Privacy policy

1. Scope

This policy explains how BRAVA handles information when you visit createbrava.com, create an account, purchase a plan or generate content. To submit a privacy request, write to hola@createbrava.com from the email associated with your account.

2. Data we handle

• Account: name, email, authentication identifiers and workspace.
• Creative content: prompts, Brand Memory, projects, settings and generated results.
• Operations: balance, credit ledger, job status, billing events and technical records required for security.
• Payments: Stripe processes card data; BRAVA stores customer, subscription, invoice and status identifiers, not your full card number.

3. How we use it

We use this data to authenticate you, isolate your workspace, perform requested generation, store results, bill subscriptions, prevent abuse, return credits after failures, provide support and meet legal obligations. We currently do not install our own behavioral advertising tools.

4. Providers

We use Vercel to host the application; Supabase for authentication, database and private storage; Stripe for payments; and, depending on the selected model, OpenAI, fal or ElevenLabs to process prompts and produce results. Providers may process data in other countries under their own terms. We do not send payment keys or BRAVA credentials to AI providers.

OpenAI's API excludes inputs and outputs from training by default. Other providers may retain data to operate, protect or improve their services according to the contracted plan; avoid adding unnecessary sensitive data to prompts.

5. Retention and security

We retain account data and content while the service is active or as needed for the purposes described. Certain transaction, security or billing records may be retained to meet legal obligations. Assets are kept in private storage, delivered through temporary signed URLs and isolated by workspace through row-level policies.

6. Your choices

You may request access, correction, export or deletion, and object to or limit certain processing where the law provides. Some requests require identity verification, and certain data may be retained where a legal obligation or legitimate security need applies.

7. Children

BRAVA is not directed to people under 18 and does not knowingly collect their data. Do not use the service to create or process material that compromises the safety or rights of children.

8. Changes and contact

We may update this policy as the product or its providers evolve. We will publish the new date and notify material changes when appropriate. Contact: hola@createbrava.com.