Privacy Policy
Effective October 3, 2026
This policy covers RightSafe: an asset library that records usage rights on photos, video, and creator content, and blocks use the rights do not cover. It explains what personal data is collected, why, who it is shared with, how long it is kept, and the rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR), Portugal's data protection and electronic communications laws, and United States federal and state privacy laws.
Who is responsible for your data
RightSafe is operated by Erica Thompson (Brave Haven). For account, billing, and website data, Brave Haven is the controller. For the files and rights information a workspace uploads, the workspace's organization is the controller and Brave Haven processes it on their behalf, only to run RightSafe for them. For anything about your data, email hr@bravehaven.io. No data protection officer has been appointed, because one is not required at this size.
The short version
- We collect what an account and a shared asset library need: your name, email, a password we store only as a hash, and the files and rights information your team uploads.
- Files are stored privately. Nobody outside your workspace can open them except through a share link someone in your workspace created, and only while the license covers it.
- We never sell your personal information, and never share it for advertising.
- Analytics stays off unless you accept it, sets no cookies, and you can change your mind at any time.
What we collect, why, and for how long
Your account and workspace
- What
- Your name, email address, and password (stored only as a bcrypt hash), your workspace's name and members, and who invited whom
- Why we are allowed to
- Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b))
- How long we keep it
- For as long as the account exists. Ask us to delete it and it is deleted within 30 days
Files and rights information your team uploads
- What
- The photos, videos, audio, and documents your workspace uploads, and what you record about them: titles, creators or sources, license dates, channels, territory, notes, signed releases, and the email that gets renewal reminders. These may contain personal data about people who appear in them or signed them. Share links record which channel they were made for
- Why we are allowed to
- Processed on behalf of your organization, under these terms, to provide the service (GDPR Art. 28)
- How long we keep it
- Until someone in your workspace deletes it, or the workspace is closed. Deleted files are removed from storage at once
Renewal reminders and invites
- What
- The recipient's email address and the asset title and end date in the message, sent through Resend
- Why we are allowed to
- Contract: part of the service your workspace uses (GDPR Art. 6(1)(b)), and legitimate interests for invites a workspace sends (GDPR Art. 6(1)(f))
- How long we keep it
- We keep a record that a reminder was sent, without the address, for as long as the asset exists. Resend keeps delivery logs for a short period under its own terms
Billing
- What
- The workspace owner's email, the workspace name, and subscription status. Card details are entered on Stripe's own pages and never reach us
- Why we are allowed to
- Contract (GDPR Art. 6(1)(b)), and legal obligation: tax and accounting law (GDPR Art. 6(1)(c))
- How long we keep it
- As long as tax and accounting law requires, up to 10 years
Protecting sign up and sign in from bots (Vercel BotID)
- What
- When you sign up or sign in: signals from your browser and request that Vercel BotID uses to tell people from automated bots, such as browser and device characteristics. We receive only a verdict: person or bot
- Why we are allowed to
- Legitimate interests (GDPR Art. 6(1)(f)): keeping accounts safe from automated abuse
- How long we keep it
- We keep nothing. BotID runs from this site and sets no cookies
Running and securing the site
- What
- IP address, browser and device type, pages requested, and time of request, in server logs
- Why we are allowed to
- Legitimate interests (GDPR Art. 6(1)(f)): keeping the site working and protecting it from abuse
- How long we keep it
- No more than 30 days, then deleted automatically by our host
Understanding how the site is used (only if you accept)
- What
- When each page was viewed, the page address, the referring site, approximate location (country, region, city), browser, operating system, and device type. No cookies. Visits are told apart by a hash of the request that Vercel discards after 24 hours, so the data is not tied to you
- Why we are allowed to
- Consent (GDPR Art. 6(1)(a)). You can withdraw it at any time
- How long we keep it
- Vercel keeps it for our plan's reporting window, and may keep it longer. Withdrawing consent stops any further collection
Cookies and similar technologies
These are strictly necessary for the site to work, so they do not need your consent:
- next-auth.session-token and next-auth.csrf-token (cookies): Keep you signed in and protect forms. Kept: Until you sign out, and no more than 30 days.
- analytics-consent (localStorage): Remembers your analytics choice. Kept: Until you clear it.
Vercel Web Analytics sets no cookies. Its script is loaded only if you choose Accept analytics; until then nothing about your visit is sent to it. You can change your choice at any time with Analytics settings at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not ask.
Who we share it with
We use these service providers (processors). Each may use your data only to provide its service to us, under a data processing agreement:
- Vercel: Hosts the service, stores uploaded files privately (Vercel Blob), and keeps short-lived server logs. Runs Web Analytics, only if you accept, and BotID on sign up and sign in. Location: United States.
- Prisma Data: Runs the database that holds accounts, workspaces, and rights information (Prisma Postgres). Location: United States.
- Stripe: Takes subscription payments. Location: United States.
- Resend: Sends renewal reminders and team invites. Location: United States.
- Our email provider: Receives and stores email you send us. Location: United States.
We do not sell personal information and do not share it for cross-context behavioral advertising. We would disclose data to authorities only where the law requires it.
International transfers
Our providers store or process data in the United States. For transfers of personal data from the European Economic Area, the UK, or Switzerland, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses in the provider's data processing terms.
Your rights
In the European Union, the UK, and Switzerland
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted.
- Restriction: ask us to stop using your data while a concern is resolved.
- Portability: receive your data in a machine-readable format.
- Objection: object to processing based on our legitimate interests.
- Withdraw consent at any time, without affecting what was done before.
You can complain to a data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. Elsewhere, contact the authority where you live or work. We would appreciate the chance to put things right first.
In the United States
Depending on your state (including California, Colorado, Connecticut, Virginia, Texas, and others with comprehensive privacy laws), you may have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it, and to opt out of its sale, of targeted advertising, and of profiling. We do none of those three. We will not treat you differently for using any of these rights. You can use an authorized agent, and if we turn down a request you can appeal by replying to our answer.
How to make a request
Email hr@bravehaven.io and say what you would like. We answer within one month (GDPR), or within 45 days for US state privacy law requests, and tell you if a complex request needs longer. Requests are free.
How we protect it
- Every connection is encrypted with HTTPS
- Files are stored in a private store with no public address; every download is checked against your workspace and the asset's license first
- Passwords are stored only as bcrypt hashes
- Each workspace can see only its own files and rights information
Children
RightSafe is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
Changes to this policy
When this policy changes, we update this page and its effective date.