Privacy Policy

1. Who this policy applies to

This policy explains how we handle personal data in two places:

• The bruk.uk website, which presents BRUK.
• BRUK Marketing, an internal tool we use to publish to BRUK's official profiles: Instagram @bruk.ia, the Facebook Page bruk.ai.official, BRUK's LinkedIn Page and the YouTube channel @bruk-ai. The tool uses the official APIs of Meta, LinkedIn and Google (YouTube).

The BRUK app (app.bruk.uk) will have its own policy before any public sign-up and is not covered here.

Data controller: BRUK Labs Ltd (in formation). Contact: [email protected].

2. Data we process

2.1 On the website

• The website has no forms, no sign-up and no tracking cookies.
• Your language choice is stored in your own browser and is not sent to us.
• The services that host and deliver the website (Vercel and Cloudflare) receive technical data from each visit, such as IP address, browser, time and requested page, to deliver the content and protect against abuse.
• We do not use third-party analytics tools. If that changes, this policy will be updated first.

2.2 In the publishing integrations (BRUK Marketing)

When BRUK itself connects its official profiles to the tool, we receive from the platforms:

• identifiers and public names of BRUK's accounts and Pages;
• access authorizations (tokens) granted by BRUK itself;
• identifiers and links of the posts we publish;
• aggregate metrics for those posts, such as reach, views and interactions, when the platform provides them.

When a team member opens or replies to comments on our own posts, the tool may read the public comment and the public name of the person who wrote it. We do not copy those comments into other systems or build profiles of people.

We do not access private messages, follower lists, contacts or third parties' personal accounts.

2.3 When you write to us

If you send us an email, we use your address and the content of your message to reply.

3. What we use data for

• Publishing and scheduling, on BRUK's official profiles, content that a team member has approved.
• Confirming that each post was published correctly.
• Following aggregate metrics to plan future content.
• Keeping an audit record of who approved and published what.
• Replying to messages and protecting our systems.

We do not sell data. We do not use data received from platform APIs for targeted advertising or to train artificial intelligence models.

Legal bases: legitimate interests in operating the website and our own channels (UK GDPR, Art. 6(1)(f); LGPD, Art. 7, IX); compliance with legal obligations, where applicable; and handling your requests.

4. Data received from platforms

• Google and YouTube. BRUK Marketing's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The YouTube integration uses YouTube API Services: when a channel is connected, the YouTube Terms of Service and the Google Privacy Policy apply. Access can be revoked at any time in your Google Account permissions.
• Meta (Facebook and Instagram). We use the data only for the purposes in section 3 and in line with Meta's platform terms. Access can be revoked in Facebook Business Integrations and in Instagram apps and websites.
• LinkedIn. We use the data only for the purposes in section 3. Access can be revoked in LinkedIn permitted services.

5. Where data is stored and who it is shared with

• The publishing tool runs on BRUK's own server in São Paulo, Brazil, rented from Hostinger, with the open-source software Postiz. Access to the tool is restricted to the team's private network.
• Backups are encrypted before they leave the server and stored in Cloudflare R2.
• Providers that process data on our behalf: Hostinger (server), Cloudflare (DNS, email and backups) and Vercel (website hosting).
• The platforms (Meta, LinkedIn and Google) receive the content we publish on them.
• Some providers may process data outside Brazil and the United Kingdom. These transfers follow the contractual safeguards offered by each provider, such as standard data protection clauses.

6. How long we keep data

• Platform access authorizations: while the official profile is connected; removed when it is disconnected.
• Post records and metrics: while they are useful to BRUK's editorial history, reviewed yearly.
• Backups: 7 days on the server and 30 days in the encrypted off-site copy.
• Contact emails: until the request is resolved and for any period the law requires.

7. Security

We use HTTPS, access restricted to a private network, credentials stored only on the server, encrypted backups and human approval before anything is published. No system is immune to failure; if an incident affects you, we will notify you as the law requires.

8. Your rights

You can ask us to confirm whether we process your data, and request access, correction, anonymization, restriction or erasure, portability, information about sharing, and object to processing (UK GDPR, Arts. 15 to 21; LGPD, Art. 18). Write to [email protected]. We will reply within one month (UK GDPR) or within 15 days (LGPD).

You can also complain to a data protection authority: in the United Kingdom, the ICO; in Brazil, the ANPD.

To remove data linked to our integrations, see also the Data deletion page.

9. Children

The website and BRUK's profiles are not directed at children, and we do not knowingly collect children's data.

10. Changes to this policy

When we change this policy, we will update the date at the top of the page. Significant changes will be highlighted on the website.

11. Contact and data protection officer

Privacy contact: [email protected].

Data protection officer (LGPD, Art. 41): as a small-scale processing agent, BRUK is exempt from appointing one (ANPD Resolution CD/ANPD No. 2/2022). The contact above serves data subjects and the authority.