Privacy Policy

Last updated: July 2, 2026

1. Introduction and data controller

This Privacy Policy explains how Valensa Consulting LLC ("we", "us") collects, uses and protects your personal data when you use our SaaS services, accessible at bravorank.com. We are a B2B business in the technology sector and are committed to protecting the privacy of our clients in accordance with the EU General Data Protection Regulation (GDPR) and applicable data protection law.

Data controller: Valensa Consulting LLC, 407 Lincoln Road, Suite 12N, Miami Beach, FL 33139, United States. Our operations are carried out from within the European Union (Portugal), so processing of personal data is governed by the GDPR. For any data protection enquiry, contact info@valensaconsulting.com or +34 666 416 516.

2. Definitions

"Personal data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on personal data. "Controller" means the entity that determines the purposes and means of processing. "Processor" means a party that processes data on the controller's behalf. "Data subject" means the individual to whom the data relates. These terms have the meaning given in Article 4 GDPR.

3. Data we collect

We collect: personal identifiers (such as name, business name and address); contact information (email, phone, WhatsApp); payment information (billing details processed via our payment provider); and connection data (IP address and server logs). If you consent to advertising cookies, we also process advertising measurement data (the ad you arrived from and the key pages you visited), as detailed in our Cookie Policy. We do not collect special categories of data or data concerning minors.

If you request a free analysis of your business without being a client yet, we process the public data of your Google listing (name, address, rating and review count) to produce the report, and the email and phone you give us to send it to you and contact you with our commercial offer. You may object to these communications at any time by writing to us or using the unsubscribe link in each email.

Where our service manages your Google Business Profile, we also process the content of customer reviews associated with your listing, which may contain the names of the reviewers.

4. Purposes of processing

We process personal data to: (a) provide, operate and maintain our services; (b) perform our contract with you (account management, billing, subscription); (c) comply with legal obligations (e.g. accounting and tax); (d) improve our services; (e) ensure security and prevent fraud; (f) communicate with you regarding your account and service (transactional communications); and (g) send you your free report and our commercial offer if you requested it, and measure the effectiveness of our advertising where you have consented to the relevant cookies.

5. Legal basis for processing (Art. 6 GDPR)

We rely on: performance of a contract (Art. 6(1)(b)) to provide the service and manage your subscription; legal obligation (Art. 6(1)(c)) for accounting and tax retention; legitimate interests (Art. 6(1)(f)) for security, fraud prevention and improving our services; and, where applicable, your consent (Art. 6(1)(a)).

6. Recipients of the data

Your personal data may be shared with external service providers (processors) who assist us in delivering the service, with public authorities where legally required, and with third parties in the event of a merger or acquisition. All processors are contractually bound to process data securely and only on our instructions.

6.1 Sub-processors

We use the following processors. Where personal data is transferred outside the European Economic Area (e.g. to the United States), the transfer is based on the EU Standard Contractual Clauses (SCCs):

• Stripe — payment processing (Stripe Payments Europe / Stripe, Inc., USA). Transfer to the USA under SCCs.
• OpenAI — AI-assisted generation of content and replies (OpenAI, L.L.C., USA). Data submitted through the API is not used for training. Transfer to the USA under SCCs.
• Google — connection and management of your Google Business Profile, where you connect it (Google LLC, USA). Transfer to the USA under SCCs.
• Resend — sending of transactional emails (Resend, Inc., USA). Transfer to the USA under SCCs.
• Clouding — hosting (Calle Montserrat Roig 42, 08908 L'Hospitalet de Llobregat, Barcelona, Spain; within the EEA).

6.2 Google API data (Limited Use)

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We access your Google Business Profile only to provide the service you sign up for — managing your listing, posts, reviews and replies. We do not sell this data, do not use it for advertising or to train general-purpose AI models, and do not allow humans to read it unless you authorise it, it is necessary for security, or the law requires it.

7. Retention period

We retain personal data for as long as necessary to provide the service and for a maximum of 3 years after your last use, except where a longer retention period is required by law (for example, invoicing and tax records, which are kept for the legally mandated periods).

8. Your rights

Under the GDPR you have the right to: access your data; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing; and not to be subject to solely automated decisions. To exercise any of these rights, contact info@valensaconsulting.com. You may request deletion of your account and personal data by email; requests are processed within 30 days.

Right to lodge a complaint: you may lodge a complaint with the lead supervisory authority, the Portuguese Comissão Nacional de Proteção de Dados (CNPD), or with your local data protection authority.

9. Data security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls and ongoing review. All data transmission and payment processing is encrypted.

10. International data transfers

Where data is transferred outside the EEA, we ensure an adequate level of protection through EU Standard Contractual Clauses (SCCs), European Commission adequacy decisions, or other appropriate safeguards. This applies to our processors located in the United States (see section 6.1).

11. Cookies and similar technologies

We use strictly necessary local storage (localStorage) to keep your session signed in, remember your language preference and store your cookie decision, which does not require consent. In addition, if you give us your consent, we use the Meta pixel (_fbp and _fbc cookies) to measure which Instagram or Facebook ads bring visits to our site, and Google Analytics 4 (_ga cookies) to know how many distinct people visit us and what path they follow. These advertising and measurement cookies are not set until you accept them, you can refuse them without losing any functionality, and you can change your decision at any time. Full detail in our Cookie Policy.

12. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The current version is always available on this page.

13. Contact

Valensa Consulting LLC — info@valensaconsulting.com. Lead supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Portugal.