Privacy policy

1. Scope

Brava is a product and brand operated by Tessum, Inc., a Delaware corporation. Tessum, Inc. is the service operator and data controller for Brava. This policy explains how we handle information when you visit createbrava.com, create an account, purchase a plan or generate content through Brava. To submit a privacy request, write to contact@createbrava.com from the email associated with your account. Business correspondence may be sent to Tessum, Inc., 2810 North Church Street, STE 89535, Wilmington, DE 19802, United States.

2. Data we handle

• Account: name, email, authentication identifiers and workspace.
• Creative content: prompts, Brand Memory, projects, settings and generated results.
• Operations: balance, credit ledger, job status, billing events and technical records required for security.
• Payments: Stripe processes card data; Brava stores customer, subscription, invoice and status identifiers, not your full card number.

3. How we use it

We use this data to authenticate you, isolate your workspace, perform requested generation, store results, bill subscriptions, prevent abuse, return credits after failures, provide support and meet legal obligations. We currently do not install our own behavioral advertising tools.

4. Providers

We use Vercel to host the application; Supabase for authentication, database and private storage; Stripe for payments; Google Analytics to measure visits and product interactions; and, depending on the selected model, OpenAI, fal or ElevenLabs to process prompts and produce results. Crisp provides customer support only after you explicitly open the support chat. Providers may process data in other countries under their own terms. We do not send payment keys or Brava credentials to AI, analytics or support providers.

Google Analytics may receive device, browser, approximate location and interaction identifiers; we use it for aggregate product analytics, not to send prompts or creative files. We do not automatically send Crisp your account name, email, internal identifiers, prompts or files. The support chat may store its own cookie and the messages and technical data you choose to provide once you open it. OpenAI's API excludes inputs and outputs from training by default. Other providers may retain data to operate, protect or improve their services according to the contracted plan; avoid adding unnecessary sensitive data to prompts or support messages.

5. Retention and security

We retain account data and content while the service is active or as needed for the purposes described. Certain transaction, security or billing records may be retained to meet legal obligations. Assets are kept in private storage, delivered through temporary signed URLs and isolated by workspace through row-level policies.

If our encrypted secondary backup system is active, information removed from the active service may remain in isolated encrypted recovery sets until their configured lifecycle expires, for up to approximately 60 days. Recovery sets are not used to provide the ordinary service and are accessed only for disaster recovery, verification and security. Deletion from the active service does not shorten that backup lifecycle.

6. Your choices

You may request access, correction, export or deletion, and object to or limit certain processing where the law provides. Some requests require identity verification, and certain data may be retained where a legal obligation or legitimate security need applies.

7. Children

Brava is not directed to people under 18 and does not knowingly collect their data. Do not use the service to create or process material that compromises the safety or rights of children.

8. Changes and contact

We may update this policy as the product or its providers evolve. We will publish the new date and notify material changes when appropriate. Contact: contact@createbrava.com.