Skip to content
TealbrickBring your next client (opens WhatsApp)

Legal

Privacy Policy

This policy explains which personal data Polygonface processes as controller to run Tealbrick Portal, sell licences and operate tealbrick.com, why, where it is stored, who receives it and what rights you have under the GDPR. It also explains which data we process only on behalf of our business customers. It applies to business and consumer customers. Effective date: 15 October 2026.

Version 1.1 · Last updated 15 October 2026

1. Who is responsible

The controller of the personal data described in sections 4 to 12 is Polygonface s.r.o., Sládkovičova 60, 974 05 Banská Bystrica, Slovakia, registered in the Commercial Register of the District Court Banská Bystrica, Section Sro, Insert No. 29301/S; company ID (IČO) 50187210, tax ID (DIČ) 2120203151, VAT ID (IČ DPH) SK2120203151. Tealbrick is a brand of Polygonface s.r.o.

For any privacy question or request, contact support@tealbrick.com. We have not appointed a data protection officer.

2. Our role: controller or processor

  • Account Data (sign-in, your Portal account record, contact, licences, orders, billing), website and security data, and messages you send us: Polygonface decides how this data is used. We are the controller, and this policy applies.
  • Workspace Data of business customers that Portal stores for a customer’s workspace (canvas configuration and drafts, agent cards, grants and policies, skill texts, Mini App setting values, deployment records, status reports from the customer’s bridge, and the workspace audit log), and the deploy logs that Portal shows during a deployment: the customer decides how this data is used. We act as the customer’s processor under the Data Processing Addendum. Section 6 describes this processing for transparency; the customer is responsible for informing the people concerned.
  • Workspace Data of consumer customers: if you use Tealbrick as a consumer (for purposes outside your trade, business or profession), the Data Processing Addendum does not apply. We are the controller of your Workspace Data and process it under this policy, only to provide the services to you.
  • Content and data in the customer’s apps in its own hosting account, the tool calls its agents make, and API keys entered in the page served by the customer’s bridge: we do not store or process them. Portal does not receive them.

3. What this policy covers, and what it does not

This policy covers the personal data that we process as controller to run Tealbrick Portal (“Portal”), to sell licences and to operate the tealbrick.com website.

It does not cover the content and data in the mini apps a customer deploys (for example Knowledge documents and memories, or the accounts, connectors and channels set up in Connect). Those apps run in the customer’s own hosting account, such as its own Railway project, and the customer controls that data.

We sell to businesses and to consumers. If you use Portal for your employer or client, that business is our customer.

4. Personal data we process as controller

Identity and sign-in

Name, email address, password (held by Clerk as a hash), sign-in method, external accounts you link for sign-in (such as Google or GitHub), multi-factor authentication settings, sessions, and the device, browser and IP address used to sign in. Held by Clerk.

Portal account record

An internal user ID, a link to your Clerk account, your email address, your name and, where Clerk provides it, your profile image address. Held in the Portal database.

Hosting-account connection

The Railway access token you give Portal when you link your Railway account. Portal stores it encrypted with AES-256-GCM and uses it only for actions you start (Terms of Service, section 3.7). Portal deletes it when you unlink Railway or delete your account. This does not revoke the token at Railway: to end the access fully, also remove Tealbrick’s access in your Railway account settings.

Licences, orders and billing

Licences and their status, the workspace each is assigned to, orders, whether you buy as a business or as a consumer, your business name and VAT ID if you give them, your request for immediate supply and your acknowledgement about the right of withdrawal (consumers), the Stripe customer and payment references, and refund and dispute review status. Held in the Portal database. Card details, billing address and tax ID are held by Stripe.

Terms acceptance

The version of the Terms of Service you accepted and the time of acceptance. Held in the Portal database.

Technical and security data

IP address, request time, path and status in hosting logs, bot-check signals at sign-in, and the technical data of the connection when a workspace bridge contacts Portal to enrol or to fetch its configuration. Held by Railway, Clerk and Cloudflare. Error reports (route, error code, type of error, stack frames, with personal data and IP addresses removed) are held on our own GlitchTip server.

Messages

What you write when you email us at support@tealbrick.com, security@tealbrick.com or legal@tealbrick.com. Held by Proton AG (Proton Mail), Switzerland.

All personal data above comes from you, from your use of the services, or from Clerk and Stripe when they report your sign-in or payment to us.

  • Create and run your account, sign you in, connect your hosting account, deploy and manage apps for you, issue agent identities and grants. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
  • Sell licences, take payment, issue receipts and invoices, and find out whether you buy as a business or as a consumer (for tax and consumer rights). Legal basis: performance of a contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c).
  • Handle withdrawals, refunds, conformity claims and complaints, and record consumers’ requests for immediate supply. Legal basis: legal obligation, Art. 6(1)(c), and performance of a contract, Art. 6(1)(b).
  • Provide the services to consumer customers, including storing their Workspace Data. Legal basis: performance of a contract, Art. 6(1)(b).
  • Keep accounting and tax records. Legal basis: legal obligation, Art. 6(1)(c).
  • Record your acceptance of our terms, prevent abuse and fraud, secure the services, enforce rate limits, handle refunds and disputes. Legal basis: legitimate interests in operating secure and reliable services and in proving our contracts, Art. 6(1)(f).
  • Find and fix errors (error monitoring). Legal basis: legitimate interests in reliable services, Art. 6(1)(f).
  • Send security notices about our products, as the Cyber Resilience Act requires. Legal basis: legal obligation, Art. 6(1)(c), and performance of a contract, Art. 6(1)(b).
  • Answer your messages and support requests. Legal basis: performance of a contract, Art. 6(1)(b), or legitimate interests, Art. 6(1)(f).
  • Establish, exercise or defend legal claims. Legal basis: legitimate interests, Art. 6(1)(f).

We do not sell personal data, we do not use it for advertising, and we do not send marketing emails. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

You need to give the identity and payment data marked as required in order to have an account and to buy a licence. Without them we cannot provide the services.

6. Data we process for our business customers (processor)

When a business customer uses Portal, Portal stores Workspace Data for that customer: canvas configuration and drafts, agent cards (name, purpose, harness, mode), grants and policies, skill texts and Mini App setting values the customer enters, deployment records (including the names of its hosting projects and services), status reports from its bridge (app states and versions, connection identifiers and client names, key names without values, scope labels and short status texts that apps write), and an audit log of who did what and when. During a deployment or update that the customer starts, Portal reads the build and start-up log lines of that service from the customer’s hosting provider and shows them to the customer, with recognisable secrets removed; Portal does not store these lines.

We process this data only on the customer’s instructions under the Data Processing Addendum. The customer is the controller. For consumer customers, we store the same kinds of Workspace Data as controller under this policy (section 2). If you are one of the people named in a customer’s Workspace Data, please address requests to that customer; if you contact us, we forward your request to the customer.

The audit log is kept for 365 days and then deleted. The audit log stores no IP addresses.

7. Who receives personal data

We use a small number of service providers to run the services, for example for hosting, sign-in, payments and email. Each one, the data it receives and where it is located are listed on the Subprocessors page. They may use the data only on our instructions.

Stripe also processes some payment data as an independent controller, for example to prevent fraud and to meet its own legal obligations. Its privacy policy applies to that processing.

We disclose personal data to public authorities only when the law requires it, for example to the national cybersecurity authority in a security incident report, which we keep free of personal data where possible. If the Tealbrick business is transferred to another company, the personal data needed to continue the services may be transferred with it.

The tealbrick.com website and Portal do not load advertising or analytics scripts.

8. Where data is stored and international transfers

Portal (its web front end and its core service), its database and the tealbrick.com website run on Railway in the EU West region (Amsterdam, Netherlands). Backups of the database are kept with Railway in the same project and region.

Some providers are based outside the European Economic Area or process data there: Clerk (sign-in), whose data is hosted in the United States; Stripe and Cloudflare for parts of their services; and Proton AG in Switzerland for email. Transfers to the United States rely on the EU–US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses. Transfers to Switzerland rely on the European Commission’s adequacy decision for Switzerland. You can ask us for a copy of the relevant safeguards.

9. How long we keep data

  • Account record, licences and hosting-account connection: while your account exists. When you close your account, you can ask for an export of your Workspace Data for 30 days; after that we delete the remaining account and workspace records within 30 days.
  • Railway access token: until you unlink Railway or delete your account.
  • Terms acceptance records, records of consumers’ requests for immediate supply, withdrawals and complaints: for the life of the account and then as long as claims under the contract can be brought.
  • Audit log: 365 days, then deleted. The period is the same for every workspace.
  • Database backups: daily snapshots for 6 days, weekly snapshots for 27 days and nightly database dumps for 14 days. Older backups are deleted automatically, so deleted data leaves the backups within 27 days.
  • Orders, invoices and other accounting records: as long as Slovak accounting and tax law requires (currently up to 10 years).
  • Hosting logs: for the limited period set by Railway, then deleted by Railway.
  • Error reports: on our own GlitchTip server, at most 90 days.
  • Emails: as long as needed to handle your request, and up to 3 years for records of security reports and legal notices.
  • Data held by Clerk and Stripe: until your account is deleted, and then as their own legal obligations require.

You can delete your account from your account settings. When you do, Clerk deletes your sign-in identity, and Portal disables your account: it refuses every later request, ends your sessions, refuses pending device sign-ins and deletes the Railway connection it holds. The remaining records are deleted as described above.

Deleting your Tealbrick account does not delete apps or their data in your own hosting account. You can delete them there.

This section is our cookie notice. It lists the cookies and browser-storage items that tealbrick.com, the Portal web app and our sign-in service set.

We use only cookies and browser storage that are strictly necessary to provide the service you ask for: to sign you in, to keep your session secure, to protect sign-in from bots, and to carry a pairing or setup step across a sign-in redirect. We do not use analytics, advertising, social-media or other tracking cookies, and no third-party scripts set tracking cookies on our pages.

Strictly necessary cookies and storage do not need your consent under Article 5(3) of the ePrivacy Directive (2002/58/EC) and § 109(8) of the Slovak Electronic Communications Act (No. 452/2021 Coll.). For this reason we do not show a cookie consent banner. If we ever add a cookie that is not strictly necessary, we will ask for your consent before we set it.

  • Clerk session cookies (__session, __client_uat, __refresh, each of which may carry a suffix). Set by Clerk on our sites. Purpose: keep you signed in and keep your session up to date. The session token is short-lived and renewed while you are signed in; the others last up to the session lifetime or at most one year.
  • Clerk redirect cookies (__clerk_handshake, __clerk_redirect_state). Set by Clerk. Purpose: pass your sign-in state safely between the sign-in service and the site during a redirect. Duration: a few minutes at most.
  • Clerk browser cookie (__client). Set by Clerk on its sign-in domain. Purpose: identify your signed-in browser to the sign-in service. Duration: until you sign out, up to the session lifetime.
  • Cloudflare cookies (__cf_bm, _cfuvid). Set by Cloudflare on the sign-in domain. Purpose: protect the sign-in service from bots and abuse. Duration: 30 minutes; end of browser session.
  • Clerk local storage (__clerk_environment). Set by Clerk. Purpose: keep the sign-in service’s public settings, so the sign-in form loads quickly. Duration: until you clear your browser storage.
  • Session storage of the Portal web app (tb.pair.state, tb.onboarding.return, tb.onboarding.step). Set by Tealbrick. Purpose: carry a pairing or setup step across a sign-in redirect. Duration: removed after use, or when you close the tab.

Sign-in may include a bot check from Cloudflare Turnstile, provided through Clerk; Turnstile does not set advertising or tracking cookies. Our web fonts are served from our own servers. You can block or delete cookies in your browser settings, but you will then not be able to sign in.

11. Security

  • All traffic uses HTTPS.
  • Portal’s signing keys and the Railway access token are sealed with AES-256-GCM under a key held outside the database. Credentials are stored as one-way digests where possible.
  • Database backups are kept with our hosting provider in the same region.
  • Sign-in, multi-factor authentication (required for account owners), bot protection and sessions are provided by Clerk. Staff access to Portal is limited to people who need it.
  • Your agents’ tool calls and the API keys you enter in the bridge page never pass through Portal, so they cannot appear in its logs.
  • Error reports contain the route, the error code, the type of the error and stack frames, not request bodies, cookies or tokens; our error-monitoring server removes personal data and IP addresses before it stores a report.

No system is perfectly secure. If you find a security issue, report it to security@tealbrick.com (see tealbrick.com/security). If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.

12. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.

To exercise a right, contact support@tealbrick.com. We answer within one month. We may ask you to confirm your identity. For Workspace Data of a business customer and for data in a customer’s own hosting account, the customer is the controller; we forward requests about that data to the customer. If you are a consumer customer, we handle requests about your Workspace Data ourselves.

You also have the right to lodge a complaint with a supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, https://dataprotection.gov.sk. You can also contact the authority in the EU country where you live or work.

13. Children

The services are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We update this policy when our practices or the law change. We tell account holders about material changes by email or in Portal before they take effect. Each version shows its version number and the date it was last updated.

Contact

Polygonface s.r.o., Sládkovičova 60, 974 05 Banská Bystrica, Slovakia, registered in the Commercial Register of the District Court Banská Bystrica, Section Sro, Insert No. 29301/S; company ID (IČO) 50187210, tax ID (DIČ) 2120203151, VAT ID (IČ DPH) SK2120203151.

Email: support@tealbrick.com. Tealbrick is a brand of Polygonface s.r.o.