A heavy studded plank door seen straight on and shut, a hinged brass shutter closed at eye height and a plain iron ring handle below it
Security & privacy4 min read

What does bernard do with my data, and is it GDPR-compliant?

Handing your business to a new home means handing over data - your email, your site, your customers’ details - so it’s fair to want to know exactly what happens to it. Here is the plain version. The formal detail lives in our Privacy Policy and Terms, and everything below is consistent with them.

The prompt

“Tell me exactly what personal data you hold about me and about the people in my contacts, where it’s stored, who else can see it, and the steps to export or delete all of it.”

Signed in, Get my prompt fills in your site for you. Otherwise press Copy and fill in the [bracketed] parts. First time? Connect your AI to bernard once: Use your own AI (opens in a new tab).

Your content and AI - the honest answer

bernard does not train anyone else’s AI on your site, and never uses your data to serve another customer. What it does do - and it’s worth being straight about this - is study how the product is used, including the editing conversations you have with your AI, so the tools get better over time. That study only ever happens in aggregated or de-identified form: patterns across many people, never your content handed to someone else.

If you connect your own AI, the key that connects it is encrypted and never shown back to your browser. Your site content and your chats aren’t sold, aren’t used for advertising, and aren’t fed into anyone’s model to be served up elsewhere. The Privacy Policy sets out the exact wording, including the lawful bases we rely on.

Where your data lives

bernard’s own hosting is in Ireland. Your account, your site, your contacts and your files are held with Amazon Web Services and Supabase in their Ireland regions. When your site is published, the original files stay in Ireland, and Cloudflare keeps cached copies in its data centres around the world so pages load quickly wherever your visitors are.

Some of the providers named in the Privacy Policy process data outside the UK and EEA, for example Stripe for payments, Postmark for email, Google and Microsoft for analytics, and the AI providers. Where they do, the data is protected by safeguards such as adequacy decisions or standard contractual clauses. The International transfers section of the Privacy Policy has the detail.

Your rights under GDPR

You can see it, correct it, take it with you, or have it erased. Those are your rights under GDPR and bernard is built to honour them:

  • See it - ask for a copy of the personal data we hold about you.
  • Correct it - anything wrong, we’ll put right. Most of it you can edit yourself.
  • Export it - take your data with you.
  • Erase it - deleting your account is a genuine, permanent erasure. It removes your account and its files for good; there’s no hidden copy left behind. See how that works in the Terms.

To exercise any of these, email hello@bernardmoves.com - or read the Your rights section of the Privacy Policy, which also tells you how to complain to the regulator if you’re ever unhappy with how we’ve handled a request.

Who else touches your data

A short list of trusted suppliers, and no one else. To run bernard we rely on a handful of specialist services - for payments, email, hosting and the AI features - and each only receives the data it needs to do its job. We choose them carefully and we never sell your data to anyone. The complete, named list of these suppliers is kept up to date in the Privacy Policy so you can always see exactly who is involved.

Cookies and tracking

Nothing tracks you until you say yes. When you first arrive, bernard asks about cookies and defaults to off - analytics only start once you agree, and you can change your mind at any time. There’s no advertising tracking on the product. The cookies section of the Privacy Policy lists what each one does.

The people you serve

For your own customers’ data, you’re in charge and bernard works for you. The contacts, buyers and students you keep in bernard belong to you: you are the data controller, and bernard is your processor - holding that data on your instructions and never using it for its own ends. That matters because it lets you meet your own GDPR duties to the people you serve. If one of your customers asks to be removed or to see what you hold, you can view, correct, export or delete their record yourself, in a moment. Doing privacy properly for your audience is part of looking professional to them.

Questions people ask

Does bernard use my content to train AI?
Not to train anyone else’s AI on your behalf, and never to serve another customer. bernard does study how the product is used - including AI editing conversations - to make the editing better, but only in aggregated or de-identified form. We do not sell your data and we do not use it for advertising. The full wording is in our Privacy Policy.
Where is my data stored?
bernard’s own hosting is in Ireland: your account, your site content, your contacts and your files are held with Amazon Web Services and Supabase in their Ireland regions, and The original files of your published site are held in Ireland, and Cloudflare keeps cached copies in its data centres around the world so pages load quickly for your visitors. Some of the providers named in our Privacy Policy, such as Stripe for payments, Postmark for email, Google and Microsoft for analytics, and the AI providers, process data outside the UK and EEA under safeguards such as adequacy decisions or standard contractual clauses. The full list is in our Privacy Policy.
Is bernard GDPR-compliant, and what are my rights?
Yes. You can ask to see the data we hold, correct it, export it, or delete it. Deleting your account is a real erasure - it permanently removes your account and its files, not just a hidden flag - and, like every change on bernard, it only happens once you approve it, so nothing is erased by accident. To exercise any right, email hello@bernardmoves.com, and see the Your rights section of the Privacy Policy.
What about the data I keep about my own customers?
For your contacts, buyers and students, you are the data controller and bernard is your processor - we hold that data on your instructions and never use it for our own purposes. You can view, correct, export or delete any contact whenever you need to, which is what lets you answer your own customers’ requests.

Next