Privacy Policy

1. Controller and contact

Bastian Wiede trading as WI-IM-EX · BRAVON™ business unit c/o IP-Management #4150 Ludwig-Erhard-Str. 18 20459 Hamburg, Germany Phone: +49 155 65084652 Email: info@bravon.eu

This policy concerns the BRAVON Studio website and application at studio.bravon.eu. For the central Bravon website and its account creation, the privacy information provided there at https://bravon.eu/privacy also applies. You can send data protection enquiries to info@bravon.eu.

2. Purposes and legal bases

We process data to provide the website, manage customer accounts and contracts, deliver the agreed content planning, handle enquiries and protect against misuse. Where you yourself are the contracting party, the necessary processing is based on Art. 6(1)(b) GDPR. For contact persons and employees of our business customers, we base it on Art. 6(1)(f) GDPR; our legitimate interest is carrying out the business relationship. We fulfil legal obligations on the basis of Art. 6(1)(c) GDPR. Voluntary analytics processing only takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR.

For content belonging to companies, the company concerned generally determines the purpose and legal basis. Processing personal customer content on its behalf requires a separate data processing agreement. The service is currently in setup and test operation; the contractual chain for regular customer operation has not yet been fully completed. Until expressly approved, please do not upload any personal data of your customers or employees.

3. Website, hosting and technical logs

The website, database, file storage and server-side functions are provided using Lovable Cloud. The provider is Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA. A dedicated background service at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, calls the sending control; this server is located in Falkenstein. This does not mean that all BRAVON Studio data is stored exclusively in Germany.

When you use the service, technically necessary connection data such as IP address, time, requested address, browser and device information as well as error and security information are processed. This serves delivery, stability, troubleshooting and misuse prevention. The legal basis is Art. 6(1)(f) GDPR; our interest lies in secure operation. Customer content data is not intended to be included in technical diagnostic messages. Individual errors may contain technical details about the affected request. Delivery also uses Cloudflare as technical infrastructure. In this context, the security cookie __cf_bm with a lifetime of 30 minutes has been observed; it serves to protect against automated misuse. BRAVON uses logs for necessary error analysis, security review and record-keeping. The retention periods set by Lovable for hosting and application logs have not been confirmed to us as specific periods; we therefore cannot currently state a specific maximum duration for them.

4. Shared Bravon sign-in

You sign in via the central Bravon sign-in page. BRAVON Studio receives a verified account identifier, your confirmed email address and your name, where provided. Your Bravon password is not passed on to Studio. Bravon administrator roles are not adopted as Studio roles. We process the account data and workspace assignments for sign-in and access control. The contractual or legitimate interests mentioned in section 2 apply, and Art. 6(1)(f) GDPR for security.

Studio uses the technically necessary, encrypted cookies __Host-bravon-social (session, at most 30 minutes) and __Host-bravon-login (sign-in process, at most 5 minutes), which are protected against script access. They are required for the expressly requested sign-in service pursuant to § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Earlier deletion or a shorter session duration is possible. Cookies of the central sign-in page are explained in its own information.

5. Workspaces, content and media

We store company and brand names, workspace assignments, post drafts, selected channels, scheduled times as well as uploaded images and associated details such as file name, format, size, image dimensions and alternative texts. Processing serves the commissioned planning and management. Access is granted to authorised users of the respective workspace and to required technical service providers. Images are stored in private storage; time-limited retrieval addresses are created for display.

Archiving or removing something in the interface is not in every case an immediate physical deletion of all files and records. We handle complete deletion requests via info@bravon.eu. Please do not upload health data, identity document data, payment data or comparably sensitive content.

6. Connections to social networks

A connection is only set up at your request via the authorisation dialog of the respective network. In doing so, we may receive account or page identifiers, display names, profile pictures where applicable, granted permissions as well as access and refresh tokens. Tokens are stored encrypted on the server side and serve the approved connection. Your password for the social network is not transmitted to BRAVON Studio.

Where publishing is enabled for your connection and you place a publishing order, the selected texts, media and required settings are transmitted to the network concerned. Status, post identifier and technical error responses may be stored for execution and tracking. Depending on the selected connection, recipients are Facebook/Instagram (Meta), LinkedIn or TikTok. The connections are optional. Merely viewing these legal texts does not involve any account authorisation with these networks.

Current status: Facebook and Instagram are being set up and tested; TikTok and LinkedIn are not yet generally enabled. This description of future connections does not constitute a promise of their availability. This information will be updated before additional data processing is activated.

Disconnecting a connection prevents its further use for new orders and removes the associated active access credentials from our connection storage. Content already published remains with the network and must be removed there separately. You can also revoke authorisations directly in the account settings of the respective provider. Information on processing by the networks can be found in their privacy notices.

7. Contact, offers and billing

When you contact us or place an order, we process the contact, company, contract and billing details provided as well as the content of your message. This serves to handle your enquiry, perform the contract and fulfil legal obligations. The respective legal bases are listed in section 2. In the current launch phase, orders are placed via individual offers; no general online checkout has been set up. Email, accounting or payment service providers only receive data to the extent required for the respective agreed processing. This information will be supplemented before an additional online payment integration is introduced.

8. Visitor analytics

The optional Lovable visitor analytics is currently deactivated. Any future visitor analytics is only to be used after an effective consent management has been set up. Before it is activated, this information will be supplemented with the providers, data, purposes and storage periods actually used. Technical logs required for operation and security remain unaffected.

9. External fonts

The application loads the Inter and Plus Jakarta Sans fonts from Google Fonts via fonts.googleapis.com and fonts.gstatic.com. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing by Google LLC in the USA is possible. When the fonts are retrieved, Google technically receives your IP address and request information, in particular details about the browser, the requested font file and, where applicable, the referring website. The purpose is the consistent display of our website. Retrieval currently already takes place when the page is opened, without a prior consent dialog. We therefore do not claim to have obtained consent for this transfer. The legal basis of this existing integration is still under review; this information does not replace any consent that may be required. Information from Google: https://policies.google.com/privacy and https://fonts.google.com/faq.

10. Recipients and international transfers

Access is granted only to recipients required for the stated purposes, in particular the hosting and IT service providers used, authorised contact persons of the respective customer and advisers or authorities required for fulfilling legal duties. In the case of a publication initiated by you, the selected social networks and the audience determined there also receive the approved content.

The database region is Europe (Ireland). The website is additionally delivered via a global content delivery network. Therefore, not all processing takes place in the database region or exclusively in the EEA. Lovable uses, among others, Supabase for the managed cloud infrastructure; the current list of its subprocessors is available at https://trust.lovable.dev/subprocessors. Lovable provides information on international transfers at https://lovable.dev/privacy and in particular names EU Standard Contractual Clauses for this purpose. Such an agreement between BRAVON and Lovable has not yet been concluded for our current Pro plan; Lovable's contracts with its own service providers do not replace this agreement. We therefore do not claim an already fully completed contractual chain or exclusive EU processing. Before regular use for personal customer content, the necessary agreements and transfer bases must be clarified. You can request information on the safeguards available for a specific processing operation via info@bravon.eu.

After a connection initiated by you, the privacy notices of the selected platform also apply: Facebook https://www.facebook.com/privacy/policy/, Instagram https://privacycenter.instagram.com/policy/, TikTok https://www.tiktok.com/legal/page/eea/privacy-policy/de and LinkedIn https://www.linkedin.com/legal/privacy-policy. An authorisation in the platform dialog does not replace a necessary legal basis under data protection law for other persons in your content.

11. Storage period and deletion

Account and workspace data is stored for the duration of the required use. After the end of the contract or a justified deletion request, data is removed as soon as the purpose no longer applies and no statutory retention obligation or necessary record-keeping prevents this. Decisive factors include ongoing contracts, open billing, statutory retention periods and specific legal claims. For customer data processed on behalf of customers, the agreed return and deletion rules also apply. Archiving is not final deletion. For deletion requests, we explain where necessary which data is still stored and for what reason. We have no automatic deletion control over published copies on social networks.

Deleted database entries may temporarily remain in daily backups. Lovable has not given us a specific retention period for this; according to Lovable, the backup period cannot be configured per project. Immediate selective removal of individual records from these backups is therefore not promised. For active data and media, we handle deletion requests via the contact route described on /data-deletion. Complete processing may require manual review and technical implementation. We do not state an unverified blanket deletion period for all systems.

12. Your rights

Subject to the statutory requirements, you have the rights of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected.

Objection: You may object to processing based on legitimate interests on grounds relating to your particular situation pursuant to Art. 21 GDPR. You may object to direct marketing at any time without giving specific reasons. To do so, write to info@bravon.eu.

You can lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement. For Hamburg, this is the Hamburg Commissioner for Data Protection and Freedom of Information (https://datenschutz-hamburg.de). Providing technically and contractually required data is necessary for the respective function; without this data, sign-in or contractual services cannot be provided. Voluntary analytics decisions do not affect access to the service. BRAVON Studio does not use solely automated decisions with legal or similarly significant effect within the meaning of Art. 22 GDPR.