Deutsch · This is a courtesy translation. The German version is the legally binding version.
Privacy Policy
Last updated: November 3, 2026
1. Controller
Responsible for data processing is:
Toba UG (haftungsbeschränkt)
St. Johannerstr. 41-43
66111 Saarbrücken
Germany
Email: support@toba.solutions
Managing Director: Antonio Sanchez
Registry court: Amtsgericht Saarbrücken, HRB 106153
A data protection officer has not been appointed pursuant to Art. 37 GDPR because there is no legal obligation to do so.
2. General information
This privacy policy explains how we process personal data when you use the Builders Brief website (https://buildersbrief.dev). Builders Brief is a daily one-page brief for people who build software with AI, with news, trends, security issues, benchmarks and prices, and an optional daily email newsletter.
We do not use analytics or tracking services and we do not use cookies.
The website is not directed at children under 16 years of age. We do not knowingly process personal data of children.
3. Legal bases
We process personal data on the following legal bases: Art. 6(1)(a) GDPR for the newsletter, which you subscribe to with your consent; Art. 6(1)(b) GDPR for answering inquiries related to a contract or pre-contractual measures; Art. 6(1)(f) GDPR for secure and stable operation of the website, abuse prevention and handling other inquiries; and Art. 6(1)(c) GDPR where statutory retention obligations apply.
4. Hosting
This website runs on Cloudflare Workers; content and newsletter data are stored in a Cloudflare D1 database. When you visit the website, Cloudflare processes technical access data such as IP addresses, request metadata, browser and device information, timestamps and security logs to deliver and protect the website.
Provider for hosting, database, delivery and security services: Cloudflare, Inc., USA. Privacy information: https://www.cloudflare.com/privacypolicy/. Cloudflare DPA information: https://www.cloudflare.com/cloudflare-customer-dpa/. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing the website securely, stably and efficiently.
5. No cookies, local storage
We do not use cookies. The only information the website stores in your browser is your choice between the light and dark theme (the "theme" entry in localStorage). This entry contains no personal data and is not sent to us. You can delete it at any time in your browser settings.
Under § 25(2) No. 2 TDDDG this storage is strictly necessary to provide the display you have chosen; it therefore requires neither consent nor a cookie banner.
6. Newsletter
You can optionally subscribe to our daily email newsletter. To do so, you enter your email address in the subscribe form. We then send you a confirmation email with a link; the subscription becomes active only when you open that link and confirm with the button on the page it leads to (double opt-in). Until then we send you no further emails, except a new confirmation email if you submit the form again. Subscriptions that are not confirmed are deleted after 7 days.
As proof of your consent we store the time of subscription, the time of confirmation and your IP address as a salted hash, once at subscription and once at confirmation.
Every email contains an unsubscribe link. When you unsubscribe, we delete your email address at once; as proof of the opt-out we keep only a hashed form of the address and the timestamps of subscription and opt-out for 30 days. You can subscribe again at any time, which again requires confirmation.
Legal basis: Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time via the unsubscribe link in any email, without affecting the lawfulness of processing carried out before withdrawal. Storing the proof of consent and of unsubscribing is based on Art. 6(1)(f) in conjunction with Art. 7(1) GDPR — our legitimate interest in being able to demonstrate the consent and its withdrawal.
We use Resend as processor to send the emails. For this we pass Resend your email address and the content of each email, including your personal confirmation or unsubscribe link. Provider: Resend, Inc.; data is processed in the USA. Privacy information: https://resend.com/legal/privacy-policy. Transfer to the USA is safeguarded by the EU Standard Contractual Clauses, which are incorporated into our data processing agreement with Resend.
7. Protection of the subscribe form
To protect the subscribe form against automated abuse, such as signing up other people's email addresses in bulk, we use Cloudflare Turnstile. Turnstile checks that a subscription comes from a person and not a script. The Turnstile script is loaded only when you focus or interact with the subscribe form. For this, Cloudflare processes technical data such as your IP address, browser and device characteristics, and interaction signals, and may run a short browser challenge. Turnstile does not use this data for advertising or cross-site tracking. Provider: Cloudflare, Inc., USA. Privacy information: https://www.cloudflare.com/privacypolicy/. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in preventing abuse and unwanted email; under § 25(2) TDDDG the check is strictly necessary to provide the newsletter subscription you have requested, so it requires no consent.
In addition, we limit the number of subscribe attempts per IP address and send at most one confirmation email per address per day. For this we store a salted hash of your IP address or a hash of your email address together with a counter for at most 48 hours. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in preventing abuse.
8. Contact by email
If you contact us by email, we process the information you provide, such as your email address and message content, to answer your inquiry. Legal basis: Art. 6(1)(b) GDPR where your inquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR for efficient handling of inquiries.
9. Content and API
The items on this website are collected and summarised by automated systems, including artificial intelligence. The website's write API is intended solely for these systems of our own; it processes no visitor data.
10. Retention and deletion
Technical access data is stored by Cloudflare according to its retention periods. We keep confirmed newsletter addresses and the proof of your consent until you unsubscribe; subscriptions that are not confirmed are deleted after 7 days. After you unsubscribe, we keep the hashed form of the address and the timestamps of subscription and opt-out for 30 days. Hashes used to limit subscribe attempts (section 7) are stored for at most 48 hours. Email inquiries are kept as long as necessary to handle them and for reasonable documentation periods.
Statutory retention obligations, for example commercial or tax retention periods under German law, remain unaffected.
11. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection under Art. 15 to 21 GDPR. Where processing is based on consent, you may withdraw consent at any time with effect for the future.
To exercise your rights, contact support@toba.solutions. We may need information to verify your identity before fulfilling a request.
12. Right to object
Where we process your personal data on the basis of Art. 6(1)(f) GDPR (hosting, protection of the subscribe form, proof of consent and opt-out, contact by email), you have the right under Art. 21 GDPR to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Please send your objection to support@toba.solutions.
13. Data transfers to third countries
In connection with Cloudflare (hosting, database and Turnstile) and Resend (email delivery), personal data may be transferred to third countries, especially the USA. Such transfers are based on Standard Contractual Clauses, data processing agreements and, where applicable, adequacy decisions including certification under the EU-US Data Privacy Framework.
14. Automated decision-making
Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.
15. Supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:
Unabhängiges Datenschutzzentrum Saarland
Fritz-Dobisch-Straße 12
66111 Saarbrücken, Germany
Email: poststelle@datenschutz.saarland.de
Website: https://www.datenschutz.saarland.de
16. Updates
We may update this privacy policy when the website, infrastructure, legal requirements or the providers we use change. For material changes, we will provide appropriate notice on the website where required.