BRAPPED — Privacy & Cookie Policy
Last updated: June 2026
This policy explains what data BRAPPED collects, why, and how you can exercise your rights. BRAPPED is operated by [YOUR LEGAL ENTITY NAME, REGISTERED ADDRESS] (“we”, “us”). Contact us at hello@brapped.app.
1. What we store on your device
We store a single sign-in token in your browser's localStorage under the key brapped-auth. This token is strictly necessary to keep you logged in and is never used for tracking or advertising. We also store a small acknowledgement flag (brapped-cookie-ack) so we don't show the cookie notice every visit.
We do not use tracking, advertising, or analytics cookies. No third-party scripts are loaded that deposit cookies on your device.
2. Data we collect
- Account data: your email address, collected when you sign up or sign in via Google OAuth.
- Uploaded clips & metadata: video files, thumbnail images, and the metadata you enter — car make, colour, price, clip date, and event/location. GPS coordinates extracted from video files are stored alongside clips.
- Waitlist email: if you join the waitlist, your email is stored to contact you at launch.
- Usage data: standard server logs (IP address, timestamp, requested path) retained by our infrastructure provider for security purposes.
3. Third-party processors
We share data with the following processors to operate the service:
| Processor | Purpose | Data transferred | Location |
|---|---|---|---|
| Supabase | Database, file storage, authentication | All account & clip data | [confirm region — EU/US?] |
| PlateRecognizer | Automatic number plate detection on uploaded clips | Video frames extracted from uploads | [confirm — may be non-EU] |
| Sender.net | Waitlist & transactional email | Waitlist email addresses | [confirm — EU?] |
| OpenStreetMap / Nominatim | Reverse-geocoding GPS coordinates to place names | GPS coordinates from uploaded clips | EU (OSMF, UK/EU servers) |
Where processors are located outside the EU/EEA, transfers are covered by Standard Contractual Clauses or an adequacy decision. [Confirm DPAs are in place with each processor before publishing.]
4. Legal basis for processing
- Contract performance (Art. 6(1)(b) GDPR): processing your account data and clips is necessary to provide the BRAPPED service.
- Legitimate interests (Art. 6(1)(f) GDPR): server logs and security monitoring.
- Consent (Art. 6(1)(a) GDPR): waitlist email — you can withdraw at any time by emailing us.
5. Retention
- Account data and clips: retained while your account is active and for up to 30 days after deletion.
- Waitlist emails: until the waitlist is closed or you ask to be removed.
- Server logs: [confirm retention period with Supabase/Vercel].
6. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Rectification of inaccurate data.
- Erasure (“right to be forgotten”) — email us and we will delete your account and clips.
- Restriction of processing in certain circumstances.
- Data portability — we can provide your data in a machine-readable format on request.
- Object to processing based on legitimate interests.
To exercise any right, contact hello@brapped.app. You also have the right to lodge a complaint with your national supervisory authority.
7. Changes to this policy
We will update this page when anything changes and revise the “Last updated” date at the top. Continued use of BRAPPED after a change constitutes acceptance of the updated policy.