What Bryeo collects, and what it doesn't

Only the sources you explicitly connect, and only with read permission:

• Task status, owners, and deadlines
• Cells in sheets and files you connect
• Calendars you connect, for meeting recap
• Audio and transcripts of meetings you send a recap bot to
• Emails you CC to Bryeo, and mailboxes if your company turns that on
• Blockers your team marks

Bryeo only reads from them. Its Google and Microsoft access is read-only, so it cannot edit, move, or delete anything in those accounts. A few tools (Dynamics 365, Azure DevOps, and QuickBooks) only offer permissions broader than reading, and Bryeo uses them only to read. In Slack, Bryeo joins public channels so it can read them, and reads private channels it has been added to.

Separately from connected sources, Bryeo stores what it needs to run the account itself:

• Your name, work email, and the company and role you belong to
• Session cookies that keep you signed in
• An audit record of security-relevant actions: who invited or removed someone, who changed a role, who connected or disconnected an integration, and who opened a support session
• Operational logs kept by our hosting provider, including IP address and request metadata

If you use Meetings, a meeting bot joins the calls you point it at and produces a transcript. That means audio and speech from those meetings (including from anyone else present) leaves Bryeo and is processed by third parties: the meeting-bot provider that captures the call, and a model provider that turns speech into text. Transcripts, participant lists, and anything derived from them are then stored in your company's database alongside the rest of your data.

Recording a meeting has consent obligations in many jurisdictions, and they fall on you as the organiser rather than on Bryeo. No bot joins a meeting until someone in your company sends it to that specific meeting, and an admin can turn Meetings off for the whole company.

Bryeo has an inbound address you can CC. When you do, the full content of that email (subject, body, sender, and recipients) is received by our email provider, verified as genuine by signature, and filed into your company's memory. The message content is sent to a model provider to pick out the decisions and facts worth keeping; quoted history and signatures are dropped first. If you do not CC Bryeo, and your company has not turned on mailbox reading (below), it never sees the message.

A company admin can turn on Email Intelligence. Each person can then connect their own Google Workspace or Microsoft 365 mailbox, or a Microsoft 365 admin can grant read access to the mailboxes of the company's Bryeo members. Bryeo reads new mail only, with read-only access, and never sends, moves, labels, or deletes mail. It skips automated mail, and sends the first 2,000 characters of the rest, with quoted history removed, to a model provider under the routing rules described below, to pick out decisions, commitments, and deadlines.

Bryeo stores sender and recipient details, a snippet of up to 300 characters, and the items it extracts, each with the sentence it came from. What it stores from a mailbox is visible only to that mailbox's owner. Admins see totals, never subjects or text. People can pause or delete their own mailbox data, and it is deleted after a retention period your company sets. Where an employer reads work mailboxes, telling employees is the employer's responsibility.

• Keystrokes
• Screens or screenshots
• Webcams
• Direct messages in chat tools
• Browsing history
• Anything you haven't connected

There is no keystroke logging, screen capture, webcam access, or background activity monitoring anywhere in the product. Bryeo has no agent on anyone's machine and cannot see what someone is doing outside the sources you connect.

Being precise about this, because “we don't monitor people” would be too convenient a summary: Bryeo does derive per-person measures from the work you connect. It records how many tasks someone holds, which are late and by how long, how often deadlines move, and how that changes over time, and it uses those measures to suggest who a task should go to and to flag work at risk. It keeps daily snapshots so it can show a trend.

All of that is computed from task and calendar records you already connected, not from observing anyone. It is nonetheless information about identifiable employees, it is visible to managers and executives in your company subject to the permissions you configure, and employees should be told it exists. Where you are the employer, telling them is your responsibility.

Bryeo does not make automated decisions that produce legal or similarly significant effects about anyone. Its output is a recommendation for a person to act on.

Company data is stored in a Postgres database hosted by Supabase in Singapore, with row-level security enabled on every table so that a query issued for one company cannot return another company's rows. Integration access tokens are encrypted at rest with AES-256-GCM before they are written. Traffic to and from the application is encrypted in transit.

Bryeo relies on the following sub-processors. Each receives only what its function requires:

Supabase

Database and authentication hosting (Singapore).

OpenRouter

Routes MARK requests to a language model, and converts meeting and voice audio to text. Receives the slice of your company data relevant to the question being asked, scoped to the asker's permissions. Text requests instruct OpenRouter to use only model providers that do not store prompts or train on them. Meeting and voice audio uses GPT-4o mini transcribe (see AI processing below).

TypeSafe (through OpenRouter)

Runs Jev, a decision model that sorts, routes and scores incoming work: for example, whether a message contains a commitment, which question a request matches, or which column of a spreadsheet holds due dates. Receives the item being decided on. Called through OpenRouter; returns probabilities, never text.

Vexa

Meeting bot for Meetings. Joins the calls you send it to and captures the audio and transcript.

Vercel

Application hosting, request logs, and page-view counts (Vercel Analytics).

Resend

Transactional email, and receiving the inbound task email you CC.

Connected work tools

Only the sources you connect, and Bryeo only reads from them. Today that can include Google Workspace, Microsoft 365 and Dynamics, Slack, Zoom, Asana, ClickUp, Monday, Atlassian, Azure DevOps, GitHub, Zendesk, Zoho, Freshdesk, HubSpot, Xero, QuickBooks, Fireflies and Fathom. Nothing is contacted until you connect it.

Meta (WhatsApp)

If your company uses Bryeo on WhatsApp, the messages you send to it and its replies pass through Meta's WhatsApp Business platform.

Frankfurter

Daily exchange rates from the European Central Bank. It receives a currency pair, never company data.

PostHog

Website analytics on marketing pages only, not inside the product.

These providers operate in several countries, so using Bryeo involves transferring data outside the country you are in. This list changes as the product changes; this page is the current version of it.

When someone asks MARK a question, Bryeo assembles the portion of your data that the asker is permitted to see and sends it to a third-party model provider to generate the answer. Bryeo does not train any model on your data.

Chat, background summaries, and the decision model carry two routing rules that OpenRouter enforces:

• No data collection: the request may only go to model providers whose published policy is not to store prompts or use them for training.
• Zero data retention: the request may only go to endpoints that keep nothing once the response is returned.

If no provider for one of those models meets both rules, that model is skipped and Bryeo tries the next one. These rules rely on the policies each provider declares to OpenRouter. Bryeo cannot audit those providers directly, and their own terms govern what they do.

Meeting and voice audio is transcribed with OpenAI's GPT-4o mini transcribe, through OpenRouter. OpenAI does not offer a zero-retention endpoint for that model, so those requests require no training and do not require zero retention. Bryeo discards the audio once the transcript is saved. OpenAI's terms govern whether they keep a copy.

Your company data is not published or searchable online. The one feature that reaches the public web is MARK's web research, which is off unless someone turns it on for a message. When it is on, the model writes a search query to look up outside facts, and it is instructed to leave company data, emails, and employee or task details out of that query. That is an instruction to the model, not a technical filter, so leave web research off for questions about confidential matters.

Bryeo also uses a decision model to make small, typed decisions about incoming work, such as whether a message is worth extracting or who an item belongs to. Each decision is logged with a one-way fingerprint of what was decided on, never the content itself.

Bryeo support staff can open a customer workspace to investigate a problem. This is restricted to staff accounts holding that specific permission, every session is written to the audit record with the staff member and the time, and a banner is displayed in the product for the duration so it is never silent. Aside from that, access to production data is limited to what operating the service requires.

Meeting audio is discarded as soon as the transcript is saved, and any stray file is removed nightly. Transcripts are deleted together with their meeting after 90 days by default. Memory, the facts and decisions Bryeo files from email and chat, is deleted after 365 days by default. Both are company settings. Weekly reports and the history of task and deal changes are kept for two years. Processing logs are kept at least one year and consent records at least seven. Disconnecting a source stops further reads immediately. Erasure removes personal content for a named person while keeping the structural record that aggregates depend on, and completes as backups roll off.

Depending on where you are, you may have the right to ask for a copy of the personal data Bryeo holds about you, to have it corrected, to have it deleted, to object to or restrict how it is used, and to complain to a data protection authority. Bryeo honours these requests regardless of whether the law where you live compels it.

Where your employer connected the data, they decide what is collected and Bryeo processes it for them, so a request about your own records is usually fastest through your employer. You can also write to us directly at the address below and we will route it.

If a breach affects your data, Bryeo will notify affected customers and the relevant authority without undue delay once the scope is understood, and will say what happened rather than issue a holding statement. Bryeo holds no security certification today and does not claim one.

Write to founders@bryeo.com to have your company's data deleted, to exercise any of the rights above, or to raise a privacy concern. The same address reaches the person accountable for privacy questions at Bryeo. Nothing you own moves or changes in your own Google or Microsoft account either way. Bryeo never had permission to alter it.

Inside the product, Bryeo sets only the cookies needed to keep you signed in and to remember which company you are currently viewing. Vercel Analytics counts page views there without cookies. There is no advertising or cross-site tracking cookie anywhere in the product.

These marketing pages use PostHog, hosted in the EU, to record anonymous usage (page views, scroll depth, which calls to action are clicked, and where the visit came from) to work out which parts of the page are doing their job. It keeps an identifier in a cookie and in local storage in your browser to tell visits apart, and it records no session replays. No product data is involved.