PrivacyPolicy.

Who is responsible for your data

Brainrune, based in Romania, is the controller of the personal data described on this page. For anything about your data, including a request to exercise your rights, write to contact@brainrune.com. Every message is read by the person responsible for data protection at Brainrune, not by a ticketing system.

What we collect and why

When you visit the site

We count visits with Umami, an analytics tool we run on our own server at stats.brainrune.com. It sets no cookies, does not store your IP address and cannot follow you from one site to another. It records the page, the referring site, the country, the browser, the operating system and the type of device, as anonymous totals. Legal basis: our legitimate interest in knowing which pages are read (Article 6(1)(f) GDPR).

We use no advertising pixels, no session recording and no third-party trackers. The cookies the site sets are listed in the Cookie Policy; all of them are needed for the site to work.

Our servers keep standard technical logs: IP address, page requested, browser and time. Legal basis: our legitimate interest in keeping the service running and secure. Logs are overwritten within a few weeks and are not used to profile anyone.

When you send us a request

The quote form and the contact address receive what you choose to send: your email, the address of your site, the subject you picked, your message and the confirmation that you are at least 16. We use it to answer you and, if you become a client, to prepare the offer. Legal basis: steps taken at your request before a contract (Article 6(1)(b)), otherwise our legitimate interest in answering the people who write to us.

When you create an account

One account works for brainrune.com and for Brainrune Keywords. We store your email, your name, your password as a hash (never in clear text), whether your email is confirmed and, if you use one, the passkey that lets you sign in without a password. Legal basis: the contract you enter into with us (Article 6(1)(b)).

When you buy something

We store your billing name and address, your VAT or company number if you give one, the country used for VAT, the order and what it contains, the invoice, the licence keys issued to you, the sites where a licence is active, your subscription and its renewals, and the credit packs on your account. At checkout we also record your consent to automatic renewal and to immediate delivery of digital content, with the time it was given. Legal basis: the contract and our legal obligation to issue and keep accounting documents (Article 6(1)(b) and (c)).

We never see or store your full card details. The payment provider handles the card on its own systems; we receive the result of the payment and the brand and last four digits of the card.

When a Pro plugin checks its licence

The plugin sends our licence server the licence key, the product and the address of the site. That is all it sends: nothing about your store’s customers or orders reaches us. Legal basis: the contract.

When we do work on your site

If you give us access to your site or hosting, we may see the personal data your store holds about your own customers. In that case we act as your processor, only on your instructions and only for the agreed work, and we sign a data processing agreement with you on request. We keep access details confidential and ask you to revoke them when the work ends.

When you use Brainrune Keywords

We store the keywords you research, the market and language you chose, the reports produced and the credits spent, so you can reopen a report without paying twice. To build a report we send the keyword, the market and the language to our search data provider. We do not send your name, email or account identifier, so the query cannot be traced back to you by the provider. Legal basis: the contract.

Emails we send you

Our emails are transactional: email confirmation, orders and invoices, licence keys, renewal reminders before a payment is taken, expiry notices, credit balance warnings, password resets, security notices and replies to your requests. They are part of the service. We send marketing email only if you ask for it, and every such message has a one-click unsubscribe link.

How long we keep it

• Invoices and accounting records: 10 years from the end of the financial year, as Law 82/1991 on accounting requires.
• Account, licences, subscriptions and credits: while your account is open. When you close it, we delete the account and anonymise what remains, except the records we must keep for accounting.
• Quote requests that did not lead to work: 12 months after the last message.
• Support conversations: 12 months after they end, or for as long as the contract they belong to, if they document work we did.
• Keyword reports: until you delete them, or 24 months after they were run, whichever comes first.
• Server logs: a few weeks.
• Backups: encrypted, kept for up to 30 days. What you delete disappears from the live systems at once and from backups within that window.

Who else sees it

We do not sell personal data and do not share it for advertising. We use a small number of processors, each bound by a contract under Article 28 GDPR and each seeing only what its job needs:

• Hosting: the site, the app, the analytics server and the backups run on servers in Germany, in the European Union.
• Email: our mailboxes and the service that delivers our transactional emails, both in the European Union.
• Payments: our payment provider processes the payment and stores the card data. For fraud prevention and its own legal duties it acts as a separate controller, under its own privacy policy.
• Search data: the provider behind Brainrune Keywords receives the query, not your identity.
• Code hosting: plugin updates are published through GitHub. It receives no personal data from us.
• Accountant: receives invoices, as the law requires.

We also disclose data to a public authority when a valid legal request obliges us to. The full list of providers, with names and countries, is available from contact@brainrune.com.

Transfers outside the European Union

Our payment provider and our search data provider may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission’s standard contractual clauses or by an adequacy decision, such as the EU-US Data Privacy Framework for certified companies. Ask us for a copy of the safeguards that apply.

Your rights

You can ask us to show you the data we hold about you, to correct it, to delete it, to restrict how we use it, to send it to you or to another provider in a common format, and you can object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time, without affecting what was done before.

Write to contact@brainrune.com. We answer within one month, usually much sooner, and we may ask you to confirm your identity from the email on your account. It costs nothing.

If you think we have handled your data wrongly, you can complain to the Romanian supervisory authority, ANSPDCP, at dataprotection.ro, or to the authority in the country where you live. We would rather hear from you first and put it right.

Age

The Services are not meant for anyone under 16, and every form that asks for an email asks you to confirm your age. If we learn that we hold data about someone younger, we delete it.

Security

Passwords are stored only as hashes, connections are encrypted, admin access is limited and protected, and backups are encrypted. If a breach puts your data at risk, we tell you and the supervisory authority as the law requires.

Changes

When this policy changes we publish the new version here with a new date. If the change matters to you, for example a new provider that receives your data, we also tell you by email.