Privacy Policy

Bravery Technology Ltd (referred to as Bravery, we, or us) operates usebravery.com and the usebravery platform, and is the business responsible for the personal information processed in connection with usebravery.com and the customer panel. Bravery is a company registered in England and Wales; our registered office and company details are available on request and through the contact methods below.

There are two distinct roles in our service. For usebravery.com and for the customer panel that you use to manage your subscription and site, Bravery is the business that determines the purposes and means of processing your personal information.

For an end customer's published site and its visitors, our customer is responsible for the personal information collected through that site, and Bravery acts as a service provider processing that information on the customer's behalf and under the customer's instructions. This Privacy Policy describes our own handling of personal information; if you are a visitor to a customer's site, the customer's own privacy notice applies to your interaction with that site.

We collect the following categories of personal information when you use the platform. Identifiers and account information, such as your name and email address. Authentication metadata associated with the one-time code (OTP) login and optional TOTP two-factor authentication, such as login timestamps and device or session information.

Commercial and billing information processed through Stripe, including your subscription, plan, and payment status. Stripe handles your card details directly; we do not store full card numbers. Site configuration information that you provide to set up and operate your site, such as your domain, plan, catalog settings, and associate tag.

Provisioning, security, and usage logs generated as we create and run your isolated box, including internet protocol addresses, technical event records, and diagnostic data. Support communications, including the contents of messages you send to us and our responses.

On our marketing website, and only where you give consent, we collect analytics and similar information through cookies and tools such as Google Analytics 4 and PostHog. Strictly necessary cookies that are required for the website and platform to function are always active.

We use personal information to provide, operate, and maintain the platform and your site, including provisioning your isolated box, configuring your domain and TLS, and generating and serving content. We use billing information to process your subscription, take payment through Stripe, manage renewals and downgrades, and prevent payment fraud.

We use personal information for security and fraud prevention, including authenticating logins, detecting and investigating abuse or unauthorized access, and protecting the integrity of the platform. We use your contact details and support communications to respond to your requests and provide customer support.

We use personal information to send service communications, such as transactional emails, security notices, and important updates about your subscription or the platform. We also use it to comply with our legal, tax, and regulatory obligations, to establish, exercise, or defend legal claims, and to improve and develop the platform.

Where you have given consent, we use analytics information from our marketing website to understand how the site is used and to measure and improve our marketing. You can withdraw consent at any time as described in the cookies section below.

Under the CCPA as amended by the CPRA, we process personal information for specified business and commercial purposes rather than relying on a separate legal basis framework. We collect and use each category of personal information only for the purposes described in this Privacy Policy and for purposes that are reasonably necessary and proportionate to those purposes, or for another purpose that is compatible with the context in which the information was collected.

Our business purposes include providing and operating the platform and your site, performing services such as account management, billing, customer support, and order or subscription fulfillment, maintaining and servicing accounts, and processing payments through Stripe. They also include detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, debugging to identify and repair errors, and performing internal operations reasonably aligned with your expectations.

Our commercial purposes include verifying and improving the quality of the platform, performing analytics on our marketing website where you have consented, and conducting activities to maintain and enhance our services. We do not use sensitive personal information for purposes other than those permitted under the CCPA, and you may direct us to limit such use as described in the rights section below.

We process personal information only for purposes that are compatible with the purpose for which it was collected. If we intend to use your personal information for a materially different, incompatible purpose, we will provide notice to you before doing so.

Bravery does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA and CPRA. We have not sold or shared personal information in this sense, including the personal information of any consumer under 16 years of age.

We disclose personal information for our business purposes only to the categories of recipients needed to run the service. These include our sub-processors and service providers, who are bound by contract to process personal information only on our instructions and for the purposes we specify. Our typical sub-processors are Stripe for payments, Resend for transactional email, Cloudflare for content delivery, TLS, and Turnstile bot protection, our cloud hosting and infrastructure provider, and, on our marketing website and subject to consent, the analytics providers Google Analytics 4 and PostHog. Product data is retrieved through the Amazon Product Advertising API under your own associate tag.

We may also disclose personal information where required to comply with applicable law, legal process, or a lawful request from a public authority, to enforce our agreements, to protect the rights, property, or safety of Bravery, our customers, or others, and in connection with a corporate transaction such as a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

The categories of personal information we disclose to service providers for business purposes include identifiers, account and contact information, commercial and billing information, internet or other electronic network activity information, and the contents of support communications, in each case limited to what each recipient needs to perform its function.

Bravery operates internationally, and your personal information may be processed in the United States and in other countries where Bravery or its sub-processors operate, including the United Kingdom and the European Union.

The privacy and data protection laws of these countries may differ from the laws of your state or country of residence. Where personal information is processed outside your jurisdiction, we take steps that we consider reasonable and appropriate to ensure that it remains protected in accordance with this Privacy Policy and applicable law.

By using the platform, you understand that your personal information may be transferred to and processed in these locations as part of providing the service to you.

We retain personal information for as long as it is needed to provide the platform to you and to fulfill the purposes described in this Privacy Policy. We keep your account and configuration information while your account is active and for a reasonable period after your account is closed, to handle any follow-up matters and to comply with our legal obligations.

We keep provisioning, security, and usage logs for a limited period appropriate to their purpose, after which they are deleted or anonymized. We keep records required for legal, accounting, and tax purposes, including billing records processed through Stripe, for the period required by applicable law.

When personal information is no longer required, we delete it or anonymize it so that it can no longer be associated with you. Some information may persist for a limited time in routine backups before it is overwritten.

If you are a California consumer, the CCPA as amended by the CPRA gives you specific rights over your personal information. You have the right to know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties and service providers to whom we disclose it. You have the right to request that we delete personal information we have collected from you, and the right to request that we correct inaccurate personal information that we maintain about you.

You have the right to opt out of the sale or sharing of your personal information. Bravery does not sell or share personal information as those terms are defined by the CCPA, so there is nothing for you to opt out of in this respect, and we do not offer financial incentives in exchange for personal information.

You have the right to limit the use and disclosure of sensitive personal information to uses that are necessary to provide the service and that are otherwise permitted under the CCPA. We use sensitive personal information only for these permitted purposes and not to infer characteristics about you. You also have the right to non-discrimination, meaning we will not deny you services, charge you a different price, or provide a different level or quality of service because you exercised your privacy rights.

To exercise your rights, contact us through the contact page or at [email protected]. We will verify your identity before responding, and we may ask for information to confirm that you are the consumer whose information is the subject of the request. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may require you to verify your own identity directly. We will respond within the timeframes required by the CCPA. If you believe your rights have not been respected, you may contact the California Attorney General or the California Privacy Protection Agency.

Our marketing website uses cookies and similar technologies. Strictly necessary cookies, which are required for the website and platform to function and to keep them secure, are always active and cannot be switched off.

Analytics and marketing cookies, including those used by Google Analytics 4 and PostHog, are only set where you give your consent through our consent banner. We do not load these tools until you have made your choice.

You can change your cookie preferences at any time through the consent controls on our website. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it. You can also manage cookies through your browser settings, although disabling strictly necessary cookies may affect how the website works.

We use technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, and alteration. These include encryption of data in transit using TLS, encryption of sensitive data, and isolated tenant infrastructure that provides each customer with its own dedicated box.

We support two-factor authentication through TOTP, apply access controls so that personal information is accessible only to those who need it, and maintain backups to support recovery and continuity. We also monitor our systems for security events and respond to incidents in line with our obligations.

While we work hard to protect your personal information, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You also play an important role by keeping your account credentials and authentication factors confidential.

The platform is intended for business users and is not directed to children. The platform is not directed to children under 16 years of age, and we do not knowingly collect personal information from children under 16.

If you believe that a child under 16 has provided us with personal information, please contact us so that we can investigate and delete the information where appropriate. We do not knowingly sell or share the personal information of consumers under 16 years of age.

If we become aware that we have collected personal information from a child under 16 without appropriate authorization, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, our platform, or the law. When we make material changes, we will take reasonable steps to notify you, for example by email or through a notice on the platform or website.

The effective date of the current version is shown on this page. We encourage you to review this Privacy Policy periodically to stay informed about how we handle personal information.

Your continued use of the platform after an updated Privacy Policy takes effect indicates that you have read and understood the changes.

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please reach out through our contact page or email [email protected].