Privacy, plainly.

01Who we are

brainfogagency.com is operated by [Legal entity name] (“Brainfog”, “we”, “us”), registered at [Registered address] (company number [Company registration number]). We are the controller of the personal data described in this policy.

Questions about this policy or your data: hello@brainfogagency.com.

02What this policy covers

This policy covers this website and its contact form. Products built by the studio (such as BoardRoom, Data Room, or Kammo) have their own privacy notices, which apply when you use them.

03What we collect

When you send a message

• Your name and email address.
• Your company name, if you give one.
• The door you picked (topic) and the message itself.
• A reference number and timestamps we generate for the submission.

When you visit any page

• Our hosting provider receives standard request data — IP address, browser user agent, the page requested, and the time — and may keep it in server logs.
• When you use the contact form, your IP address is held in server memory for up to 10 minutes to limit abuse. It is not stored with your message.
• Visit statistics, without cookies. We record which page was viewed, the referring website, browser, operating system and device type, and your country when our hosting network provides it. To count unique visitors we store a one-way hash of your IP address and browser, salted with a secret that changes every day — it can't be reversed, and the same visitor can't be linked from one day to the next. Your IP address itself is not stored.

What we don't do: no third-party analytics, no advertising pixels, no tracking cookies, no profiling, and no following you across sites or days. See the Cookie Policy.

04How we use it, and why

• To reply to you and handle what you asked for — legitimate interests, or steps you asked us to take before entering a contract.
• To keep a record of conversations with the studio — legitimate interests.
• To keep the site secure — rate limiting, spam filtering, and investigating abuse — legitimate interests.
• To understand how the site is used — which pages are useful and where visitors come from, as aggregate statistics only — legitimate interests.
• To meet legal obligations where they apply.

We don't use your details for marketing unless you ask us to, and we never sell them.

05Who we share it with

Only with service providers that help run the site, under contracts that limit their use of the data:

• Hosting — [Hosting provider].
• Database storage — hosted in [Database hosting region].
• Email delivery for contact notifications — Resend (resend.com).

The site's typefaces are served from our own domain, so loading a page sends nothing to font providers or other third parties.

We may also disclose data if the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition (in which case this policy continues to apply). We do not sell or “share” personal data for cross-context behavioural advertising.

06International transfers

The studio works across the USA, India, the UAE, and Indonesia, so your message may be read and processed in any of those countries, and by providers in others. Where the law requires it (for example, for data from the EU, UK, or under the UAE PDPL), we use recognised safeguards such as standard contractual clauses.

07How long we keep it

• Contact submissions: [24 months] after our last exchange, then deleted — sooner if you ask.
• Server logs: [30 days].
• Rate-limiting data: held in memory only, cleared within 10 minutes.
• Visit statistics: raw records for 13 months, then deleted automatically.

08Security

Data travels over HTTPS, access to submissions is limited to the people who need it to reply, and every message is checked for automated abuse before it is stored. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities as the law requires.

09Your rights

Depending on where you live, you can ask us to access, correct, delete, or export your data, to restrict or object to how we use it, and to withdraw consent where we relied on it. Email hello@brainfogagency.com — we will answer within the time the law sets, and won't treat you differently for asking.

• EU / UK (GDPR, UK GDPR): you may also complain to your local data protection authority.
• California (CCPA / CPRA): rights to know, delete, and correct. We do not sell or share personal information, and do not use sensitive personal information.
• India (Digital Personal Data Protection Act, 2023): rights to access, correction, erasure, grievance redressal, and to nominate someone to act for you. Grievance Officer: [Grievance Officer name], reachable at hello@brainfogagency.com.
• UAE (Federal Decree-Law No. 45 of 2021, PDPL): rights to access, correction, erasure, restriction, and objection.
• Indonesia (Law No. 27 of 2022, PDP Law): rights to access, correct, delete, and withdraw consent for processing of your personal data.

10Children

This site is for businesses and professionals. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has sent us their details, email hello@brainfogagency.com and we will delete them.

11Changes to this policy

If we change how we handle personal data, we will update this page and the “Last updated” date above. Significant changes will be highlighted here before they take effect.

12Contact

[Legal entity name], [Registered address]. Email hello@brainfogagency.com, or use the contact page.