Privacy Policy

1. Introduction

At Bravos AI, we take the protection of your personal data very seriously. This Privacy Policy explains what information we collect, how we use it, and what your rights are under the General Data Protection Regulation (GDPR) and applicable data protection legislation.

2. Data Controller

• Identity: Global Online Mapps Ltd (trading as "Bravos AI")
• Company Number: 9909303 (Companies House, England and Wales)
• Registered office: Suite 7 Midshires House, Smeaton Close, Aylesbury, England HP19 8HL
• Email: [email protected]

3. What Data We Collect

3.1 Data You Provide Directly

• • Account information: Name, email, password (encrypted with bcrypt)
• • Optional contact data: Information you choose to share voluntarily (phone number, company, etc.)
• • Billing information: Processed by Stripe (we do not store card details)
• • Chatbot content: Texts, documents, images, and files you upload to train your bots
• • Support messages: Communications you have with our team

3.2 Automatically Collected Data

• • Usage data: Pages visited, features used, time of use
• • Technical data: IP address, browser, operating system
• • Cookies: For essential functionality and analytics

3.3 End User Data (Widget)

When visitors to your website interact with your chatbots:

• • Conversation messages
• • Shared media files (paid plans only, automatically deleted after 24 hours)
• • Anonymous session identifier (fingerprint)
• • Contact data the visitor provides themselves: the fields from the lead capture form you configure (name, email, phone, country and additional fields) and the email address requested when they ask to speak with a person

3.4 Human Intervention

On the PRO and ENTERPRISE plans, a member of the Customer's team can step into an ongoing conversation and reply in place of the chatbot, both in the website chat and on WhatsApp. While that person is handling the conversation, the chatbot stops responding in it. The visitor is shown a notice that the conversation is continuing with a person, unless the Customer has configured otherwise.

When a visitor asks to speak with a person in the website chat, they are asked for an email address to complete the request. That address is used for two purposes: alerting the Customer's team that someone is waiting, and being able to reply to the visitor if they leave the page before being attended to. The legal basis is legitimate interest in the context of a pre-contractual relationship, and it is retained together with the rest of the contact data (see section 9).

Each message is logged indicating whether it was written by the chatbot or by a member of the Customer's team, and, in the case of WhatsApp, whether it was sent from the Bravos AI panel or from the Customer's own WhatsApp Business application.

4. Legal Basis for Processing

We process your personal data based on:

• • Contract performance: To provide you with the service you have subscribed to
• • Consent: For marketing communications (you may withdraw it at any time)
• • Legitimate interest: To improve our services and prevent fraud
• • Legal obligation: To comply with tax and legal requirements

5. How We Use Your Data

• • Provide and maintain the Bravos AI service
• • Process payments and manage subscriptions
• • Send important notifications about your account
• • Provide technical support
• • Improve and optimize our services
• • Comply with legal obligations
• • Prevent fraud and abuse
• • Access the content you upload to the platform (documents, texts, integrations and conversations) where necessary to provide the service, deliver the support you request and ensure security, preventing improper or unlawful use of the chatbots. Such access is limited to personnel with a justified need and is subject to confidentiality (see the DPA)
• • Send marketing communications (only with your consent)

6. Who We Share Your Data With

We do not sell your personal data. We only share information with trusted third parties necessary to operate the service:

Sub-processors:

All our providers are subject to data protection agreements and commit to processing personal data in accordance with applicable regulations. Personal data submitted through the chatbot may be processed by our AI providers solely for the purpose of generating responses, never for general-purpose model training.

6.1 AI Connector (MCP)

You can connect your account to an MCP-compatible AI assistant (for example Claude, ChatGPT, Cursor or Mistral) to manage and audit your bots from that assistant. If you enable this connection:

• • What the assistant sees: at the time of each request, your bots' configuration, conversations (which may contain your end customers' personal data), captured contacts, your knowledge base content and usage statistics. They are read live; the connector does not keep a separate copy.
• • Why: solely so the assistant can help you set up, audit and configure your bots.
• • Who receives them: the provider of the assistant you choose (Anthropic, OpenAI or another), acting as a recipient under its own privacy policy and running the processing on your account. Bravos does not control what that provider does with the data once it receives it.
• • What it never sees: your passwords and credentials, or your contact webhook's secret token (stripped automatically).
• • Control and retention: access is limited to your organisation, authorised via OAuth 2.1 (PKCE) without sharing your password, and the token is stored only as a hash, expires after 30 days and can be revoked at any time from your panel.
• • Model training: what the assistant reads is governed by the terms of the AI provider you connect. Data sent over an API/MCP-type connection is usually not used to train general-purpose models, but the provider determines this: review its terms before connecting your customers' data.

When you revoke the connection, access is cut off instantly and the connector keeps no copy of your data. The processing terms between you and Bravos are set out in the Data Processing Agreement (DPA).

7. Messaging Integrations (WhatsApp Business)

When a Customer connects their WhatsApp Business account to Bravos AI through Meta's Embedded Signup flow, we process the following data:

7.1 Data Processed

• • Messages: text, images, audio, and documents exchanged between end users and the chatbot
• • Contact identifiers: phone number and WhatsApp display name of the end user
• • Integration metadata: WABA ID, connected number, and connection status

7.2 Purpose

To generate automatic chatbot responses, display conversations in the Customer's dashboard, and maintain a message history for service analysis and traceability.

7.3 Coexistence Mode

The Customer can connect a number dedicated to the chatbot, or the number they already use in their WhatsApp Business application. In this second case, known as coexistence mode, the Customer's app keeps working as normal and the chatbot handles conversations in parallel. This involves two additional processing activities:

• • Messages the Customer sends from their own application: when the Customer replies to an end user from their phone or from WhatsApp Web, Meta sends us a copy of that message and it is logged in the conversation. This is what lets the chatbot detect that a person is handling that conversation and stop responding in it.
• • Initial sync required by Meta: when connecting the number, Meta requires requesting a sync of the Customer's chat history and contacts within the first 24 hours. We request that sync because it is a platform requirement, but we do not import that data: it is not stored in our database and is not logged in our records. The Customer's panel only contains conversations produced from the moment of connection onward.

Messages from WhatsApp groups never reach the chatbot and are not processed. The Customer can also exclude specific numbers: their conversations are not logged in Bravos AI.

7.4 Encryption and Retention

Messages are stored encrypted on our EU-based servers (Hetzner, Germany). Audio files are stored on Amazon S3, in the Ireland region, also within the European Union. Inactive conversations are automatically deleted after 90 days, except those associated with a contact request, which are retained for as long as the contact is retained (legitimate interest: context of the pre-contractual relationship); when the contact is deleted, the conversation is deleted as well. Media files are deleted 24 hours after receipt.

7.5 Data Deletion by End Users

An end user whose data has been processed via WhatsApp Business can request deletion by emailing [email protected] indicating the phone number from which they wrote. We process requests within 30 days as required by the GDPR.

8. International Transfers

Some of our providers are located outside the European Economic Area. In such cases:

• • We use EU Standard Contractual Clauses (SCCs) approved by the European Commission
• • We verify participation in the EU-US Data Privacy Framework where applicable
• • We implement appropriate technical and organizational measures

9. How Long We Retain Your Data

• • Account data: While your account is active + 30 days after cancellation
• • Billing data: 10 years (legal tax requirement)
• • Chatbot content: Until you delete it. When you delete your account, your data (chatbots, content and conversations) is kept for up to 30 days and then permanently erased; you can request immediate deletion by contacting us
• • Widget conversations: 90 days of inactivity (automatically deleted); those associated with a contact request are retained for as long as the contact is retained
• • Widget media files: 24 hours (automatically deleted)
• • Technical logs: 90 days

10. Your Rights (GDPR)

You have the right to:

• • Access: Request a copy of your personal data
• • Rectification: Correct inaccurate or incomplete data
• • Erasure: Request deletion of your data ("right to be forgotten")
• • Restriction: Restrict the processing of your data
• • Portability: Receive your data in a structured format
• • Objection: Object to the processing of your data
• • Withdraw consent: At any time, without affecting prior processing

To exercise these rights, contact: [email protected]

You also have the right to file a complaint with the relevant data protection authority, such as the Information Commissioner's Office (ICO) in the United Kingdom.

11. Data Security

We implement technical and organizational measures to protect your data:

• • Data encryption in transit (HTTPS/TLS)
• • Password encryption (bcrypt)
• • Restricted access to personal data
• • Regular and secure backups
• • Security monitoring

12. Cookies, Pixels and Similar Technologies

We use three categories of cookies and tracking technologies:

• • Essential: Authentication, session and basic functionality. No consent required since they are strictly necessary for the service to work.
• • Analytics: Help us understand how the service is used in aggregate (pages visited, time spent). On the public website, they require your consent through the cookie banner.
• • Marketing and advertising: Allow us to measure the effectiveness of our advertising campaigns and optimise them. On the public website, they require your consent through the cookie banner.

12.1 Specific tools we use

• • Google Analytics 4 (analytics) — provider: Google Ireland Ltd / Google LLC. Identifies your device pseudonymously to measure aggregate use of the service.
• • Google Ads Conversion Tracking (advertising) — provider: Google Ireland Ltd / Google LLC. Measures conversions from our ads and enables campaign optimisation and remarketing lists.
• • Meta Pixel (advertising) — provider: Meta Platforms Ireland Ltd. Measures conversions from our ads on Facebook and Instagram and enables campaign optimisation, custom audiences and lookalikes.

12.2 Server-side conversion measurement (Meta Conversions API)

To complement the above, when you complete certain actions on our service (for example, starting a trial or activating a subscription), we send a conversion event from our servers directly to Meta's servers through the Meta Conversions API (CAPI). This transmission allows us to measure conversions reliably and deduplicate them against those received via the Meta Pixel.

The data transferred to Meta via the Conversions API is:

• • SHA-256 hash of your email address (we do not transmit the plain email)
• • Your IP address and browser user-agent at the time of the conversion
• • Event type (for example, "start trial" or "subscribe") and a unique event identifier to prevent duplicates

12.3 Legal basis

• • On the public website (anonymous visits): we rely on your consent, collected through the cookie banner (Art. 6.1.a GDPR). If you reject the banner, we do not load Meta Pixel, Google Analytics or Google Ads.
• • In the user panel after sign-up: we rely on our legitimate interest (Art. 6.1.f GDPR) to measure conversions of our own product and optimise our advertising investment, balanced against your rights. This is standard practice in SaaS companies.

12.4 How to object or withdraw your consent

• • You can reject analytics and advertising cookies in the banner that appears when you enter the website.
• • You can configure your browser to block cookies or use the privacy controls offered by Google and Meta directly.
• • If you are a registered user and wish to object to the transmission of your data via the Meta Conversions API or any other advertising measurement tool, please email us at [email protected]. We process your request within a maximum of 30 days as required by the GDPR.

You can also configure your browser to block cookies, although this may affect the functionality of the service.

13. Minors

Bravos AI is not intended for individuals under the age of 16. We do not knowingly collect data from minors. If you are a parent or guardian and believe your child has provided us with data, please contact us to have it removed.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice in the service. The "Last updated" date will be updated accordingly.

15. Contact

For any inquiries regarding this Privacy Policy or the processing of your data:

• Email: [email protected]
• Registered office: Suite 7 Midshires House, Smeaton Close, Aylesbury, England HP19 8HL