Privacy policy.

Last updated: 7 September 2026

Who is responsible for your data

BraveAutomations is the data controller. The registered company name, tax number and registered address are being filed and will be published on this page. You can reach us at team@braveautomations.com for anything on this page, including deletion requests.

What we collect, and why

When you fill in a form

The audit intake, the service request, the careers application and the community waitlist collect what you type into them. That means your name, your work email, your phone number, your company and the answers you give about how the company runs. We use it to prepare the session, to answer your request or to review your application. Nothing else.

When you buy something

Payments are processed by Stripe. We never see or store your card number. We receive the billing details Stripe passes back to us, which we need to issue the invoice and meet our accounting obligations.

When you book a call

Scheduling runs on Cal.com. It holds the slot, your email and anything you write in the booking notes.

When you chat with JAMES

Messages you send to the assistant on this site go to our automation server, then to an AI model through OpenRouter and Anthropic, which generate the reply. Each exchange is stored in Airtable with the page you were on and a session identifier, so we can review conversations and improve the answers. We keep those records for twelve months. The chat does not ask for personal data unless you want us to contact you, and it never asks for payment details. Do not paste passwords, card numbers or client data into it.

Recordings

The audit session is recorded. You receive the transcript. The video stays with us, because it may contain screens and details belonging to our consultants and to other work. We keep it for quality and training of our own team, and we delete it on request.

Legal basis

We process your data to take steps at your request before entering a contract, to perform a contract once you hire us, to meet our legal obligations, and for our legitimate interest in running and improving the business. Marketing emails go out only if you tick the box, and you can unsubscribe from any of them in one click.

Who else sees it

Only the providers we need to operate, each acting on our instructions under a data processing agreement:

• Netlify hosts the site and receives every form you send.
• Our own automation server, n8n, receives a copy of each form and each chat message so we can act on it.
• Airtable is where we keep records of requests, applications and chat conversations.
• Stripe processes payments. We never see your card number.
• Cal.com holds the booking slot and what you write in the booking notes.
• OpenRouter and Anthropic process the messages you send to JAMES in order to generate a reply. They do not use them to train models.
• Google Workspace handles our email, and our accountant sees billing details.

We do not sell your data and we do not share it for anyone else's advertising.

How long we keep it

Enquiries that go nowhere are deleted after two years. Client records are kept for the legal retention period that applies to invoices and contracts, which in Spain is six years. Applications are kept for one year unless you ask us to remove them sooner.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict how we use it, object to it or take it elsewhere. Write to team@braveautomations.com and we answer within thirty days. If you are in the European Union and you think we have handled it badly, you can complain to your national data protection authority.

Cookies and similar storage

This site sets no advertising cookies and no tracking cookies. That is why you see no cookie banner: there is nothing to consent to.

Your browser keeps three small pieces of data on its own, and none of them leaves it. One remembers your currency choice. Two keep your chat with JAMES alive while the tab is open, so you can change page without losing the conversation. They disappear when you close the tab. If we ever add web analytics, a banner will appear first and nothing loads until you accept it.

The fonts on this site are served from our own domain, so no request goes to a font provider. The booking calendar on the audit page is an embedded service and may set its own cookies once you interact with it. Videos on case pages load from a privacy mode that sets no cookie until you press play.

Changes

If this policy changes we update the date at the top. Material changes are announced by email to clients and to anyone on the newsletter.