Privacy policy

Who this covers

BravaSpace is a white-label client portal for agencies and creative studios. Two kinds of people use it: agencies (our customers, who set up a workspace and a team) and clients (the people an agency invites into a portal under its own name).

For the account an agency holds with us, and for visitors to this website, BravaSpace decides how data is used (the “controller”). For everything an agency puts into its workspace about its own clients, the agency decides and BravaSpace acts on its behalf (the “processor”). The DPA and GDPR page covers that second role.

BravaSpace is operated by BravaSpace LLC (“BravaSpace”, “we” or “us”).

What we collect

• Live demo requests. When you ask for a demo workspace we collect your name, work email, company name and company website, plus a tag for the page or button you used, so we know what brought you. We use your company name and website to set up the demo, including reading your public website for your logo, colors and fonts.
• Sign-up details. Your name, email address, agency name, website and your answers to the sign-up questions. If you start sign-up and stop part-way, we keep what you entered and how far you got, so we can follow up.
• Your workspace. Your brand name, logo, colors and font, your team members and their sign-in details, and the plan and trial status of the workspace.
• Client content. What an agency and its clients add: client records and contacts, tasks, messages, files, galleries, invoices, contracts, notes and meeting details.
• Client sign-ins. When an agency invites a client, that person creates a login in the agency’s portal. We store the email address and sign-in details so they can get back in.
• Connected tools. If an agency connects Google, SE Ranking, Stripe or ActiveCampaign, we keep the access token or API key it provides, on our servers. Those secrets cannot be read back from a browser. We then pull in the data the connection allows, such as search rankings or calendar events.
• Usage. Storage used, AI usage (counted so plan limits work) and the actions needed to keep your workspace running and secure.
• Support. Messages you send us through the in-app support chat or by email.
• Payments. Stripe collects card details when you subscribe. We never see or store full card numbers; we keep the plan, billing contact and invoice history.
• Device and log data. Like most online services, our servers record technical details such as IP address, browser type, the pages or features used and the time of each request. We use these to run, secure and fix the service.
• This website. The marketing site sets no cookies and runs no analytics or advertising scripts. Our hosting provider keeps ordinary server logs. See the cookie policy.

Why we use it

• To provide BravaSpace: create your workspace, run your client portals, sync the tools you connect and bill your plan. This is needed to perform our contract with you.
• To keep the service safe and working: prevent abuse, limit repeated requests, fix bugs and plan capacity. This is in our legitimate interest.
• To talk to you: answer support questions and send service notices about your account, such as billing, security and changes to the product.
• To set up a demo you ask for and follow up about it. If you request a demo or start a sign-up, we may email you about BravaSpace. This is in our legitimate interest, or based on your consent where the law requires it. Every marketing email has an unsubscribe link, and you can opt out at any time by replying or emailing us.
• To understand what brings people to BravaSpace, using campaign tags on our links (such as utm_source). We do not use advertising trackers on this site.
• To meet legal duties, such as tax records.
• Where you choose to connect a Google account, to read the data you allow. You can disconnect it at any time.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use client content to show advertising or to train AI models.

Brava, our AI

Brava drafts replies, summaries, reports and other writing for an agency to review. When someone asks Brava for something, we send the request, and the part of the agency’s workspace needed to answer it, to Anthropic’s Claude models to generate a response.

• Brava never sends anything to a client on its own, unless you switch review off on a scheduled report. Otherwise a person reviews and sends.
• We meter AI usage per workspace so plan limits and daily caps work.
• AI output can be wrong. Agencies should read it before using it.

We use Anthropic through its commercial API. Under those terms, Anthropic does not use the data we send to train its models, and keeps it only for a limited time to provide the service and check for misuse. We do not use client content to train any model ourselves.

Who we share it with

We use these service providers (sometimes called subprocessors) to run BravaSpace. We share only what each needs.

Within a workspace, agency team members see all of that workspace’s clients. A client sees only their own portal. One workspace cannot read another’s data. We may also disclose data if the law requires it, or to protect people from harm. If the business is ever sold or merged, we will tell you before your data is handled under a different policy.

Where data goes

Our providers may process data in the United States and other countries. Workspace data and files are hosted by Supabase in the United States (AWS us-west-2, Oregon), and the app and this site are served by Netlify. Where personal data leaves the UK, the European Economic Area or Switzerland, we rely on the European Commission’s standard contractual clauses (with the UK addendum where it applies) or another lawful transfer mechanism, and we require our providers to protect it to the same standard.

How long we keep it, and deleting it

• Deleting a client. An agency can delete a client. The client is hidden right away and can be restored for 24 hours. After that, the client’s tasks, messages, files, galleries, invoices, notes and logins are permanently deleted.
• Deleting a workspace. The workspace owner can delete the whole account. That removes every record, every stored file and every team and client login. There is no export and no restore after this, so download what you need first.
• Billing records. When a workspace is deleted we delete its Stripe customer record, which also cancels subscriptions. Stripe and we may keep invoices and payment records the law requires.
• Demo requests and unfinished sign-ups: kept for up to 24 months after we last hear from you, then deleted. Ask us and we delete them sooner.
• Support messages: kept while your account is open and for up to 24 months after it closes.
• Server logs: kept for up to 90 days, longer only when we need them to investigate a security issue.
• Backups: roll off within 24 hours, so deleted data leaves our backups within a day.

Your rights

Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, export it, restrict or object to how we use it, and withdraw consent you gave. You can also complain to your data protection authority.

To make a request, email us from the address on your account. We may ask you to confirm it is you, and we reply within 30 days (or sooner where the law requires). Making a request costs nothing, and we will not treat you differently for making one.

If you are a client of an agency, the agency decides how your data in its portal is used, so please ask the agency first. We will help them answer you. For anything about your BravaSpace account or this website, contact us.

Agencies can export client data from the Clients page and erase it themselves, as described above.

US state privacy rights

If you live in California or another US state with a consumer privacy law, you have the right to know what personal data we collect, use and disclose, to get a copy of it, to correct it and to delete it. You can also opt out of the sale or sharing of personal data for targeted advertising; we do neither. You can use an authorized agent to make a request for you, and we will not discriminate against you for using these rights.

In the past 12 months we collected the categories described in What we collect: identifiers and contact details, commercial information (plan and billing), internet activity within the product, and professional information (your company and role). We collect them from you, from the agency that invited you, and from the tools an agency connects, and we disclose them only to the providers listed above, for the purposes listed above.

Security

Each workspace’s data is kept separate from every other workspace’s at the database level. Integration keys and tokens are stored on the server and never sent back to a browser. Sensitive actions such as sign-up and checkout are rate limited. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires. More on the security page.

Children

BravaSpace is built for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us personal data, tell us and we will delete it.

Changes to this policy

When we make a meaningful change we will update the effective date above and, for current customers, tell you in the app or by email before it takes effect.

Questions about this policy or your data: hello@bravaspace.com.