Privacy Policy

The data controller is Bravexo ("we", "Bravexo"), reachable at kontakt@bravexo.pl.

Data submitted through the contact form: name, email address and message content — used only to respond to the inquiry.

Client panel account data: email address and password (stored in encrypted form by Supabase Auth), organization role, and project name and domain.

Data from Google Search Console and Google Analytics, fetched only after the organization admin knowingly connects their Google account in the panel (the “Connect Google” button under Integrations) and grants the scopes listed below:

• `https://www.googleapis.com/auth/webmasters.readonly` — read Search Console data: verified sites, search queries, clicks, impressions, CTR and average position per page and query.

• `https://www.googleapis.com/auth/analytics.readonly` — read Google Analytics (GA4) data: property/service ID, sessions, users, pageviews and conversion events, broken down by date and page.

All of this data is read-only access (we never modify or delete anything in the client's Google account), stored in our database (Supabase, EU region) and shown only to members of that organization who are logged into the panel. It is never used for advertising and never sold or shared with data brokers.

Bravexo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: data from Google APIs is used solely to provide and improve user-facing panel features (ranking, traffic and SEO audit reports), is never used for advertising, and is never used to train generalized AI/ML models unrelated to that feature. Only the systems needed to process and display that data in the panel have access to it.

We use trusted subprocessors: Supabase (database and authentication, EU region), Vercel (application hosting), Google LLC (Search Console and Analytics APIs, read-only). Each processes data solely on our instructions, to the extent necessary to provide the service, under the data processing agreements (DPAs) each provider maintains. We do not sell data or share it with other third parties for marketing purposes.

We process data under GDPR Art. 6(1)(b) (performance of the SEO/marketing services agreement) and Art. 6(1)(f) (legitimate interest — handling contact inquiries and maintaining panel security).

Account and project data is kept for the duration of the cooperation, and afterwards for the period required by tax and accounting regulations. Contact form messages are deleted no later than 12 months after the last contact, if no agreement was signed.

You have the right to access, rectify, erase, restrict processing of, and port your data, to object, and to lodge a complaint with the relevant data protection authority. To exercise these rights, email kontakt@bravexo.pl.

You can revoke Google's access to Search Console/Analytics at any time in your Google account settings: myaccount.google.com/permissions. After revoking access, Bravexo stops pulling new data from those APIs, and you can request permanent deletion of previously fetched data by emailing kontakt@bravexo.pl — we delete it within 30 days of receiving the request.

The panel uses only strictly necessary cookies (login session, light/dark theme preference, language choice). We do not use advertising cookies or third-party analytics trackers on the public website.

Questions about data protection should be sent to kontakt@bravexo.pl.