Privacy Policy

1. Who we are

Bravoora is a service of Bravoora Technology, based in the United Arab Emirates. For any privacy question or request, email [email protected].

2. What we collect

We collect only what each feature needs.

• Joining quickly: your email address, your mobile number with its country code, your language, your acceptance of the Terms and this policy (with their version and the time). We do not verify the mobile number by text message. When you first sign up we also record how you arrived: the page you signed up on, the form you used and any campaign tags in the link (utm_source, utm_medium, utm_campaign), and the first and the most recent way you reached the website (the kind of link, such as a search engine or a social app, its campaign tags and the page you landed on, with the day). And each time you sign up from the Professionals or Shop page, we record what you were interested in: your profession and the number of clients you picked, or the shop.
• Building your profile: the same account details (the mobile number is optional here), plus your answers: your goals; your date of birth (day, month and year), which we use to check you are 13 or over and, only if you have switched on Bravoora news by email, to send you a birthday message; if you choose calorie and weight tracking, also your name, sex, height and weight; the ingredients you want to avoid or be warned about, including any you add in your own words, and why (allergy, intolerance or your choice) if you say; your diet; your country and city; and how you heard about us. You can also add profiles for up to 5 other people, such as a partner, a parent or a child: for each, the name you give, their year of birth, your relationship, and the ingredients and diet you set for them. How you heard about us and the extra profiles are optional; the other questions are needed to finish, and you can save a draft at any step. Allergy, diet and body details, including the ingredients you add yourself and the reasons you give, are saved with your profile only after you tick the consent box for them.
• Before you confirm your email: what you submit is held aside and applied to your account only when you press the button in the confirmation email. If you never confirm, it is deleted (section 7).
• On your own device: when you are not signed in, the profile builder keeps a draft in your browser so you can pick up where you left off. It is removed when you save it, start over or sign out, or when you clear your browser data, and it is discarded if you come back more than 30 days after you last used the builder. It is not sent to us until you save. When you are signed in, the builder keeps nothing on your device. If you arrive through a referral link, its code is also kept in your browser for 30 days, so the referral can be credited if you buy in that time.
• Signing in: a strictly necessary session cookie keeps you signed in for up to 7 days. It holds a random value, not your email address. Signing out ends your sessions on every device.
• Paying on this website: when you press Pay, your browser keeps a random value. It lets that browser, and only that browser, reopen a payment page it started and show that order in full. It is not your email address, it is never sent to analytics, and it is no longer used 30 days after you last press Pay; it is deleted the next time you open a page where you can pay or see your order. Your receipt, and any email about a refund of that order, carry a private link that shows the order in full on any device, so anyone you forward one of them to can see it too.
• Marketing choices: whether you want Bravoora news by email and, separately, launch updates on WhatsApp, with the version of the wording you agreed to, the time you last switched each one on and, while one is off, the time you switched it off. Both are optional and start switched off.
• Buying on this website: the plan or edition you chose, the email address you pay with, the name you want on your member card (optional), the member number you asked for and the one assigned to you, for a gift the recipient’s email address (optional) and your message, the referral code of the link you arrived through, the first and the most recent way you reached the website (the kind of link, its campaign tags and the page you landed on, with the day), the amount, the state of the order (for example pending, paid or refunded) and the payment reference. You enter your card details on our payment partner’s secure page and they never reach Bravoora. A keyed one-way hash of your IP address is kept with the order to limit repeated checkouts.
• Referrals: the code of the link you arrived through, saved with your order, so that you and the friend who shared it each get your extra month.
• Abuse prevention: a keyed one-way hash of your IP address, used to limit repeated sign-ups and checkouts, and your browser’s user-agent string (the browser and its version, the operating system and the device type).
• Support: what you send us when you contact support, including reports of wrong results.
• The label checker and other free tools: what you paste into them is processed in your browser and is not sent to us.
• Website analytics: we use PostHog to understand how the website is used and to improve it. It records the pages you view and where you came from (the referring website and campaign tags), the buttons you press and the steps you take, your IP address, your approximate location worked out from it, and device details (browser, operating system, device type and screen size). It also records session replays (a reconstruction of what happened on the page, with everything you type and every allergy, diet, goal and health choice masked so it is never recorded), heatmaps of where people click and scroll, page-speed measurements, errors, and the answers to any short survey you choose to answer. It stores an identifier in a cookie and in your browser’s local storage so visits can be linked. Event details never include your email address, name, member number, allergies, diet, goals or barcodes.
• Visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland are asked first: analytics starts only after you press Allow. Everyone else can switch it off at any time with the Stop analytics link at the bottom of every page.
• The app (at launch): your account and profiles; the products you scan and their results; the meals, goals, weight and water you choose to log; medicines and supplements you log (name, dose, time, reminders, expiry); steps and calories burned from Apple Health or Health Connect, only if you switch it on; if you link to a professional, the items you choose to share with them; the label and meal photos you choose to take; your device and app version; and your subscription status from Apple or Google.

3. Why we use it, and on what basis

• To run your account, save your profile, process orders, issue member numbers and gift codes, send the emails the service needs, and credit referral months (to perform our contract with you, or to take steps you asked for before one).
• To store allergy, intolerance, diet and body details, including the ingredients you add in your own words and their reasons (your explicit consent, which you can withdraw by deleting them or your account).
• To send Bravoora news by email, including a birthday message on your birthday, or launch updates on WhatsApp (your consent, only if you ticked that box).
• To measure and improve the website with analytics, session replays, heatmaps and surveys (our legitimate interests; in the EU, EEA, UK and Switzerland, your consent).
• To keep the service secure, prevent fake sign-ups, repeated checkouts and referral abuse, and fix problems (our legitimate interests).
• To keep purchase, refund and tax records (legal obligation).

4. Emails and WhatsApp

Some emails are part of the service and are sent whatever your marketing choices: the confirmation email, sign-in links, receipts with your member number, gift codes, the launch-day email, for monthly plans the reminder to keep your plan, and notice of important changes to these documents. Marketing emails and WhatsApp updates are sent only if you ticked those boxes. You can turn either off at any time from your account on this website, with the unsubscribe link in every marketing email, or by replying STOP on WhatsApp. Turning them off never affects your account, your profile or a purchase.

5. Who processes it for us

We do not sell your personal data or share it for advertising. We use these providers, under contract and only for the purposes above:

• Our hosting provider: hosting, the database and security for this website.
• Our email providers: one sends the emails that are part of the service (section 4) and receives your email address and what those emails say. A separate one holds the marketing lists and sends marketing emails and, if you opted in, WhatsApp updates: it receives your email address and language, and your mobile number only if you chose WhatsApp. Neither receives your profile answers.
• Our payment partner, a UAE payment company licensed by the Central Bank of the UAE: payments on this website. It processes your card and payment details under its own terms and privacy policy, and tells us whether a payment succeeded.
• PostHog, Inc. (United States): the website analytics, session replays, heatmaps and surveys described in section 2.
• When the app launches: the app’s hosting and sign-in services, Apple and Google for subscriptions, and image-reading services for the label and meal photos you choose to take.
• A professional you link to with their code: only what you choose to share, until you stop sharing.
• Authorities or professional advisers, when the law requires it or to protect our rights.
• Ask [email protected] and we’ll tell you the name of any provider.

6. International transfers

Our providers may process data in the United Arab Emirates, the European Union, the United Kingdom and the United States; our analytics data is stored in the United States. Where the law requires it, we use recognised safeguards such as standard contractual clauses.

7. How long we keep it

• Sign-ups never confirmed: deleted after 30 days, with anything submitted with them, unless an order is linked to them.
• Confirmation links last 24 hours and sign-in links 1 hour. Each works once, and a newer link replaces any older unused link of the same kind.
• Sign-in sessions: up to 7 days, or until you sign out or delete your account.
• Profile-builder drafts on your device (only while you are not signed in): until you save them, start over, sign out or clear your browser data. A draft is discarded if you open the builder more than 30 days after you last used it.
• A referral code from a link you opened: 30 days, in your browser.
• The payment value in your browser: no longer used 30 days after you last press Pay, and deleted the next time you open a page where you can pay or see your order.
• Account and profile data: until you delete your account.
• Hashed IP address and user-agent string: 90 days.
• Orders on which a payment was started, whether or not it went through, with their payment attempts and refunds: as long as tax and commercial law requires. If you ask us to delete your data, we keep them without your name, email address or the name on your card.
• Your member number: kept with your order record. A number is never given to anyone else, even after a refund.
• Analytics: kept under PostHog’s standard retention periods; session replays are deleted after 30 days.
• Records of your consents (which versions of the Terms, this policy and each consent wording you accepted, and when you accepted them, agreed to us storing allergy, diet and body details, and switched marketing on or off): kept after you delete your account, without your name, email, mobile number or profile, so we can show what was agreed and when.
• The deletions above that depend on time are carried out by an automatic clean-up that runs every day.

8. Your rights and choices

Wherever you live, you can ask us to access, correct, delete or export your data, object to or restrict certain processing, and withdraw consent at any time (this does not affect processing that already happened). When you are signed in on this website you can download your data, change your marketing choices and delete your account yourself. You can also email [email protected]; we answer within 30 days.

To object to analytics, press Stop analytics at the bottom of any page: it switches PostHog off in that browser straight away. Blocking cookies or clearing your browser data also stops it being linked across visits.

• United Arab Emirates: rights under Federal Decree-Law No. 45 of 2021 (PDPL). You may complain to the UAE Data Office.
• Saudi Arabia: rights under the Personal Data Protection Law. You may complain to SDAIA.
• European Union and United Kingdom: rights under the GDPR and UK GDPR, including the right to complain to your data protection authority (for the UK, the ICO).
• California and other US states: the right to know, delete and correct, and to opt out of the sale or sharing of personal data. We do not sell or share personal data for cross-context advertising.

9. Children

Accounts are for everyone 13 and over. We ask for your date of birth, and if you are under 13 the profile builder stops and saves nothing. A parent or guardian can add a child under 13 as a profile on their own account; the child has no account of their own. We store the child’s name, year of birth, and the ingredients and diet you set, only after you tick the consent box, and you can delete it at any time. If you believe a child under 13 has given us information themselves, email [email protected] and we will delete it.

10. Security

Data is encrypted in transit. Sign-in works through one-time links sent to your email, so there is no website password to steal; we store only keyed hashes of those links and of session values, never the values themselves. Access is limited to people who need it, and secrets are never stored in the website code. No system is perfectly secure, so keep access to your email account safe.

11. Changes

When this policy changes in a meaningful way, we update the date above and, for important changes, tell you by email or in the app before they apply.

12. Contact

Privacy questions and requests: [email protected]. Everything else: [email protected].