Privacy Policy

Berdely is operated by Berdely LLC, Republic of Azerbaijan ("we"). In Berdely you create AI agents, give them tasks, and the agent returns a result (text or files). This page explains in plain language what data we store, who we share it with, and how you can delete it.

• Account — email, name (optional), a hash of your password (the plain password is never stored), time zone, plan and credit balance.
• Agents — the agent's name, role, instructions and settings.
• Jobs — the text of tasks you give, chat messages, the agent's answer and status.
• Files — files you upload and result files the agent creates.
• Connected services — the service name and an encrypted access token (see §4).
• Technical records — sign-in and security events, credit history, error logs.

We do not sell your data and we do not run tracking advertising.

• To carry out your task and show you the result.
• To protect your account, prevent abuse and charge credits correctly.
• To keep the service running and fix errors.

We process your data only for these purposes.

• Each user connects to an external service (for example Canva) only with their own account. Nobody uses another person's account, and users cannot see each other's connections.
• The access token issued by the service is stored in our database encrypted with AES-256-GCM. The encryption key is kept separately from the database.
• You can remove the token at any time: the "Ayır" (Disconnect) button on the connected service card deletes the token from our database. You can also revoke access on the service's own "connected apps" page.
• When Google and other services are connected through the automation engine, the tokens are stored there, encrypted with the engine's own key. Execution data in the engine is kept for at most 7 days.
• The agent reads from a connected service only what it needs to carry out your task. Before any changing operation (such as creating or editing a design) we ask for your approval.
• We do not store the short-lived signed preview and download URLs that services return (for example a design image): variant previews stay only while the choice card is open and are removed when the job ends; the result file is downloaded and attached to your files, and the URL itself is not written down.

• Anthropic (USA) — the AI provider. The text of your task, chat history, the content of files you upload, and the service results the agent reads are sent to it to produce an answer. Your password and tokens are not sent.
• Vercel — hosting for the application and the file storage for uploaded files.
• Neon — the database (Frankfurt).
• Hetzner (Germany) — the server of the service that runs agent tasks.
• Resend — sends verification codes and notification emails (only your email address).

Anthropic is located in the USA, so data is transferred outside your country, under appropriate safeguards.

Payments do not go through Berdely and we do not collect or store card details. When a paid plan is opened, payment will be handled by a separate payment provider and this page will be updated.

If you sign in with Google we receive only your email address and profile name (scopes: openid, email, profile). We do not request access to Gmail, Drive or other Google data through this sign-in. If you connect your Google account separately for a service, only the permissions that service shows are used. You can also revoke access at any time at myaccount.google.com/permissions.

We use information received from Google APIs only to provide the feature you connected. We do not use it for advertising, we do not sell it, and we do not use it to train general AI models. Humans may read it only with your permission, for security, or where the law requires. This complies with the Google API Services User Data Policy, including the Limited Use requirements.

Berdely’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

• External service tokens are encrypted with AES-256-GCM (§4).
• Passwords are hashed with Argon2id.
• All connections are encrypted with TLS.
• Every request checks that the agent, job, file and connection belong to you.
• Logs do not contain full file URLs or tokens.

• Account, agents, jobs and files — until you delete them or close your account.
• External service token — until you press "Ayır" or delete your account.
• Verification codes — 10 minutes.
• Security records — after account deletion, kept only in anonymized form (email turned into a hash).

With Settings → "Delete account" you can permanently delete your account at any time. This deletes your agents, jobs, chats, uploaded and generated files, connected service tokens and your data in the automation engine. To remove just one connection, press "Ayır" on its card. If the button does not work or you need help, write to destek@berdely.com.

You may access, correct, delete, object to the processing of, and receive a portable copy of your data. Write to us to do so. You may also complain to the data protection authority in your country.

We use only the cookie that is necessary for your sign-in session; there are no advertising or tracking cookies. The service is not intended for people under 16.

When this policy changes we update the date on this page and tell you about important changes by email.

Questions and requests: destek@berdely.com

Canva is a trademark of Canva Pty Ltd. Berdely is an independent product: it works with Canva but is not a Canva product.