Privacy, in plain words.

01Who is responsible for your data

The controller is Brainstead, the operator of brainstead.si, based in Switzerland. For anything about your data, write to privacy@brainstead.si.

The operator's name and postal address are available on request at that address where genuinely needed, for example for formal legal correspondence.

02What we collect, and why

• Demo requests. When you send the demo form, we receive your work email and, if you fill them in, your name, your agency, how many client brands you run, what you're interested in and your message, plus your tick in the consent box. We use it only to reply to your request. It's filed as a ticket on our own request board, which only the Brainstead team reads.
• The human check on the form. The home page, where the form is, loads Cloudflare Turnstile, which checks that a person and not a bot is sending it. For that check Cloudflare receives your IP address and details about your browser.
• Abuse protection. To stop the form being flooded, our server remembers the IP addresses that sent it for 10 minutes, in memory only, and refuses more than five requests from one address in that time. They aren't written to disk.
• Visit counts. We count page views and sent demo requests with Umami, which we run on our own servers. It sets no cookies, stores nothing in your browser and doesn't keep your IP address: it uses the address to work out roughly where you are (country, region and city) and, turned into a one-way code that changes regularly, to tell one visit from another. It records the page, the site that sent you, your browser, operating system, device type, screen size and language. Because it leaves nothing on your device, it runs whatever you choose in the cookie banner.
• Google Analytics, in Google's consent mode. What it receives depends on your choice in the cookie banner; see section 3.
• Fonts. The pages load their fonts from Google Fonts, so your browser sends your IP address to Google when a page opens. Google Fonts sets no cookies.
• Server request logs. Like almost every website, our servers log each request: the time, your IP address, the page asked for, the page you came from and your browser's identifier, to keep the site running and secure.

We don't use advertising networks or tracking pixels, and the site has no accounts or sign-in.

03Cookies and your choice

We use Google Analytics to understand how the site is used. Its script loads on every page, but until you accept it in the cookie banner it sets no cookies and can't recognise you from one visit to the next: it sends Google only a cookieless signal that a page was viewed, with details about your browser and, like any request, your IP address.

If you accept, Google Analytics also sets cookies (named _ga and _ga_…, which last up to two years) and sends Google the pages you view, details about your browser and device, and your IP address. Advertising features stay switched off whatever you choose.

Your choice is kept in your browser's local storage, not in a cookie, under the name analytics-consent. You can change it at any time. If you withdraw it, the Google Analytics cookies are deleted.

04Why we're allowed to (legal bases)

We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies to visitors in the EU or EEA, the EU General Data Protection Regulation (GDPR). Under the GDPR we rely on:

• Your consent: for your demo request, which you give with the tick box, and for Google Analytics cookies, which you give in the cookie banner. You can withdraw either at any time; that doesn't affect what we did before.
• Steps you ask for before a possible contract: replying to your demo request and arranging the demo.
• Our legitimate interests: keeping the site secure and the form free of abuse (Turnstile, the rate limit, server logs), cookie-free visit counts, the cookieless Google Analytics signal, and showing the site in its fonts.

05Who else sees it

We don't sell, rent or trade your data, and we don't share it for advertising. Apart from the Brainstead team, your data reaches only:

• Our hosting provider, which runs the servers but doesn't use the data for itself.
• Cloudflare, for the Turnstile check, under Cloudflare's privacy policy.
• Google, for Google Analytics and Google Fonts, under Google's privacy policy.
• Authorities, only where the law requires us to.

06Where your data lives

The website, the form's server, our request board (where demo requests are filed) and our visit counter all run on a server we rent from Hetzner in its data centre in Helsinki, Finland. Encrypted nightly backups of that server are stored with Hetzner in Nuremberg, Germany. Pages are served only over encrypted HTTPS. The providers involved are:

Finland and Germany are in the EU, which Switzerland recognises as giving adequate protection for personal data. Transfers to the United States go to companies certified under the Swiss-U.S. Data Privacy Framework (Cloudflare, Inc. and Google LLC), which Switzerland recognises as adequate for certified companies.

07How long we keep it

• Demo requests: until we've dealt with your request and any conversation that follows from it, then we delete them. Ask us and we'll delete yours sooner.
• IP addresses for the rate limit: 10 minutes, in memory only.
• Server request logs: 30 days.
• Visit counts: kept as statistics until we delete them. Umami never stores your IP address.
• Google Analytics: Google keeps the detailed data for at most 14 months; its cookies last up to two years unless you withdraw your consent or clear them.
• Your cookie choice: in your browser until you change it or clear your browser's site data.
• Backups: our encrypted nightly backups hold copies of what is on our server, including demo requests and server logs, for at least 30 days.

08Your rights

Under the FADP and, where it applies, the GDPR, you have the right to:

• find out what personal data we hold about you and get a copy of it;
• have it corrected if it's wrong;
• have it deleted, or its use restricted;
• object to how we use it, including anything we do on the basis of our legitimate interests;
• receive data you gave us in a common, machine-readable format;
• withdraw your consent at any time: for Google Analytics with the cookie settings, for anything else by writing to us.

To use any of them, write to privacy@brainstead.si. We reply within 30 days. If you think we've handled your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch, or, if you live in the EU or EEA, to the data protection authority in your country.

09Children

brainstead.si is for agencies and the people who work at them. It isn't aimed at children, and we don't knowingly collect data from anyone under 16.

10Changes to this policy

If we change this policy, we'll post the new version on this page and update the date at the top.

Questions? See also our Terms and Conditions, or write to privacy@brainstead.si.