Legal
Privacy policy
BridgeStick is a product of Davait, Inc. This policy says what BridgeStick collects about you and the data you connect, why, where it is kept, for how long, and how to have it deleted.
Who is responsible
- Davait, Inc., a Delaware corporation (8 The Grn Ste B, Dover, DE 19901-3618, United States), owns, develops and operates BridgeStick — bridgestick.com, app.bridgestick.com and api.bridgestick.com — and is responsible for the personal data this policy describes.
- For anything about this policy or your data, write to info@davait.com. For help with BridgeStick itself, write to team@davait.com.
What we collect
- Your account: your email address and the identifier Firebase Authentication gives your account. When you sign in with a password, Firebase Authentication keeps it, never BridgeStick; signing in with Google shares your email address with us.
- What you configure: your sources, destinations, connections, schedules, links, agents, API keys (stored as hashes) and settings. The credentials of your sources and destinations are encrypted before they are stored.
- What runs: the history of your jobs, comparisons, notifications and audit trail.
- Push notifications: when you turn them on in a browser, the token Firebase Cloud Messaging gives that browser, until you turn them off or sign out there.
- Server logs: each request to the API, with the address it came from; session tokens and keys are masked in them.
The data you move
- When a connection runs on a link, its rows are read and written by the agent inside your network and do not reach BridgeStick's cloud.
- Rows reach BridgeStick's cloud only when you ask for them there — the data API, Explore, a comparison of a private source — or when every end of a connection is public. They are processed to do that and not kept, except the results of comparisons, which can include the values of the rows that differ and are kept with the comparison's history.
- We never sell your data, and never use it for advertising or to train models.
Why we use it
- To provide the service you sign up for: your account, your connections and their runs (our agreement with you).
- To keep the service secure and working: logs, backups and the prevention of abuse (our legitimate interest).
- To answer you when you write to us.
Where it is kept, and who processes it
- BridgeStick's cloud runs on Google Cloud in the United States (South Carolina,
us-east1). Sign-in runs on Firebase Authentication, its pages protected by Firebase App Check with reCAPTCHA Enterprise (which assesses the browser's signals there to tell people from bots), push notifications are delivered by Firebase Cloud Messaging, and this site and the app are served by Firebase Hosting, all run by Google. - Google processes this data on our behalf, under its terms for Google Cloud and Firebase. Let's Encrypt issues the API's certificate and receives no personal data.
- If you are outside the United States, your data is transferred there.
How long we keep it
- Your account: until you ask us to delete it. What you configure: until you delete it, or your account is deleted.
- Run history: the number of days you choose in the app (3 by default). Server logs: 8 weeks. Backups of the control database: 14 days.
- When your account is deleted, everything of it is deleted at once, your sign-in at Firebase Authentication included; what remained in backups and logs is gone within 14 days and 8 weeks.
Your rights
- You can ask to access, correct, export or delete your data, or object to how it is used, by writing to info@davait.com. We answer within 30 days.
- You can also complain to the data protection authority where you live.
Security
- How BridgeStick protects data is set out on the Security page: tenant isolation, encrypted secrets, signed agent identity, outbound-only agents and allow lists.
Children
- BridgeStick is a tool for businesses and is not meant for anyone under 16.
Changes to this policy
- This policy changes when BridgeStick does; the date of the last change is at the top. A change that matters is announced in the app or by email before it applies.
Bridge your data with nothing bent on the way.
Create your space, connect a source and run your first sync — free during early access. When your systems are private, an agent is one command away.