Privacy Policy

1.1This Privacy Policy (the "Policy") applies to the websites birden.kz and app.birden.kz, the API at api.birden.kz and all related services (the "Service") operated by WHILETRUE LLP, BIN 250640007871, [Registered address, Republic of Kazakhstan] (the "Operator", "we").

1.2The Operator processes personal data in accordance with the Constitution of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" No. 94-V (the "Law"), the Law "On Informatization" and other applicable legislation.

1.3By registering an account or using the Service you confirm that you have read this Policy. Where the Law requires consent, consent is given by ticking the box at registration and may be withdrawn as described in section 11.

1.4This Policy covers personal data of users of the Service. Personal data that our customers process in their own deployed applications and document storage is covered by section 12.

2.1"Personal data" means information relating to an identified or identifiable natural person recorded on electronic, paper or other tangible medium.

2.2"Subject" means the natural person to whom the personal data relates.

2.3"Processing" means any action with personal data, including collection, recording, systematisation, storage, modification, use, distribution, depersonalisation, blocking and destruction.

2.4"Owner" and "Operator" have the meanings given in Article 1 of the Law. In relation to data described in section 3 the Operator is both the owner and the operator of the personal data database.

3.1Account data: email address, display name (optional), password hash, language preference, time zone, dates of registration and last sign-in.

3.2Project metadata: names of projects and repositories, branch names, build settings, custom domain names, names (not values) of environment variables, deployment identifiers and statuses, document storage identifiers.

3.3Technical and log data: IP address, browser user agent, request timestamps and paths for the dashboard and API, build and deployment logs, audit events (who did what and when in the account), error reports.

3.4GitHub integration data: when you install the birden GitHub App, we store the installation identifier, the repository identifiers you grant access to and the GitHub account login associated with the installation.

3.5Payment data (when paid plans launch): billing name, legal entity details for invoices (name, BIN, address), payment status and transaction identifiers. Full bank card numbers are processed only by the payment provider and never reach the Operator.

3.6Support correspondence: messages you send to support@birden.kz and our replies.

3.7We do not collect special categories of personal data (health, ethnic origin, political or religious beliefs, biometrics) and we ask you not to send them to us.

4.1Creating and administering the account, authenticating you and protecting the account against unauthorised access.

4.2Providing the Service: fetching repositories, running builds, serving deployments, issuing TLS certificates, provisioning document storage, showing logs and usage.

4.3Metering usage against plan limits, preventing abuse, investigating security incidents and enforcing the Terms of Service and the Acceptable Use Policy.

4.4Billing, issuing invoices and closing documents and complying with tax and accounting legislation of the Republic of Kazakhstan.

4.5Communicating with you about the Service: transactional messages (deployment failures, security alerts, changes to terms) and replies to support requests. We do not send marketing emails without separate consent.

4.6Complying with legal obligations and responding to lawful requests of state authorities of the Republic of Kazakhstan.

5.1Processing of account, project and technical data is necessary to conclude and perform the agreement with you (the Terms of Service) and is carried out on the basis of your consent given at registration, as provided by Articles 7 and 8 of the Law.

5.2Processing of payment data is based on the agreement and on legal obligations under tax and accounting legislation.

5.3Processing for security and abuse prevention is based on the Operator's obligation under Article 20 of the Law to take measures protecting personal data, and on the agreement.

5.4Where processing relies on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing before withdrawal and may make it impossible to continue providing the Service.

6.1All personal data databases of the Service are stored on servers located in the Republic of Kazakhstan, in the Yandex Cloud Kazakhstan region (zone kz1). This includes the platform database, build artifacts, application containers, document storage, logs and backups.

6.2In accordance with Article 12 of the Law, the Operator stores personal data in databases located on the territory of the Republic of Kazakhstan.

6.3Yandex Cloud (Kazakhstan) acts as the infrastructure provider. The provider does not have the right to access personal data for its own purposes and processes data only on the Operator's instructions under the infrastructure agreement.

7.1The Service performs one cross-border data transfer, and only when you choose to connect GitHub: the Operator sends to GitHub, Inc. (United States) the installation and repository identifiers needed to fetch your source code, and GitHub sends the repository contents and webhook events to the Operator. GitHub processes this data under its own privacy policy.

7.2No other personal data is transferred outside the Republic of Kazakhstan. The Operator does not use foreign analytics, advertising, tag-management or customer-tracking services.

7.3If the Operator adds any other cross-border transfer in the future, this Policy will be updated in advance and, where the Law requires, your consent will be requested.

8.1The Operator does not sell personal data and does not share it for advertising.

8.2Personal data may be disclosed to: the infrastructure provider (section 6); the payment provider licensed in the Republic of Kazakhstan (payment data only, when paid plans launch); state authorities of the Republic of Kazakhstan upon a lawful request; successors in the event of reorganisation of the Operator, subject to the same obligations.

8.3The Operator may publish aggregated, depersonalised statistics (for example the total number of deployments) that cannot be used to identify any person.

9.1Account and project data are stored while the account exists and for 30 calendar days after deletion, after which they are destroyed.

9.2Build and deployment logs are stored for up to 90 calendar days; audit events for 12 months; request logs of the dashboard and API for up to 30 calendar days.

9.3Invoices, acts and other accounting documents are stored for the period required by the tax legislation of the Republic of Kazakhstan (currently 5 years).

9.4Backups are overwritten in a normal cycle of up to 90 calendar days. Data deleted from the live system may persist in backups until the cycle completes.

9.5When the retention period ends, personal data is destroyed or depersonalised in a way that makes recovery impossible.

10.1Transport encryption (TLS) for all connections to birden.kz, app.birden.kz, api.birden.kz, preview and production hostnames.

10.2Encryption at rest for secrets: environment variable values, storage credentials and integration tokens are encrypted with per-secret data keys that are themselves wrapped by a master key; a project identifier is bound to the ciphertext so that secrets cannot be moved between tenants.

10.3Passwords are stored only as salted scrypt hashes; sessions are opaque random tokens stored as hashes. Session cookies are HttpOnly and Secure.

10.4Builds run in isolated containers without platform credentials; application containers receive only their own environment variables; each document storage tenant has a separate database and a restricted user.

10.5Access to production systems is limited to authorised personnel of the Operator, uses individual keys and is logged. Secret values are redacted from logs automatically.

10.6The Operator will notify affected users and, where required, the authorised body for the protection of personal data of a personal data breach without undue delay after becoming aware of it.

11.1Under Article 24 of the Law you have the right to: know what personal data about you the Operator holds and obtain it; request correction of inaccurate or incomplete data; request blocking of data in case of violation of the conditions of processing; request destruction of data collected unlawfully or no longer needed for the purpose; withdraw consent to processing; protect your rights and legitimate interests, including by complaining to the authorised body for the protection of personal data or to a court.

11.2Most account and project data can be viewed, corrected and deleted directly in the dashboard at app.birden.kz. Deleting a project deletes its deployments, artifacts, environment variables, domains and document storage; deleting the account deletes the remaining data as described in section 9.

11.3To exercise any right that is not available in the dashboard, write to support@birden.kz from the email address of your account. We respond within 3 business days and complete requests within the period set by the Law.

11.4Where a request concerns data we must retain by law (for example accounting documents), we explain which data is retained and for how long.

12.1Customers deploy their own applications on the Service and may store personal data of their own users in those applications and in document storage. In relation to such data the customer is the owner and operator of the personal data database within the meaning of the Law, and the Operator provides infrastructure on the customer's instructions.

12.2The Operator does not inspect customer application data except as necessary to operate the Service (for example to measure storage quota), to investigate violations, or to respond to lawful requests of state authorities.

12.3Because the Service is hosted in the Republic of Kazakhstan, customers can satisfy the localisation requirement of Article 12 of the Law for the data they store on the Service. Customers remain responsible for the lawfulness of their own processing, for obtaining consents from their users and for their own privacy policies.

13.1The Service uses only functional cookies: the session cookie on api.birden.kz and the language cookie birden_lang. No third-party analytics or advertising cookies are set by default. Details are in the Cookie Policy.

14.1The Service is not directed at persons under 18 years of age. If we learn that an account was created by a minor without the consent of a legal representative, we delete it.

15.1The Operator may update this Policy. The current version is published at birden.kz/legal/privacy with the date of the last update. Material changes are announced by email to the account address or in the dashboard at least 15 calendar days before they take effect.

16.1Owner and operator of the personal data database: WHILETRUE LLP, BIN 250640007871, [Registered address, Republic of Kazakhstan].

16.2Person responsible for personal data processing: [Name, position]. Email: support@birden.kz.

16.3Authorised body for the protection of personal data in the Republic of Kazakhstan: Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan [verify current name].