Privacy notice
Version 2026-10-06a. Applies to the Brickstream platform (app.brickstream.se) for consultants, candidates and client users.
1. Controller
Brickstream AB, reg. no. 556792-7644, Linköping. Data protection contact: info@brickstream.se. Brickstream has no data protection officer (not required for our activities).
2. What data we process
- Account: e-mail address, name, phone (optional), language, role. If you sign in with a Microsoft work account, also your organisation’s tenant ID.
- Profile: role, years of experience, town, region, skills, languages, summary, available from, max workload, preferred form of engagement and work mode (on site, hybrid, remote), minimum rate or salary, notice period, LinkedIn address, clients you do not want to be shown to, and two self-declared answers (yes/no/prefer not to say): whether you are or have been security vetted (no level) and whether you are a Swedish citizen. Vetting and citizenship are only used when an assignment has such requirements. The data in those fields is never shown to clients and never sent to AI.
- CV and attachments: up to three CV versions, certificates and grades you upload, and what is read from them. Attachments are never shown to clients.
- Assignments and presentations: expressions of interest, requests to present you and your answers.
- Interview and references: before we propose you for an assignment we have a structured call of about 20 minutes. We keep the interview questions, the interviewer’s short notes, an assessment per area (recommended / with reservations / not recommended) and possibly a summary. Before a client gets your name and CV we take two references: we keep the people you name (name, role, relationship, e-mail and possibly phone), your confirmation that they agreed to be contacted, the status and their answers. If Brickstream knows you first-hand from its own work, we may instead record that (type, since when, a short reason and whether it replaces the interview and/or references). We then keep our decision – verified (12 months) or not taking things further (with an internal reason from a fixed list, never protected grounds) – and the system’s rule-based recommendation.
- Consents: which choices you made, when, and which text version you accepted.
- Company and assignments (subcontractors): company name, reg. no., VAT number, address, bankgiro, F-tax status, assignments, rates, time reports, deviations, expenses, mileage and receipts, self-invoices and payouts. For employees: salary and time.
- Client users: name, e-mail, function (procurement or line manager) and approvals of time.
- Security log: sign-ins (time and method), changes to important data and who opened invoices and reports.
- Support and call-backs: when you ask us to call you back we store your name, phone number, e-mail (optional), topic and preferred time, and your conversation with the assistant if you choose to attach it. Questions in the help assistant are not stored with your name or account. Questions the assistant could not answer are stored without any link to you, and e-mail addresses, phone numbers and ID numbers are removed automatically before storage (pseudonymised), so that we can improve the answers.
- Signing: when you sign an agreement we store the agreement text, a checksum, the time, IP address, browser and who signed. With BankID signing we also receive Zigned’s verification appendix.
- Notifications: messages we send you in the platform and by e-mail.
2a. If we contacted you without you signing up
We may contact consultants, candidates and contact persons at companies when we think an assignment or our service may be of interest. We then use name, professional role, employer or company, skills and contact details obtained from public professional profiles (e.g. LinkedIn), the company’s website, public registers or from someone who referred you. In the first contact we tell you where we got the details. The legal basis is our legitimate interest in offering assignments and services (Art. 6(1)(f)). If you do not want to be contacted again, just reply "no thanks" and we will not contact you again. You also have the rights listed in section 10.
2b. If you have been named as a reference
A consultant can name you as a reference and confirm that you have agreed to be contacted. We then receive your name, your role, your relationship, your e-mail address and possibly your phone number from the consultant and e-mail you a link to five short questions. We use the data only for the reference, based on our legitimate interest in checking consultants’ experience before we share name and CV with a client (Art. 6(1)(f)). Your answers are read by Brickstream and never shared with the client; the consultant sees that you have answered but not what, but may have the right to request the answers under the GDPR (we then balance this against your rights). If the consultant has approved AI reading of their CV, the answers may be summarised with AI (Anthropic, USA), without your name or contact details. The link is valid for 14 days and can be used once. If you choose "No thanks" we erase your details straight away and will not contact you again. Retention: see section 7. You also have the rights listed in section 10.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|
| Account and sign-in | Contract (b) |
| Match you to assignments | Consent (a) – you can withdraw it at any time |
| Show an anonymous card to signed-in clients | Consent (a) – off until you switch it on |
| AI reading of your CV | Consent (a) – only if you tick the box when uploading |
| Present you to a client with name and CV | Consent (a) for each individual assignment |
| Interview before we propose you for an assignment, and references before a client gets your name and CV | Legitimate interest (f) – only proposing consultants we have checked |
| Contact and keep data about the people you name as references (section 2b) | Legitimate interest (f) – checking consultants’ experience |
| AI support for interview questions and summaries of the interview and references | Legitimate interest (f), and only if you have chosen AI reading of your CV; for the need text the client must also have approved AI |
| Assignments, time reports, self-billing and payout | Contract (b) |
| Answer questions in the help assistant and call you back when you asked us to | Legitimate interest (f) – giving you support |
| Bookkeeping and tax | Legal obligation (c) – Bookkeeping Act |
| Ask whether your availability is still correct and send notifications | Legitimate interest (f) – keeping the data we match on up to date |
| Call you back when you asked us to | Legitimate interest (f) – answering your request |
| Signing and evidence of agreements | Contract (b) and legitimate interest (f) – being able to show what was agreed |
| Contact people who have not signed up (section 2a) | Legitimate interest (f) – offering assignments and services |
| Internal AI assistant for operations, support and e-mail | Legitimate interest (f) – operating the service efficiently |
| Security, logging and preventing misuse | Legitimate interest (f) |
| Client users and contact persons | Legitimate interest (f) – performing the agreement with the client |
4. Who sees what
- Brickstream (the owner and staff with specific permissions) sees profiles and CVs in order to match and administer assignments. The owner and staff sign in with two-step verification.
- Clients never see your name, CV or town in the platform. If you chose so, signed-in clients see an anonymous card: role, experience range, region, work mode, month of availability, workload as a range and up to six skills. Clients you excluded, and the client you work for, do not see the card.
- Your name and CV are only shared with a client once you have approved being presented for that specific assignment and two references have answered (or Brickstream knows you from before or has verified you).
- Interview notes and assessments are read by the owner and by staff with the Recruiter permission (the interviewer). The references’ details and answers are read by the owner only. The "known from before" marking and the reason for a decision are read by the owner only. Clients never see notes, assessments, reasons or answers – only the badge "Verified by Brickstream" (or the badges "Interviewed by Brickstream" and "References taken") on the anonymous card.
- At the client, line managers see time and consultants but never prices; procurement sees prices and invoices for their own organisation.
5. Processors and recipients
| Provider | What | Where | Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, sign-in and file storage (CVs, contracts and invoices) | EU – AWS eu-north-1 (Stockholm); support access from third countries may occur | DPA with standard contractual clauses for any third-country support access |
| Vercel Inc. | Hosting of the web application (server functions) and forwarding of the platform’s AI requests to Anthropic via Vercel AI Gateway | EU – region arn1 (Stockholm) for server functions; global CDN for static files (no personal data); AI Gateway may process AI requests in the USA | DPA, standard contractual clauses and EU–US Data Privacy Framework |
| Anthropic PBC | AI reading of CVs (only if you opt in), client need texts, call-offs and purchase orders (only if the client approved) and answers in the "Ask us" assistant when you ask a question (for signed-in users also the account data needed for the answer). Requests reach Anthropic via Vercel AI Gateway (Vercel Inc.) or directly via Anthropic’s API. Also Brickstream’s internal AI assistant (Claude) for operations, troubleshooting, development, support and e-mail | USA | Vercel’s and Anthropic’s terms with DPA and standard contractual clauses; in the platform’s AI requests model training is blocked and only Anthropic is allowed as provider |
| Resend (Plus Five Five Inc.) | Sending e-mail from the platform, sender info@brickstream.se: sign-in e-mails, notifications and invoices as PDF (name, e-mail address, message content and attachments) | EU region (Ireland) for sending; company in the USA | DPA, standard contractual clauses and EU–US Data Privacy Framework |
| Zigned AB | Electronic signing of agreements with BankID (name, e-mail, IP address, device information and the agreement content for the signer; with an identity check also the personal identity number, which Zigned hashes) | Sweden (company). Agreements and signatures are stored in the EU (Heroku and Google Cloud); e-mail delivery via Mailgun and some support (Typeform, Zapier, Slack) take place in the USA. The signed agreement and verification appendix are also stored by us (Supabase, Stockholm) | Zigned’s data processing agreement (v1.0); transfers to the USA under the EU–US Data Privacy Framework or standard contractual clauses |
| Google (Google Workspace) | Company e-mail at brickstream.se (including info@brickstream.se) when you write to us or we write to you, with any attachments. Our internal AI assistant may read and draft e-mails | EU and USA (Google data centres) | Google’s Cloud Data Processing Addendum, standard contractual clauses and EU–US Data Privacy Framework |
| Wint AB | Bookkeeping and accounting: client and self-invoices, payouts, receipts and vouchers (names, companies, amounts and invoice details) | Sweden/EU | Data processing agreement (DPA) with Wint |
For assignments, data is shared with the client (after your approval) with our bank for payouts and with our accounting firm for bookkeeping. Authorities receive data when the law requires it, e.g. the Swedish Tax Agency.
6. Transfers outside the EU/EEA
The database, sign-in and CV files are stored in Stockholm. Brickstream uses AI services from Anthropic PBC (USA). AI requests from the platform go either via Vercel AI Gateway (Vercel Inc.) or directly to Anthropic’s API. Your CV is only sent to Anthropic if you choose AI reading. If you have chosen it, we may also send your profile summary (role, years of experience, skills, languages and summary – never the CV file or contact details) to prepare interview questions, and the interviewer’s notes for a summary; when the client’s need text is included, the client must also have approved AI. Reference answers about you may be summarised on the same terms, without the referee’s name or contact details. Brickstream also uses an AI assistant (Claude by Anthropic) in its internal work: for operations, troubleshooting and support, and to draft and answer e-mails. The assistant may then read the data about you held in the platform and in our e-mail, but only to the extent needed for the task. It makes no decisions about you (see section 8). If you use the "Ask us" help assistant, your question is sent to Anthropic and, if you are signed in, the data from your account needed for the answer (e.g. assignments, time status, company status and self-invoices). If a user at a client asks about time, approvals or contracts, the data about the client’s consultants needed for the answer is also sent (the assignment’s role, reported hours, approval status, contract end and, for procurement, usage against the purchase order), but not the consultants’ names: they are replaced by labels such as "Consultant 1" before the request leaves us, and the names are put back on our side before the answer is shown. If the user names one of the client’s consultants in such a question, the name is replaced in the same way, and e-mail addresses and ID numbers in client users’ messages are always removed. Several of the providers above are US companies; transfers and any support access are protected by the European Commission’s standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework. Our assessment of the transfers is in a separate transfer impact assessment that you can request.
7. How long we keep data
| Data | Retention |
|---|---|
| Candidate profile and CV | Until you erase them yourself (Profile & CV → Your data). Planned: erasure 24 months after your last sign-in, with a reminder 30 days before (switched on once the period is decided). |
| Old CV versions | At most three CV versions are kept; the oldest is removed when you upload more. Files no longer linked to a profile or saved version (for example interrupted uploads) are removed automatically by a daily clean-up. |
| Availability | We ask every six months (or one month before your availability date) whether it is still correct. Without an answer within 30 days your anonymous card is no longer shown to clients. |
| Interview with Brickstream (questions, notes, assessments, summary) | Erased automatically 24 months after the last change, and straight away if you erase your account. Only the fact that an interview was held (date and assignment) remains, without content. |
| References (the referees’ details and answers) | Name, role, relationship, contact details and answers are erased automatically 12 months after the answer. Unanswered requests are erased 30 days after the link has expired. Straight away when the referee declines, when you withdraw the request or erase your account. An AI summary of the answers is erased together with the answers. |
| Known from before and decisions (verified / not taking further) | The reason for "known from before" is erased when the marking ends (after at most 24 months) or 30 days after it was revoked. The reason, note, recommendation and basis of a decision are erased 12 months after the decision. Everything is erased straight away if you erase your account. |
| Contracts, time reports, self-invoices and invoices | 7 years after the end of the calendar year in which the financial year ended (Swedish Bookkeeping Act), with your name and company, even if you erase your account. |
| Sign-in account | As long as you have the account. If you erase your account, it is closed automatically within 30 days: the e-mail address, phone number, password and sign-in details are removed from it. |
| Security log (sign-ins and changes) and consent history | The log cannot be altered afterwards and is currently kept without a time limit, to show who did what and that consent existed. Planned: at most 24 months after the account is closed. |
8. AI and automated decisions
The platform calculates how well a profile matches an assignment based on skills, location and availability. The score is a support; the decision to present you is made by a person at Brickstream and by you. We make no decisions based solely on automated processing that have legal effects for you (art. 22). In the platform, AI is only used to read your CV after your choice, for a client’s need text only if the client has approved it, for interview questions and summaries of the interview and references only if you have chosen AI reading of your CV (and the client has approved AI when the need text is included), and in the help assistant when you ask a question. The interview is held and assessed by a person, and the decision to verify you or not to take things further is always made by a person at Brickstream; the system only gives a rule-based recommendation and AI makes no decisions about you. In addition, our internal AI assistant is used as described in section 6. In the platform’s AI requests, training models on the content is blocked.
9. Security
All traffic is encrypted (HTTPS with HSTS) and data is encrypted at rest. Access is controlled per role directly in the database (row-level security). The owner, staff and client users without company sign-in use two-step verification; clients can require Microsoft sign-in. Important changes are recorded in a log that cannot be altered afterwards.
10. Your rights
- Access and download your data (Profile & CV → Your data → Download). Interview questions, notes, assessments and summary are included, as are the references you named, any "known from before" marking and our decisions with the reason. The references’ answers about you are provided on request after balancing against their rights – e-mail us.
- Correct data (Profile & CV).
- Withdraw consents (Profile & CV → Your data). This does not affect processing before the withdrawal.
- Erase your account (Profile & CV → Your data). Data we must keep under the Bookkeeping Act is kept for 7 years.
- Request restriction, object to processing based on legitimate interest, and data portability – e-mail us.
- Lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
We reply within one month.
11. Cookies and browser storage
We only use necessary cookies: the sign-in session (protected, not readable by scripts), your language choice (kept for one year when you switch language) and during sign-in which address we e-mailed (at most one hour). No analytics or tracking cookies and no third-party cookies.
In the browser’s session storage, which is cleared when the tab is closed, the help assistant keeps the conversation, and long forms (profile, time report, new need) keep what you changed but had not saved yet, so nothing is lost on an error. Drafts are kept per user and form, removed when you save and never used after 24 hours. They may contain e.g. a phone number or rate, but never consents, security vetting or citizenship. Close the tab if you use a shared computer.
12. Changes
We update this notice when the platform changes. Material changes are announced in the platform. See also the terms of use and contact details.