← Back to Home

Privacy Policy

Last updated: October 16, 2026

1. Controller

Nubri GmbH
Liebenowzeile 22
12167 Berlin, Germany
Email: info@nubri.co
VAT ID: DE332956472
Registration: HRB 217794 B, Amtsgericht Charlottenburg

2. Data We Collect

We collect and process the following personal data:

  • Account data from GitHub when you sign in with it: your GitHub id, email address, name and avatar
  • Usage metrics of the Bedrock calls you connect (through our SDK, the proxy or your AWS account's CloudWatch/S3 logs): model, region, token counts, latency, status, cost and the tags you set. Never the prompts or answers: the proxy forwards them to Bedrock without storing them
  • The AWS connections you set up (account id, role ARN, regions), your API keys (stored only as hashes), alert rules and the alerts sent
  • Payment data (processed by Stripe; we keep only your customer and subscription identifiers, never card details)
  • Usage events: a random visitor id and which steps of the site you reached, with the campaign tags you arrived with

3. Legal Basis (GDPR Art. 6)

  • Contract performance (Art. 6(1)(b)): Processing your monitoring data and managing your account
  • Legitimate interest (Art. 6(1)(f)): Improving our service, security measures
  • Consent (Art. 6(1)(a)): Optional analytics or marketing communications

4. Third-Party Services

  • Amazon Web Services (AWS) — servers, database and alert emails (region us-east-1, USA)
  • GitHub — sign-in (USA)
  • Stripe — payments (USA and Ireland)

Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place (the EU-U.S. Data Privacy Framework or the EU standard contractual clauses).

5. AWS Data Processing

BedrockOps connects to your AWS account to retrieve Bedrock usage metrics. We access only the metrics and logs you explicitly authorize. We do not access your AI model inputs/outputs or any other AWS resources beyond what is required for monitoring.

6. Cookies

BedrockOps sets no cookies. Your sign-in token is kept in your browser's local storage (bo_token) and removed when you sign out; local storage also keeps the random visitor id and the campaign tags you first arrived with. No tracking or advertising.

7. Data Retention

Your account data stays while you have an account. Usage metrics are deleted automatically after 30 days on Free, 90 days on Pro and a year on Team. When you delete your account we remove your personal data within 30 days, except where the law requires us to keep it.

Server logs

When you open any page, our web server records your IP address, the time, the address requested, the response and your browser's user agent. We use these logs only to keep the service secure and to find faults (Art. 6(1)(f) GDPR). They are deleted automatically after at most 8 days.

8. Your Rights

Under GDPR, you have the right to:

  • Access your personal data (Art. 15)
  • Rectification of inaccurate data (Art. 16)
  • Erasure of your data (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing (Art. 21)

To exercise your rights, contact us at info@nubri.co. You also have the right to lodge a complaint with the Berlin Commissioner for Data Protection (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

9. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews.