This Privacy Policy explains how Holded Brains ("we", "us") handles personal data when you visit our website, register a workspace, purchase credits, or run automations through our platform. It applies to individuals ("you") and to the organisations you represent.
1. Data we collect
We collect only what we need to operate the service:
- Account data — first name, last name, email address and hashed password you provide at checkout.
- Billing data — credit purchases, promo codes, currency, invoice history and payment method (bank transfer today; card and wallet options later).
- Workflow data — the automations, templates and integrations you install, run and configure.
- Technical data — IP address, browser, device, pages viewed and diagnostic logs, used to keep the service secure and stable.
2. How we use your data
We use personal data to:
- Create and maintain your workspace and credit balance.
- Deliver and support the automations, templates and integrations you install.
- Process payments and send invoices, receipts and bank transfer instructions.
- Detect fraud, abuse and violations of our Acceptable Use Policy.
- Communicate service updates and, where you have opted in, product news.
3. Legal bases (GDPR)
For users in the EU/EEA and UK we rely on the following legal bases: performance of a contract (running the service you purchased), legitimate interests (security, fraud prevention, product improvement), legal obligation (tax and accounting) and consent (analytics cookies, marketing emails).
4. Sharing and subprocessors
We share personal data only with vetted subprocessors that help us run the platform — for example our hosting provider, payment/bank reconciliation partners, transactional email provider and error-monitoring service. We do not sell personal data.
5. International transfers
Where data leaves the EU/EEA, transfers are covered by adequacy decisions or Standard Contractual Clauses with the recipient.
6. Retention
Account and billing data is kept for as long as your workspace is active and for up to 7 years after closure to meet tax and accounting obligations. Diagnostic logs are kept for up to 90 days. You can request earlier deletion where no legal obligation applies.
7. Your rights
Subject to local law, you may access, correct, export or delete your personal data, restrict or object to certain processing, and withdraw consent at any time. Contact us at [email protected].
8. Security
We use industry-standard controls including encryption in transit, encryption at rest for credentials, least-privilege access, audit logging and regular backups. No system is perfectly secure — please use a strong, unique password (minimum 8 characters).
9. Children
Holded Brains is not directed to children under 16 and we do not knowingly collect their data.
10. Changes
We may update this Policy from time to time. Material changes will be announced in-app and by email at least 14 days before they take effect.