1 Overview & Commitment
Brava Creator Lab ("BravaLab", "We", "Us", or "Our") is committed to transparent, privacy-first data handling across our digital product ecosystem, including the GoNano platform (gonano.bravalab.online), digital toolkits, and fulfillment services. This Privacy Policy outlines the exact categories of data we collect, why we process them, how our fulfillment architecture works, and the rights you maintain over your personal information.
2 Information We Collect & Process
Our data collection is strictly limited to information necessary to fulfill orders, provision secure software access, personalize digital toolkits, and maintain service security:
| Category | Data Elements | Primary Purpose |
|---|---|---|
| Account & Identity | Name, email address, internal user ID (usr_...). |
User account provisioning, authentication, customer support. |
| Orders & Fulfillment | Stripe Checkout Session ID, PaymentIntent reference, itemized order lines, assigned license serials (GN-EN-..., BL-CFK-..., BL-AGK-...), order timestamp. |
Fulfillment dispatch, automated license stamping, certificate verification. |
| Payment Data | Processed directly by Stripe Inc. under PCI-DSS Level 1 compliance. | Payment execution. BravaLab servers never collect or store full credit card numbers or security CVVs. |
| Application Data | Saved project settings, custom palette configs, localized text drafts. | GoNano in-app project persistence and export functionality. |
| Attribution & Analytics | First-touch campaign tags (UTMs), browser session identifiers, click IDs (fbclid), timestamp. |
Marketing attribution, server-side conversion validation (Meta CAPI). |
| Security & Logs | IP address, user agent, server access timestamps. | Fraud prevention, rate limiting, system diagnostics. |
3 Architectural Data Flow & Outbox Telemetry
When you complete a transaction on Brava Creator Lab:
- Payment Processing: Stripe handles card authorization and notifies our webhook infrastructure via cryptographic signature verification.
- Atomic Fulfillment: Our server generates an internal order record, sequential collision-free license serial, and atomic outbox event.
- Centralized Telemetry: Operational lifecycle events are dispatched to the BravaLab central Ops gateway (
ops.bravalab.online) using HMAC-SHA256 authenticated payloads to ensure deterministic single-event accounting. - Digital Stamping: Downloadable PDF toolkits are personalized on-the-fly with your assigned license serial before being delivered via expiring secure download links.
4 Third-Party Service Providers
We share minimal necessary data only with verified service infrastructure providers who enable our operations under strict confidentiality:
- Stripe: Payment processing, fraud screening, and tax calculation.
- Hostinger: Cloud web server hosting, database infrastructure, and native transactional email dispatch.
- Meta Platforms (CAPI): Server-to-server purchase conversion measurement for advertising attribution.
We do not sell, rent, or trade your personal information to third-party data brokers or marketing aggregators.
5 Cookies, Local Storage & Tracking
We use functional browser storage (such as localStorage and sessionStorage) to remember your active product selection (e.g., GoNano core, Client Finder, Agency Kit), preserve active in-app builder edits, and maintain first-touch attribution parameters. These storage mechanisms are required for the seamless functioning of the interactive software and checkout configurator.
6 Data Retention Policy
We retain your account, license, and fulfillment data for the duration of your active platform entitlement and as required to maintain perpetual verification for licensed digital toolkits (e.g. through the public certificate verification route /verify/). Transaction records are retained as necessary to comply with statutory legal, accounting, and tax obligations.
7 Data Security Safeguards
Brava Creator Lab implements robust technical safeguards, including HTTPS TLS 1.3 encryption, database row-level locking, salted authentication tokens, secure HTTP headers, and access-controlled cloud infrastructure. While no digital system is completely infallible, we employ commercial-grade safeguards to protect your personal data.
8 Your Privacy Rights
Subject to applicable data protection laws, you maintain the right to:
- Access & Portability: Request a copy of personal information and active license entitlements associated with your email.
- Rectification: Request correction of inaccurate account or contact information.
- Erasure: Request deletion of personal records, subject to legal and regulatory compliance retention requirements.
- Inquiries: Direct any privacy request to our privacy officer at access@bravalab.online.
9 Children's Privacy
Our platform, software products, and commercial toolkits are intended exclusively for individuals 18 years of age or older. We do not knowingly collect personal information from minors.
10 Policy Revisions & Contact
We may update this Privacy Policy periodically. Significant changes will be noted with an updated effective date. For questions regarding data processing, please contact: