Privacy Policy.

Controller

Rebrained društvo za posredovanje, promet i usluge d.o.o.
Legal form: društvo sa ograničenom odgovornošću (d.o.o., limited liability company)
Hakije Kulenovića 10
71000 Sarajevo, Bosnia and Herzegovina

Email: support@rebrained.app

Data protection officer

No Data Protection Officer appointed. One is not required under Art. 37 GDPR for this organisation.

What a Rebrained Account is

A Rebrained Account is the single sign-in for the Rebrained Stack. You create one account at account.rebrained.app, and it opens every product your plan includes, so there is no separate signup per tool. Creating an account also creates a workspace, which is where your plan, your team and your product data live.

Signing in with Google

You can create or access your Rebrained Account either with an email address and a password, or with Sign in with Google. If you choose Google, we ask Google for two things only, your email address and basic profile information (name and profile picture). We never receive your Google password, and we ask for no access to Gmail, Drive, Calendar, Contacts or any other Google service.

What comes back from Google is used for one purpose: to create your Rebrained Account and to recognise you when you sign in again. It is stored with the rest of your account data as described below, it is never sold, never used for advertising and never shared with anyone beyond the providers listed further down. You can withdraw our access at any time in your Google Account under Third-party apps and services, and you can ask us to delete the account itself by writing to support@rebrained.app.

What we process

Account data. When you create a Rebrained Account, Supabase Auth stores your email address and a cryptographic hash of your password. We never store or see your password in plain text. If you sign in with Google, basic profile information from your Google account (email, name) is processed the same way.

Profile data. An optional display name and profile picture, which exist only so that people you work with can recognise you. Both are optional and can be cleared at any time. A picture you upload is served from a content delivery network so pages load quickly, which means its image address can be opened by anyone who has that address, so please do not upload an image you would not want seen.

Workspace data. Your workspace name and, for each team member, their email address and role within the workspace.

Billing data. If billing is configured on your plan, upgrading is handled entirely by our payment provider (Stripe or Paddle). Your card details are entered directly into the provider's own checkout and billing portal and never pass through or touch our servers. We store only the resulting customer reference and subscription status (plan, active or canceled, renewal date) needed to grant product access, and a record of each payment, refund or chargeback so that money moved through your account is auditable.

Requests you send us. If you write to us, or ask for access to a plan that is not self-serve, we keep the email address the request came from and whatever you chose to write in it, so that we can answer you.

Technical data. Our hosting provider processes the ordinary technical details of every request (your IP address, your browser's user agent, the page you asked for) in order to deliver the page and keep the service available. We ourselves use your IP address for one purpose: to count recent attempts at sensitive actions such as signing in or requesting a password reset, so automated abuse can be slowed down. Those counts live in memory for minutes at a time and are never written to a database or attached to your account.

Usage measurement. This website measures how the site is used with Vercel Web Analytics, the measurement feature of the provider that already hosts the site. It is cookieless, it is served from our own domain rather than by an outside tracker, and what it produces is aggregate: how often pages were viewed, and how often a short list of named links was clicked (which plan people open, for instance). We receive no identifier for you in it, we cannot single you out in it, and it is never used to profile you, to target advertising, or to follow you onto other websites. It is not switched on yet, so at the time of writing nothing is being collected at all. This paragraph describes what happens once it is enabled, so that you are told beforehand rather than afterwards. The Rebrained Account itself runs no measurement of any kind.

No advertising, no profiling. We run no advertising, no behavioural tracking and no third-party trackers or pixels, and we do not sell personal data.

Who else processes your data

We use a small number of providers, each acting on our instructions and only for the purpose named:

Supabase stores accounts, workspaces and uploaded profile pictures. Vercel hosts our websites and provides the usage measurement described above. Resend delivers the email we send you, such as sign-in links, workspace invitations and password resets. Stripe and Paddle handle payment, whichever of them is configured.

Products you use inside the Rebrained Stack may process the content you put into them, which their own terms and this policy cover together. Where a product needs a credential of yours to work on your behalf, it is stored for that product alone and is not shared with the others.

Cookies

We use a single session cookie, set by Supabase Auth, to keep you signed in. In production it is scoped to .rebrained.app so that signing in once works across every Rebrained Stack product you are licensed for. In local development it is scoped only to the developer's own machine. This cookie is strictly necessary for the service to function and carries no advertising or tracking purpose.

That cookie is the only one we set. The usage measurement described above is cookieless, so no consent banner is needed and none is shown: we do not ask you to agree to tracking, because there is no tracking to agree to.

Where your data is stored

All account and workspace data, and any profile picture you upload, is stored in Supabase, hosted in the EU (eu-central-1, the Frankfurt region). Our websites and the code that serves them run on Vercel, which handles requests from its own network of locations.

Your rights

Under the GDPR you have the right to access, rectify or erase your personal data, to restrict or object to its processing, to data portability, and, where processing is based on consent, to withdraw that consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise any of these rights, contact us at support@rebrained.app.

Changes to this policy

We may update this policy as the product changes. Material changes will be reflected here with an updated effective date.