BraveStrides Privacy Policy

This Privacy Policy explains how BraveStrides ("we", "us", or "our") collects, uses, discloses, and safeguards personal information when you use our website, applications, and services (the "Services"). It is tailored to our mentorship platform and includes disclosures required under the EU/UK GDPR, Canada’s PIPEDA, and California’s CCPA/CPRA.

1) Information We Collect

• Account & Profile Data: name, email, role, organisation, timezone, profile fields (skills, interests, goals), optional avatar.
• Programme Data: mentorship preferences, cohort membership, matching inputs, pairing assignments, session notes and milestones.
• Scheduling & Meeting Data: availability windows, meeting dates/times, meeting links (e.g., Zoom), attendance status.
• Communications: messages, feedback forms, surveys, support inquiries.
• Billing Data: plan details, billing contact, payment status (processed by our payment processor; we do not store full card numbers).
• Device/Usage Data: IP address, browser/user agent, pages viewed, referral pages, app events, approximate location derived from IP.
• Cookies & Similar Tech: used for authentication, security, preferences, and analytics. See our Cookies section below.

2) Purposes and Legal Bases for Processing

We process personal information for the following purposes and, where GDPR applies, on these legal bases:

• Provide and secure the Services (account creation, authentication, tenant isolation, fraud prevention) — Contract, Legitimate Interests.
• Programme operations (matching, scheduling, goals/milestones, feedback, analytics) — Contract, Legitimate Interests.
• Communications (transactional emails, service announcements) — Contract, Legal Obligations.
• Improvement and analytics (usage metrics, performance, features) — Legitimate Interests or Consent where required.
• Billing and account management — Contract, Legal Obligations.
• Compliance and enforcement — Legal Obligations, Legitimate Interests.

3) Sharing and Disclosures

We do not sell personal information. We share data only as necessary to provide the Services:

• Service Providers/Processors: hosting, email delivery, analytics, error monitoring, payments, and communications (e.g., Zoom integration when used).
• Organisation Administrators: within your organisation, programme managers and admins may access relevant participant data and reports.
• Legal/Compliance: if required by law, subpoena, or to protect rights, safety, and integrity of the Services.
• Business Transfers: in a merger, acquisition, or asset sale, subject to this Policy and applicable laws.

4) International Data Transfers

Where data is transferred internationally, we implement appropriate safeguards (e.g., Standard Contractual Clauses) and adopt additional measures as required.

5) Security

We employ administrative, technical, and physical safeguards, including tenant isolation, access controls, encryption in transit, rate limiting, and monitoring. No method is 100% secure; we continuously improve our protections.

6) Data Retention

We retain personal information for as long as needed to provide the Services and fulfil the purposes above, then delete or anonymise it unless a longer retention period is required by law or legitimate business needs (e.g., dispute resolution).

7) Your Rights

Depending on your jurisdiction, you may have the following rights:

• GDPR/UK: access, rectification, erasure, restriction, portability, and objection; right to withdraw consent where processing is based on consent.
• CCPA/CPRA: right to know, delete, correct, and opt-out of certain disclosures; limit use of sensitive personal information where applicable; non-discrimination for exercising rights.
• PIPEDA: access and challenge accuracy; withdraw consent subject to legal/contractual restrictions; ask about our policies and practices.

To exercise rights, contact us at support@bravestrides.com. We may verify your identity and request information to process your request.

10) Integrations and Third Parties

• Zoom: If enabled by your organisation, we process meeting details (topic, time, link) you choose to store. We do not receive your meeting content unless explicitly shared in the app.
• Payments: Payments are processed by our payment processor; we do not store full card numbers.
• AI Features (if enabled): We may process text you submit for goal or content suggestions. Do not include sensitive personal information in prompts.
• PWA/Offline: The app may cache assets and previously visited pages on your device to support offline access. You can clear site data in your browser settings.

10a) Retired AI Career Advisor

BraveStrides previously offered an AI Career Advisor. It is no longer available. Resume text pasted into it was used to generate a report and then discarded; we did not retain the raw resume text. Assessment records created before it was retired may include non-sensitive intake fields (e.g., first/last name, email, current position, preferences). Contact us to request deletion of that record.

11) Organisation Responsibilities

Organisations using BraveStrides act as the controller of participant data within their tenant. They determine programme configuration, retention, and access. We act as a processor for such data and process it on their instructions.

12) Data Subject/Consumer Requests

You may contact your organisation admin for requests related to programme data (e.g., pairing notes). You can also contact us directly; we will coordinate with your organisation as needed.

13) Contact, DPO, and Complaints

Questions or concerns? Email support@bravestrides.com. If you are in the EEA/UK, you may also lodge a complaint with your local supervisory authority. We will respond to inquiries in a timely manner.

14) Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via the Services or by email. Your continued use after the effective date constitutes acceptance.

15) Subprocessors

We use vetted service providers to help deliver the Services (e.g., cloud hosting, email delivery, analytics, payments). We require appropriate contractual safeguards and data protection commitments from our subprocessors. A current list of key subprocessors is available upon request at support@bravestrides.com.

16) Data Exports and Deletion

• Export: Organisation admins may request exports of programme data. We provide exports in a commonly used, machine-readable format where feasible.
• Deletion: Organisation admins can request data deletion for their tenant. We will process deletion subject to legal obligations and permitted retention (e.g., financial records).
• User Requests: Individuals may request deletion via their organisation admin or by contacting us directly. We will coordinate with the organisation as controller.

17) Backups and Data Residency

Operational backups are maintained for disaster recovery and are purged on a rolling schedule. Backups are encrypted and stored in reputable cloud regions. While we strive to honour residency preferences, some processing may occur in other jurisdictions by necessity (e.g., global CDN, support operations). We apply appropriate safeguards to such transfers.

18) Security Incidents

We maintain an incident response programme. In the event of a data breach that is likely to result in a risk to individuals’ rights and freedoms, we will notify affected organisations and regulators as required by law and our agreements.

19) Regional Disclosures

• EEA/UK: International transfers rely on lawful mechanisms (e.g., SCCs). We will enter into a Data Processing Addendum upon request.
• US (CCPA/CPRA): We do not “sell” personal information as defined by California law. We may “share” limited data for cross-site analytics/ads only with consent where required. You may exercise rights as described in Section 7.
• Canada (PIPEDA): We rely on consent or other lawful bases per PIPEDA. Individuals can contact us to access or correct information.

20) Data Processing Addendum (DPA)

For organisation customers subject to data protection laws requiring a DPA, we provide a standard DPA that incorporates appropriate transfer mechanisms and security commitments. Contact support@bravestrides.com to request our DPA.