Privacy Policy

Last updated: 3 November 2026

1. Who we are

1.1Brabo Group Ltd is the controller of personal data processed through Brabo, meaning the websites brabo.team and trialportal.org and the Brabo desktop and mobile apps.

1.2Brabo Group Ltd is a private company limited by shares, registered in England and Wales under company number 17558873, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom.

1.3You can contact us at owlbert@brabo.team. We have not appointed a Data Protection Officer.

1.4This policy is made under the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where it applies, the EU GDPR (together, "GDPR").

1.5Brabo is only for people aged 18 or over.

2. Data we process

2.1Account: email address, password (stored only as a one-way hash), Emerald Chat username and user ID, display name and profile picture.

2.2Staff profile: name, optional profile details and your second sign-in step (a passkey, authenticator app or phone number, stored encrypted or as a public key).

2.3Age and identity check: the result, your age in whole years, reference numbers, and the result codes our verification provider Didit returns. Your selfie, any identity document and your facial data are processed by Didit and are not stored by us.

2.4Verification history: a record of each identity check started, kept apart from your account. It holds the result, ages, Didit's result codes, any links to earlier checks, your Emerald Chat username and user ID, dates, one-way hashes of your email address, IP address and device identifier, when and why your account was deleted, and any administrator decision about the check.

2.5Training and use of Brabo: questionnaire and onboarding answers, including how long they took, how they were entered and your stated availability; messages, attachments and reactions; ban requests and evidence; reports and blocks; and staff notes and evaluations.

2.6Staff tools: team chat messages, saved messages, reminders, and presence and typing status.

2.7Technical data: IP address and the approximate location derived from it, browser and device information, a random device identifier, sign-in history and sessions, time online, app and version, push notification tokens and error reports.

2.8Payments: for Lantern purchases, a Stripe customer reference, what was bought and the payment or subscription status. We do not receive card or bank details.

2.9We get this data from you, from staff (who may add your Emerald Chat user ID) and from Didit (the results in clause 2.3).

3. Why we use it

3.1To run Brabo and the training programme, including accounts, sign-in, training, messaging, evaluation and support. Lawful basis: contract (Article 6(1)(b) GDPR) and our legitimate interest in running Brabo (Article 6(1)(f)).

3.2To check age and identity, so that only adults take part and people given moderation privileges are accountable. Lawful basis: our legitimate interest in the safety and integrity of the programme (Article 6(1)(f)) and contract (Article 6(1)(b)).

3.3Biometric data is processed by Didit for the check, including comparing your face with earlier checks for Brabo to detect duplicate accounts. Lawful basis: your explicit consent, given on Didit's screen before the check (Article 9(2)(a)).

3.4To prevent fraud and abuse, including duplicate accounts and breaches of participation bans, and to keep Brabo secure. Lawful basis: our legitimate interest in preventing fraud and protecting Brabo (Article 6(1)(f)).

3.5To match recruits with trainers, using time zone, approximate location, availability, time online, declared conflicts of interest and trainer workload. Lawful basis: our legitimate interest in running the programme fairly (Article 6(1)(f)).

3.6To produce statistics on training outcomes, staff activity and app usage. Lawful basis: our legitimate interest in running and improving Brabo (Article 6(1)(f)).

3.7To send notifications by email, desktop and push, according to your settings. Lawful basis: contract (Article 6(1)(b)), or consent where the law requires it (Article 6(1)(a)).

3.8To take payments. Lawful basis: contract (Article 6(1)(b)) and our legal obligation to keep accounting records (Article 6(1)(c)).

3.9To meet legal obligations and deal with legal claims. Lawful basis: legal obligation (Article 6(1)(c)) and our legitimate interest in protecting our rights (Article 6(1)(f)).

3.10You can object at any time to any use based on our legitimate interests by emailing us.

4. Data you must provide

4.1Recruits must provide an email address, a password and their Emerald Chat username, and must complete the age and identity check. The check needs a camera, your consent to Didit's biometric processing and, in some cases, a government-issued identity document. Without these you cannot take part.

4.2Staff must provide a name and email address.

4.3Everything else is optional.

5. Automated decisions

5.1Didit decides the age and identity check automatically. It uses your estimated age, a liveness check and image quality and, where an identity document is needed, the document's validity, the match between your face and the document, and the date of birth. Didit also declines checks that match its blocklist.

5.2If you fail the check, you cannot take part.

5.3You can ask for a person to review the result, give your view and contest it by emailing owlbert@brabo.team.

5.4Automated checks may flag an account for an administrator to review. A person always decides whether to refuse, close or end an account, and staff always decide training outcomes.

6. Who we share it with

6.1Didit (Didit Identity Spain, S.L., Spain): processor for the age and identity check and its blocklist. It receives the check data directly from you and, from us, a reference number, your recruit number, your Emerald Chat username and user ID and, where we hold it, your email address.

6.2Heroku (Salesforce, Inc., United States, EU region): processor for hosting, database and realtime messaging.

6.3Cloudflare (Cloudflare, Inc., United States): processor for network traffic, attack protection and content delivery.

6.4Bunny (BunnyWay d.o.o., Slovenia): processor for file storage in the EU and traffic to trialportal.org.

6.5Sentry (Functional Software, Inc., United States, EU region): processor for error reports.

6.6Purelymail (United States): processor for email delivery.

6.7Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): push notifications in the mobile app.

6.8Prelude (prelude.so): processor for text message sign-in codes, for staff who choose them.

6.9Klipy (klipy.com): GIF search. It receives search terms, but not your IP address or account.

6.10Stripe (Stripe, Inc. and Stripe Technology Europe, Limited): independent controller and seller for Lantern purchases.

6.11Emerald Chat (Connected Software Inc., United States): independent controller. It receives your training outcome, and its authorised staff can see verification records held by Didit.

6.12YouTube, Vimeo and Google Fonts receive your IP address when you play an embedded video or open one of our emails.

6.13Authorities, courts and others, where the law requires it or to protect rights, safety or security, as set out in our Law Enforcement Policy.

6.14We do not sell personal data or use it for advertising.

7. International transfers

7.1Heroku, Cloudflare, Sentry, Purelymail, Google, Apple, Prelude, Klipy and Emerald Chat may process personal data outside the UK and the EEA.

7.2These transfers rely on an adequacy decision (including the EU-U.S. Data Privacy Framework and its UK Extension), the EU Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement.

7.3Verification data stays in the European Union.

7.4You can ask for a copy of the safeguards at owlbert@brabo.team.

8. How long we keep it

8.1Recruits: an account is archived 24 hours after a pass or 5 days after a fail. Archiving removes the email address, password, profile picture, time zone, sessions and devices. The archive is deleted 12 months after training ends.

8.2Applicants: deleted 7 days after sign-up if the identity check isn't completed, 3 days after being disqualified by the questionnaire, or within 24 hours of an identity document showing they are under 18.

8.3Unfinished training: a training still open after 6 months is deleted. Only the Emerald Chat user ID, the trainer and the dates are kept, for 12 months.

8.4Deleted accounts: removed immediately. Staff messages remain, shown as "Deleted account". The audit log entry and the records in clauses 8.5 to 8.7 are kept for their own periods.

8.5Verification history (clause 2.4): for as long as we run the training programme, including for applicants found to be under 18, and reviewed at least once a year.

8.6Data held by Didit: selfies until your age is estimated; identity documents and facial data for 30 days; face templates for as long as clause 8.5; blocklist entries for as long as needed to prevent abuse.

8.7Participation bans: until lifted, reviewed at least once a year.

8.8Logs: application and email logs for 30 days, approximate location for 60 days, staff sign-in alerts and error reports for 90 days, time online for 35 days, app and version usage for 180 days, sign-in history, sessions and trainer matching records for 1 year, and the audit log for 2 years.

8.9Statistics: training statistics name the recruit and trainer for 30 days and are then kept without identifiers. Staff activity totals are deleted with the staff account.

8.10Payments: 10 years, as accounting law requires.

8.11Backups: 7 days.

9. Your rights

9.1Under the GDPR, you can ask to access, correct or erase your personal data, to restrict or object to its use, and to receive it in a portable format.

9.2You can withdraw consent at any time. This does not affect processing before you withdrew it.

9.3You have the right not to be subject to a decision based solely on automated processing (see section 5).

9.4To use any of these rights, email owlbert@brabo.team. We reply within one month, which the law allows us to extend in some cases. We can also ask Didit to delete the data it holds about you.

9.5You can complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, to the data protection authority where you live or work.

10. Cookies and device storage

10.1We use only strictly necessary cookies and storage: access_token, session_hint and console_token (sign-in, up to 30 days), device_id (device identifier, up to 400 days) and lantern_theme (chosen colour theme, 1 year), plus local storage for interface preferences.

10.2The mobile app keeps its sign-in token, device identifier and preferences in the device's secure storage.

11. Changes

11.1When this policy changes, we update the date at the top. We tell you about material changes.