Privacy notice.

The controller is Tolaron s.r.o., IČO 300 03 547, Příčná 1892/4, 110 00 Praha 1, Czech Republic; registered at the Municipal Court in Prague, file C 455064. Bracemont is a venture of this company.

For data questions, correction, deletion or withdrawal of consent, write to privacy@bracemont.com. This notice covers the public website and incoming correspondence. Client assessment data will be covered by a separate agreement before testing.

• privacy@bracemont.com

We collect your email address, your chosen signup type and language, a submission identifier and the wording/version of your consent. The longer pilot form also lets you provide a company name, engineering-team size and regulatory exposure. Those extra fields are optional.

We use pilot requests to discuss fit and future availability, and research requests to send the occasional updates you asked for. These purposes have separate consent wording. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it by replying or writing to privacy@bracemont.com; withdrawal does not affect earlier lawful processing.

Submitting requires an email address and consent. It does not create an account, authorize a security test or subscribe you to unrelated marketing. Address ownership is confirmed before research mailings.

When signup delivery is enabled, the form sends your request through Resend to Tolaron’s Google Workspace inbox. The website does not keep a separate database of signups. Copies are held in the receiving mailbox and by delivery providers according to their service settings.

Resend, Google and the public website host Vercel process data for their respective delivery, mailbox and hosting functions. These providers may process data outside the European Economic Area, including in the United States. Their data-processing terms describe applicable transfer safeguards, including standard contractual clauses. You can ask us for information about the safeguards applicable to your data.

• Resend data-processing terms
• Google Workspace data-processing terms
• Vercel data-processing terms

The hosting provider processes request information, such as IP address, requested URL, browser details and time, to deliver and protect the website. We use a short-lived hash of an IP address for signup rate limiting, counted in ten-minute windows; expired entries are cleared on subsequent requests or when the server instance stops. The original address is not included in signup emails.

The public site does not add advertising trackers, analytics scripts or application cookies. Fonts are served by the website. The private console has separate authentication cookies and is not part of the public signup flow.

The legal basis for delivering the website and preventing abuse is our legitimate interest under Article 6(1)(f) GDPR. We make no solely automated decisions about you with legal or similarly significant effects.

We receive your address and whatever you include in your message. General enquiries, support, privacy and security addresses route to Tolaron’s Google Workspace inbox. Please include only information relevant to your request.

We use correspondence to respond, handle security reports and discuss possible work. Depending on the request, the basis is steps you ask us to take before a contract under Article 6(1)(b), or our legitimate interest in responding and protecting the service under Article 6(1)(f) GDPR.

Pilot-interest records are kept while we handle your request and the pilot waitlist remains active, unless you withdraw sooner. Research subscription records are kept until you unsubscribe or we end the mailing list. Correspondence is kept while needed to resolve the matter; contractual records may have separate legal retention requirements.

We may retain the minimum record needed to honor an opt-out or establish consent where necessary. Delivery and technical logs follow the relevant provider’s retention settings. Deletion requests cover mailbox copies and relevant provider records where applicable; they are handled by a person.

Subject to the conditions in data-protection law, you can request access, correction, erasure, restriction or a portable copy of your data. You can object to processing based on legitimate interests and withdraw consent at any time. Contact privacy@bracemont.com; we may need to verify your identity.

You can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) or the relevant supervisory authority where you live. We update this notice and its effective date when our processing changes.

• Czech Office for Personal Data Protection
• Your data-protection rights — European Commission