top of the document.
13. Contact us
Personal data: contact@braike.com. Address: 18 bis rue de Villiers, 92300 Levallois-Perret.