Privacy Statement

Using Bravik involves processing personal data in two distinct roles. That distinction determines who you need to address with which question, so it comes first.

Our details: Studio Primary (Eenmanszaak, a Dutch sole proprietorship), Eindhoven, Nederland, Chamber of Commerce 82701237, VAT number NL003719360B48. For privacy questions: info@studioprimary.com.

We are not required to appoint a data protection officer: we are not a public authority, our core activity is not large-scale systematic monitoring, and we do not process special categories of personal data on a large scale (art. 37(1) GDPR). Privacy questions arrive at the address above and are handled by us directly.

• Account data — first and last name, email address, encrypted password, language preference, registration and last-login times, and your email verification status.
• Business data — company name, legal form, address, Chamber of Commerce number, VAT number, IBAN, logo, branding and the details of any partners in a general partnership.
• Subscription and payment data — chosen plan, our invoices to you, payment status and the payment reference at our payment service provider. Your full card or account details never reach us; the payment service provider processes those.
• Administration data — invoices, quotes, contacts, expenses and receipts, hours, projects, mileage records, bank transactions and the resulting overviews. For this data we are the processor (article 1).
• Usage and technical data — IP address, browser and device data, login times, failed login attempts and application error reports.
• Communications — your messages to our support and the email we send you, with its delivery status.

Every processing operation has a purpose and a legal basis under art. 6(1) GDPR. They are set out side by side below.

Where we rely on a legitimate interest, we have weighed that interest against your privacy. You may object; see article 12. Where we ask for consent, you may withdraw it at any time — that does not affect the lawfulness of processing before withdrawal.

1. We do not sell, rent or trade your personal data.
2. We do not use your administration for advertising and do not share it with advertisers or data brokers.
3. We do not use your administration to train third-party AI models, and the sub-processor providing the AI features is contractually bound not to either.
4. We do not build profiles of you for commercial purposes.

When a period expires we delete the data or make it irreversibly anonymous. If a dispute, complaint or audit is pending, we retain the relevant data until it is concluded.

You may request deletion at any time, via info@studioprimary.com or from your account settings. This is how that works:

1. We confirm within one month. If your request is complex we may extend that period by two months; we will tell you so with reasons within the first month (art. 12(3) GDPR).
2. Your account is deactivated immediately. Logging in is no longer possible, active sessions are revoked, scheduled email and reminders are stopped, and nothing further is sent on your behalf.
3. Whatever is not covered by a retention obligation, we erase. That includes in any event your profile and preference settings, your branding and logo, support correspondence, usage statistics and security logs unrelated to an ongoing incident.
4. Whatever is covered by a retention obligation stays until that period expires. That is not our choice: art. 17(3)(b) GDPR expressly provides that the right to erasure does not apply to the extent processing is necessary for compliance with a legal obligation. For your administration, that is the period in article 5.
5. In the meantime we lock that data down. It is no longer used for the service, no longer displayed, no longer included in overviews and no longer disclosed to third parties. It remains solely to comply with the law and to be produced in an audit or dispute. This is the restriction under art. 18 GDPR.
6. If you expressly ask us to erase the administration sooner, we will do so. You are then instructing us as the controller of that data, and thereby assume responsibility for your own retention obligation. We confirm this in writing, and strongly recommend exporting first.
7. Once the last retention period expires we erase everything, without you having to ask again.

1. If you cancel your subscription, you retain access for ninety (90) days to export.
2. After that we retain your administration for the remainder of your statutory retention obligation, and delete it thereafter. You need do nothing.
3. If your account has been unused for twenty-four (24) months, we will warn you by email before closing it. The retention rule in paragraph 2 applies there too.

We engage service providers who process data on our behalf. A data processing agreement is in place with each of them. This is the complete list; it is derived from the software itself rather than from a standard template.

In addition, we provide data to a competent authority where we are legally required to, and to our accountant, adviser or lawyer to the extent necessary; they are bound by confidentiality. In the event of an acquisition or merger, data may transfer to the acquiring party, on the same terms and with prior notice to you.

If you would like advance notice when we add or replace a sub-processor, subscribe via info@studioprimary.com. The procedure is set out in article 6 of the Data Processing Agreement.

Bravik runs on infrastructure inside the European Union and most service providers are established in the Netherlands or the EU. At three points data leaves the EEA, and we state that explicitly because it concerns data you entrust to us.

• OpenRouter, Inc. (United States) — receives the receipt or invoice you have scanned, including everything printed on it, and for the AI assistant your question with limited business context. Only when you use those features.
• Cloudflare, Inc. (United States) — receives your IP address and browser characteristics on the login and registration forms, to protect against automated abuse.
• Google (Ireland, with onward transfer to the United States) — Google Analytics and Google Tag Manager on the public website. Without your consent Google receives only anonymous measurement signals (your IP address and the page visited), with no cookies and with no way to recognise you or follow you across visits. Analytics cookies are set only after you consent.

For these transfers we rely on the European Commission's standard contractual clauses (art. 46(2)(c) GDPR), supplemented by a transfer impact assessment and additional measures, and where applicable on the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, art. 45 GDPR). A copy of the safeguards used is available on request.

1. Bravik contains two AI features: reading receipts and invoices, and an assistant that answers questions about your administration. In accordance with art. 50 of the AI Act we state that you are interacting with an AI system.
2. These features are optional. If you do not use them, nothing is processed for that purpose and nothing is sent to the provider.
3. What is sent is set out in article 8 and article 9. Your full administration is not shared; each request carries only what that request needs.
4. Your data is not used to train models. That is contractually agreed.
5. No automated decision-making producing legal effects or similarly significant effects takes place (art. 22 GDPR). A suggested entry is a suggestion; you confirm it yourself.
6. AI output can be incorrect. See article 9 of the Terms of Service.

Art. 11.7a of the Dutch Telecommunications Act requires consent for storing or reading data on your device, except for what is strictly necessary. We apply that distinction as follows.

1. If you refuse, or do nothing, no analytics cookies are set and you are not identified. The measurement code does stay active in anonymous form (Google Consent Mode v2): Google receives the IP address and the page visited, but cannot link them to you or follow you across visits. Refusing is as easy as accepting.
2. We store your choice for twelve (12) months in your browser and you can change it at any time via the cookie settings at the bottom of the website.
3. On the pages your clients see — a shared invoice or quote under `/view/…` and the client portal under `/portal/…` — no measurement code at all is loaded and nothing is asked. Your clients are not measured there, not even anonymously.
4. In the logged-in environment only necessary cookies are set. The anonymous measurement code may be active there, on the same terms as above.

For the data for which we are the controller (article 1) you have the following rights:

• Access (art. 15) — find out what data we process about you and receive a copy.
• Rectification (art. 16) — have inaccurate data corrected or completed. Most of it you can change yourself in your settings.
• Erasure (art. 17) — request deletion, subject to the limits and procedure in article 6.
• Restriction (art. 18) — have processing frozen, for instance while an objection is being assessed.
• Portability (art. 20) — receive your data in a structured, commonly used, machine-readable format. Bravik offers CSV, UBL and XAF for this; you need not even ask.
• Objection (art. 21) — object to processing based on a legitimate interest. You may object to direct marketing at any time and without giving reasons.
• Withdrawal of consent (art. 7(3)) — where we asked for consent, you can withdraw it as easily as you gave it.

1. Send a request to info@studioprimary.com. We respond within one month, with a possible two-month extension for a complex request (art. 12(3) GDPR).
2. Where we have reasonable doubts about your identity we will ask for additional information. We never ask for a copy of your identity document by email.
3. Exercising your rights is free of charge. Only for manifestly unfounded or excessive, repetitive requests may we charge a reasonable fee or refuse, and we will explain why.
4. If your request concerns data a Bravik user has recorded about you — for instance because you received an invoice from one of our customers — we are the processor and that user is your point of contact. We will refer you and help that user carry out the request.

We take appropriate technical and organisational measures within the meaning of art. 32 GDPR. These include:

• encrypted connections (TLS) for all traffic, and encrypted storage of back-ups;
• passwords stored only as hashes, never readable, not even by us;
• short-lived access tokens in an httpOnly cookie, with single-use refresh tokens that revoke the entire family on reuse;
• double-submit cookie protection against CSRF and rate limiting on sensitive endpoints;
• strict per-organisation separation: every database query is bound to your organisation id, so customers' data cannot reach each other;
• an audit log of changes affecting money, so it can be established afterwards who did what;
• production access limited to those who need it, and secrets stored encrypted;
• regular back-ups and periodic dependency updates.

Found a vulnerability? Report it to info@studioprimary.com. We respond within five working days and will not take legal action against anyone who reports a vulnerability carefully and confidentially, accesses no more data than needed to demonstrate it, and gives us reasonable time to remedy it before publishing.

1. If we establish a personal data breach for which we are the controller, we report it to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk (art. 33 GDPR).
2. If the risk to you is likely to be high, we will inform you without undue delay and in clear language, stating what happened, which data is involved and what you can do yourself (art. 34 GDPR).
3. Where the breach concerns data for which you are the controller, we notify you without undue delay and not the supervisory authority — that notification is yours to make. We supply the information you need for it. The timing and contents are set out in article 8 of the Data Processing Agreement.
4. We keep an internal register of all breaches, including those not requiring notification.

If you disagree with how we handle your data, please tell us first via info@studioprimary.com — that is usually the quickest route. If we cannot resolve it, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl. You may also go to court.

Bravik is a business service and is not directed at people under the age of sixteen. We do not knowingly collect data about minors. If you believe this has nevertheless happened, please contact us and we will delete that data as soon as possible.

1. We update this statement when the service, our service providers or the applicable rules give cause to. The version number and date at the top indicate which version you are reading.
2. For a material change — a new purpose, a new legal basis, a new transfer outside the EEA or a longer retention period — we will inform you in advance by email or in the application.
3. Earlier versions are available on request.