Privacy Policy

Last updated: 12 September 2026

This Privacy Policy explains how Bragaf (“we”, “us”) collects, uses and protects your information when you use our website (bragaf.com) and the Bragaf web application (www.bragaf.com).

This document is a good-faith summary of our practices. It is a template that should be reviewed by a legal professional and adapted to the laws that apply to you before commercial launch.

1. Information we collect

Waitlist & contact: your email address, and optionally your name and institution, together with your consent, a timestamp and the sign-up source, when you join our waitlist. Any content you send us by email.
Your diffraction data: the Bragaf app parses and plots your files in your browser. When you use server-side analyses (peak fitting, background subtraction, unit-cell or Rietveld refinement), the numeric pattern and any CIF / instrument file you attach are sent to our server to compute the result and returned to you. We do not store this data; temporary working files are automatically deleted.
Technical data: standard server logs and your IP address, used for security and rate-limiting.
Audience analytics: we count visits with Cloudflare Web Analytics, which uses no cookies and does not identify you. On our public website we also use Google Analytics to understand how visitors use the site (pages viewed, approximate location, device and browser). Google Analytics loads only after you consent via our cookie banner.
Advertising: on our public website we display ads served by Google AdSense. These load only after you consent via our cookie banner. When enabled, Google may set cookies and process your IP address and ad interactions to serve and measure ads. You can withdraw consent at any time (see “Cookies” below).

Analytics and advertising cookies are only set after you have given consent, and never on the Bragaf app itself.

2. How we use your information

To operate and provide the service (including running the analyses you request).
To email you about the launch and product updates — only if you gave consent (you can unsubscribe anytime).
To respond to your support requests.
To keep the service secure and prevent abuse.

3. Legal bases (GDPR)

We rely on your consent (marketing emails, analytics and advertising cookies), legitimate interests (operating and securing the service), and performance of a contract (delivering features you use).

4. Service providers (subprocessors)

We share the minimum necessary data with providers that help us run Bragaf:

Cloudflare — website hosting, CDN, network security and cookieless visit statistics (Web Analytics).
Google Cloud (Cloud Run) — backend compute for server-side analyses.
Hostinger — our email ([email protected]) and waitlist notifications.
Plotly — the plotting library is loaded in your browser from its CDN.
Google Analytics — audience measurement on our public website, only after you consent.
Google AdSense — serves advertising on our public website, only after you consent. Google may act as an independent controller for advertising data; see Google’s privacy policy for details.
Paddle — our payment provider for paid plans (once available). Paddle acts as Merchant of Record and processes payment details; we never see your full card data.

5. Cookies

We use essential/functional cookies (for example, security cookies set by Cloudflare), which do not require consent. On our public website we also use analytics cookies set by Google Analytics and advertising cookies set by Google AdSense — these are only placed after you accept them in our cookie banner. If you decline, no analytics or advertising cookies are set. You can change your choice at any time by clearing the bragaf-consent entry in your browser storage (or your site data for bragaf.com), which brings the banner back.

6. Data retention

We keep your waitlist details until you unsubscribe or ask us to delete them. Support correspondence is kept as long as needed to help you. Data sent for server-side analysis is processed transiently and not retained.

7. Your rights

Subject to applicable law, you can request access, correction, deletion, or a copy of your data, object to or restrict processing, and withdraw consent at any time. To exercise these rights, email [email protected]. You may also lodge a complaint with your local data protection authority.

8. International transfers

Our backend runs in the European Union (Google Cloud, Belgium region) and our CDN is global. Where data is transferred internationally, we rely on our providers’ safeguards.

9. Children

Bragaf is intended for researchers and is not directed at children under 16.

10. Changes

We may update this policy; the date at the top reflects the latest version.

Questions about this policy? Contact [email protected].

Privacy · Terms · Refunds