Privacy policy
Last updated: October 31, 2026
SKKIRB publishes CreaBrikks. This page describes the personal data we process, our reasons, how long we keep it and your rights.
1. Who processes your data
SKKIRB, a French société par actions simplifiée (simplified joint-stock company), 24 boulevard de la Reine, 78000 Versailles, France, registration number 944 173 657 (Versailles Trade and Companies Register, RCS). Contact: contact@brikks.co.
SKKIRB plays two roles:
- Controller for visitors to this site, for people who book a demo and for user accounts. SKKIRB then decides which data it collects and how it uses them.
- Processor for the agency, for the content of its workspace: its clients' data, briefs, deliverables, annotations. The agency decides, and SKKIRB follows its instructions (section 3).
2. Data, purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Measure the audience of this site with Google Analytics | Pages viewed, clicks on "Book a demo", clicks on links to other sites, random cookie identifier, device, browser, approximate location | Your consent (Article 6(1)(a); Article 82 of the French Data Protection Act) |
| Arrange a demo | Name and email address entered in Google's booking calendar, then our exchanges | Steps taken at your request before a contract (Article 6(1)(b)) |
| Create and manage your account | First name, last name, email address, language, hashed password, profile photo, identifier and email address of the linked Google or Microsoft account, role in each workspace, dates of creation, last sign-in and deactivation; for each signed-in browser, its User-Agent header (browser and system), its sign-in date and the date of its last activity |
Performance of the terms of use the agency accepted; for its members and invited clients, SKKIRB's legitimate interest in giving them the service the agency asked for (Article 6(1)(b) and (f)) |
| Send the service's emails | Email address, name, language, invitation or password reset link | Same as the row above |
| Protect the service | IP address, addresses of the pages requested, dates and times, sign-in attempts per email address and per IP address, identifier and email address of the signed-in account when an error occurs | Legitimate interest: protecting the service and its users (Article 6(1)(f)) |
| Host workspace content | The content the agency and its clients upload | Instructions of the agency, the controller (section 3) |
If you sign in with Google or Microsoft, that provider sends us an identifier, your email address, whether it has verified that address, your first name and your last name.
SKKIRB sells no data and uses none for advertising.
3. Workspace content
In a workspace, the agency is the controller of the content its members and clients upload. SKKIRB hosts and processes that content on the agency's behalf and on its instructions, under the data processing agreement annexed to the terms of use.
To exercise your rights over this content, contact the agency. If you write to us, we pass your request on to the agency.
4. Access by the Brikks team
The Brikks team can access workspace content, for operations and support, under a duty of confidentiality. The team is made up of the SKKIRB staff who administer CreaBrikks.
For support, a member of the Brikks team can sign in as you. They then see what you see and act in your name. We keep a record of each session: the team member, your account, the start and the end. A session in progress appears in the list of devices on your profile, and you can close it.
5. Recipients
- The Brikks team (section 4).
- Agency members in a workspace: they see the name, email address and profile photo of the other agency members and of the invited clients of that workspace, and the invited addresses. An invited client sees neither the agency members nor the other invited clients.
- The processors in section 6, each for its own service.
6. Processors
| Provider | Service | Data location | Transfers outside the European Union |
|---|---|---|---|
| Heroku (Salesforce, Inc., United States) | Application, PostgreSQL database and its backups | Ireland | Data Privacy Framework (Salesforce's certification covers Heroku) |
| Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) | File storage (S3), email sending (SES), file delivery (CloudFront) | Sweden (Stockholm) for S3 and SES; CloudFront keeps temporary copies in its points of presence around the world | Data Privacy Framework and standard contractual clauses |
| Cloudflare (Cloudflare, Inc., United States) | DNS and proxy for the production addresses | Cloudflare's global network | Data Privacy Framework and standard contractual clauses |
| CloudAMQP (84codes AB, Sweden) | Message queue for background tasks | Ireland | None |
| Papertrail (SolarWinds Worldwide, LLC, United States) | Logs of the application and of the Heroku router | United States | Standard contractual clauses (SolarWinds data processing addendum) |
| Google (Google Ireland Limited, Ireland, and Google LLC, United States) | Sign-in with Google, demo booking calendar, Google Analytics | European Union, United States and other countries where Google operates | Data Privacy Framework (Google LLC) |
| Microsoft (Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, United States) | Sign-in with Microsoft | European Union, United States and other countries where Microsoft operates | Data Privacy Framework (Microsoft Corporation) |
For sign-in, Google and Microsoft also process your data as controllers, under their own privacy policies.
The logs (Papertrail) may contain invitation and password reset links, and the internal identifier of your account. Only the Brikks team reads the logs.
No AI provider processes any data today. When the product uses one, it will join the list of processors after a notice period (see the terms of use).
7. Retention periods
- Account: SKKIRB keeps your data until the agency's contract ends. Within the 30 days that follow the export period (article 10 of the terms of use), SKKIRB deletes your account if it belongs to no other workspace. The same rule applies to an account the Brikks team has deactivated and to a user whom the agency has removed from a workspace. You can ask for erasure sooner at contact@brikks.co: we handle the request by hand, within one month.
- Invitation: the link is valid for 7 days. The invitation (invited address, author, dates) stays on record with the workspace data. Revoking an invitation erases it at once. Deleting one of the agency's clients also erases the invitations that attached people to it.
- Password reset link: 1 hour.
- Session: it closes after 8 hours of inactivity.
- Signed-in devices: we erase a browser's data when you sign it out (from that browser or from your profile), when you change your password from another browser and when you reset your password. When that browser is no longer signed in (8 hours without activity, or the end of the "Remember me" cookie), we erase them at your next sign-in, or with your account.
- Brikks team sessions as you: we keep their record with your account.
- Sign-in attempts: we count them for one minute.
- Logs (Papertrail): 7 days, searchable for the first 2 days.
- Database backups: Heroku keeps the last 7 daily backups, one weekly backup and the last 5 manual backups. Deleted data leave the backups as they rotate.
- Files: CloudFront may keep a copy of a deleted file for up to 24 hours.
- Workspace content: when the contract ends, the agency has 30 days to ask for an export; SKKIRB deletes the content within the following 30 days.
- Demo request: 3 years after your last contact, the period the CNIL (French data protection authority) recommends for prospects.
- Google Analytics: Google keeps the measurement data for 14 months.
8. Cookies
| Cookie | Where | Role | Duration |
|---|---|---|---|
| Session | The application | Keep you signed in | Until you close the browser; the session expires after 8 hours of inactivity |
| "Remember me" | The application, if you turn on the option when signing in with a password, Google or Microsoft | Sign you back in without a password | 30 days |
| Device | The application, at each sign-in | Recognise this browser in the list of your devices, and accept the "Remember me" cookie only with it | 30 days |
__Host-csrf-token_… |
Pages that contain a form | Protect form submissions against request forgery | Until the form is sent, at the latest until you close the browser |
cb_consent |
This site | Keep your choice about audience measurement | 6 months |
_ga, _ga_<identifier> |
This site, after "Accept all" | Google Analytics: tell visitors apart | 13 months, not extended on later visits |
The first five cookies sign you in, protect form submissions and keep your choice. The CNIL exempts from consent the cookies strictly necessary for a service you ask for, and lists authentication cookies and cookies that keep your choice among them.
The Google Analytics cookies wait for your consent. Before you choose, and after a refusal, this site loads no Google script. The "Manage cookies" link, at the bottom of the pages of this site, reopens the choice; withdrawing your consent deletes the _ga cookies.
We have turned off Google Signals and ad personalisation. Google derives an approximate location from your IP address, on European servers, then discards the address.
9. Your rights
You can access your data, rectify them, erase them, restrict their processing, object to processing based on our legitimate interest and receive your account data in a machine-readable format. You can withdraw your consent at any time through the "Manage cookies" link. You can also set instructions about what happens to your data after your death.
Your profile lets you change your first name, last name, language, photo and password, and link or unlink a Google or Microsoft account. For anything else, write to contact@brikks.co. We answer within one month. If we have doubts about your identity, we may ask you to prove it.
You can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), at www.cnil.fr/fr/plaintes, or with the data protection authority of your country of residence.
10. Security
- Every page goes through HTTPS.
- We store your password in hashed form.
- We limit the number of sign-in attempts per email address and per IP address.
- Files stay private: each reading link carries a signature and expires within two hours.
- We strip the GPS position and other metadata from your profile photo.
- Only the agency members and the Brikks team can access a workspace. An invited client sees only the projects of their client there.
11. Changes
We update this policy when the service changes. The date at the top of the page shows the latest version. Before a significant change, we notify the agencies by email.