Privacy Policy

1. Controller

BuroBrain LLC

12600 Hill Country Blvd,, Bldg R, Ste 275 PMB 17422257, Austin, TX 78738, USA

Data protection contact: privacy@burobrain.com

2. Visiting this website

Pages are served from our hosting provider. As with any web server, the request is processed together with the technical data needed to deliver it: IP address, requested page, referrer, browser and operating system, date and time. This data is used to deliver the site and to keep it secure and available.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing a functioning, secure website.

3. The enquiry form

If you send us a project enquiry, we process what you enter: name, email address, and optionally company, phone number, project type, budget range, timeline, existing website and your description of the project. We use it to answer your enquiry and, if it leads somewhere, to prepare an offer.

To prevent automated abuse, the form also records a one-way hash of your IP address together with the submission time, and your browser’s user-agent string. The IP address itself is never stored — only the hash, which we cannot reverse and which is used solely to count submissions from the same connection within an hour.

Legal basis: Art. 6(1)(a) and (b) GDPR — your consent, and steps taken at your request prior to entering into a contract. Abuse prevention rests on Art. 6(1)(f) GDPR.

4. Where the data is stored

Enquiries are stored in a managed PostgreSQL database hosted in the European Union. Access is restricted to the studio’s own staff through an authenticated admin area; the database is not reachable from the public internet without that authentication.

If email notification is enabled, a copy of the enquiry is sent to our own mailbox through an email delivery provider acting as a processor on our behalf.

5. How long we keep it

Enquiries that do not lead to a project are deleted no later than 12 months after our last contact with you. Where a contract results, the relevant records are kept for as long as statutory retention periods require. Rate-limiting hashes are only meaningful for one hour and are removed with the record they belong to.

6. The demo project

The ordering demo at /demo/acai-cafe is a working system, so placing a demo order writes a demo order record: the name, email address and any note you type into it. No payment is processed and no card details are ever collected — the payment step is simulated. Please do not enter data in the demo that you would not want stored; demo orders are deleted periodically.

7. Cookies and analytics

This site sets no advertising or tracking cookies and embeds no third-party trackers. Small amounts of data are stored in your browser (local storage) purely to remember things like your language choice and, in the demo, the contents of your cart. That data never leaves your device.

Where we measure usage, we use a privacy-friendly, cookie-free method that records page views in aggregate without profiling individual visitors.

8. Your rights

To exercise any of these, write to privacy@burobrain.com. We answer within one month.

• Access to the personal data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR)

9. International transfers

BuroBrain LLC is established in the United States, so data you send us may be accessed by our staff there. Such transfers are based on the standard contractual clauses and, where applicable, on your consent under Art. 49(1)(a) GDPR. The database itself remains hosted in the European Union.

10. Changes

We update this policy when the site changes. The date at the top always shows the current version.