Privacy Policy

Last updated: April 2026

Overview

Brickslasher ("we", "us") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

Data We Collect

Account data: your email address and organisation name, provided at signup via Supabase Auth.
Databricks metadata: cluster names, job names, runtime versions, and cost usage figures — collected read-only during scans. We never store credentials.
Usage data: scan history, findings, savings estimates, and action logs, stored per organisation in our database.
Billing data: subscription status managed by Stripe. We do not store card details.

How We Use Your Data

To provide the Brickslasher cost optimisation service.
To send reports and alerts you have configured (email, Slack, Teams).
To improve detection rules and benchmarks using anonymised, aggregated scan metrics.
We do not sell your data to third parties.

Data Retention

Scan data is retained for as long as your account is active. You may request deletion at any time by emailing support@brickslasher.org.

Security

All data is encrypted in transit (TLS) and at rest. Scheduled scan credentials are encrypted with AES-256 before storage and never logged.

Your Rights (GDPR / UK GDPR)

If you are located in the EEA or UK, you have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data ("right to be forgotten").
Restriction: Request that we restrict processing of your data in certain circumstances.
Portability: Receive your data in a structured, machine-readable format.
Object: Object to processing based on legitimate interests or for direct marketing.
Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email support@brickslasher.org. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Data Processors

We use the following third-party processors to deliver our service:

Supabase — authentication and managed PostgreSQL database. Hosting region listed at support@brickslasher.org on request.
Stripe — subscription billing and payment processing
Railway.app — cloud infrastructure and application hosting
Google Analytics (GA4) — anonymous website analytics (landing page only)
Gmail / Google SMTP — transactional email delivery

Each processor is bound by a Data Processing Agreement (DPA) and processes data only as necessary to provide their service.

Contact

For privacy questions, email support@brickslasher.org.