Privacy Policy

1. Who we are

Bravoora is operated from Dubai, United Arab Emirates. The legal entity, trade licence number and registered address will be added here before launch. For any privacy question or request, email [email protected].

2. What we collect

We collect only what each feature needs.

• Early access (waitlist): your email address; optionally your WhatsApp number; your answers to three short questions (who you shop for, what to watch, where you shop); your language; the page and campaign link you came from; a referral code if a friend invited you; the text and time of your consent; a hashed (one-way) version of your IP address and your browser type, kept for abuse prevention.
• Profile builder: country, year of birth, gender (optional), your main reason for using Bravoora, diet, allergies and intolerances, ingredient restrictions, optional health context (for example pregnancy, IBS, diabetes, high blood pressure, shopping for a child or an older relative), family profiles (a first name or nickname plus that person’s diet and allergies), how you heard about us, and the stores you shop at. Health-related details are stored only after you tick the consent box on the last step.
• The app (at launch): your account and sign-in details; the profiles you create; the products you scan and the results you get; label photos you choose to take so we can read the ingredient list; device and app version for troubleshooting; and your subscription status from the App Store or Google Play. We never see your card details.
• Founding member reservations and shop interest: your email and the package or product you are interested in. No payment is taken on this website.
• Support: what you send us when you contact support, including reports of wrong results.
• Website usage: we use privacy-friendly, aggregated analytics to understand which pages are used. We do not use advertising cookies or sell browsing data.

3. Why we use it, and on what basis

• To provide the service you asked for: your early-access spot, referral rewards, your pre-built profile, and, in the app, results for your profile (performance of a contract, or steps before one).
• To send you news, tips and offers by email and, if you opted in separately, by WhatsApp (consent). You can unsubscribe at any time using the link in every email or by replying STOP on WhatsApp.
• To store allergy, diet and health details you give us (explicit consent). You can edit or delete them at any time.
• To keep the service secure, prevent abuse (for example fake referrals) and improve the product (legitimate interests).
• To meet legal obligations, such as keeping purchase records.

4. Email and WhatsApp messages

When you join early access you agree to receive your invite plus ingredient tips and member perks by email. WhatsApp messages are sent only if you gave us your number and ticked the WhatsApp box. Every message tells you how to stop. Stopping marketing never affects your early-access spot or your account.

5. Who we share it with

We do not sell your personal data. We share it only with providers who process it on our behalf under contract, and only for the purposes above:

• Hosting and database for this website and its waitlist (Cloudflare).
• Email and WhatsApp delivery (Brevo).
• App backend and authentication (Supabase) at launch.
• App stores for subscriptions (Apple App Store, Google Play), which handle payment under their own privacy policies.
• Label-reading services that extract text from the label photos you take. We choose providers that do not use your photos to train their models.
• Authorities or advisers when the law requires it or to protect our rights.

6. International transfers

Our providers may process data in the United Arab Emirates, the European Union, the United Kingdom and the United States. Where the law requires it, we use recognised safeguards such as standard contractual clauses.

7. How long we keep it

• Early-access data: until the app launches and for up to 24 months of inactivity after that, unless you delete it sooner.
• Profile-builder data: until you delete it, or until 24 months after launch if you never create an account.
• Account data: for as long as you have an account. Deleting your account deletes your profiles, scans and photos.
• Hashed IP addresses and browser data used for abuse prevention: 90 days.
• Purchase and consent records: as long as the law requires.

8. Your rights and choices

Wherever you live, you can ask us to access, correct, delete or export your data, object to or restrict certain processing, and withdraw consent at any time (which doesn’t affect processing that already happened). Email [email protected]; we answer within 30 days. You can also delete your account and data yourself in the app, or follow the steps on our account deletion page.

• United Arab Emirates: rights under Federal Decree-Law No. 45 of 2021 (PDPL). You may complain to the UAE Data Office.
• Saudi Arabia: rights under the Personal Data Protection Law. You may complain to SDAIA.
• European Union and United Kingdom: rights under the GDPR and UK GDPR, including the right to complain to your data protection authority (for the UK, the ICO).
• California and other US states: the right to know, delete and correct, and to opt out of the sale or sharing of personal data. We do not sell or share personal data for cross-context advertising.

9. Children

Accounts are for people aged 18 and over. A parent or guardian can add a child as a family profile and is responsible for that information. If you believe a child has created an account, email us and we will delete it.

10. Security

Data is encrypted in transit, access is limited to people who need it, and secrets are never stored in the website code. No system is perfectly secure, so please use a strong, unique password for your account.

11. Changes

When this policy changes in a meaningful way, we update the date above and, for important changes, tell you by email or in the app.

12. Contact

Contact: [email protected]