Privacy Policy

1. Data Controller

Company name: BRTH Kft. (BRTH Ltd.) Registered office: Szent István út 10/A, 2nd floor, door 210, Győr 9021, Hungary Tax number: 32582730-2-08 EU VAT ID: HU32582730 Company registry number: 08-09-36879 Email: info@brth.io

2. Personal Data Collected and Legal Bases

The Data Controller processes the following personal data:

• Registration data (last name, first name, email address): necessary for the performance of a contract – GDPR Article 6(1)(b)
• Profile data (specialty, AI knowledge level, personalization responses): consent – GDPR Article 6(1)(a)
• Usage data (completed courses, quiz results, ideas, bookmarks): necessary for the performance of a contract – GDPR Article 6(1)(b)
• Technical data (IP address, browser type, session identifier): legitimate interest of the Data Controller – GDPR Article 6(1)(f)

3. Data Processors

The following third-party data processors are engaged in operating the Service:

• Supabase Inc. — User authentication and database storage. The database operates within the European Union (Frankfurt, Germany).
• OpenAI, LLC (USA) — AI-powered content generation (news summaries, quizzes).
• Anthropic, PBC (USA) — AI-powered content generation.
• ActiveCampaign, LLC / Postmark (USA) — Transactional email delivery (registration confirmations, invitations).
• Google Ireland Limited (Ireland) / Google LLC (USA) — Google Analytics 4 web analytics and Google Ads conversion tracking. We use the Google Consent Mode v2 framework: marketing cookies (e.g. _gcl_aw, _gcl_au) are only activated with the user's prior consent. Without consent, Google receives anonymous, cookieless pings that contain no personal identifiers.
• Vercel Inc. (USA) — Web application hosting and content delivery (CDN). Vercel may process technical data (IP address, HTTP headers) when handling server-side requests.
• Meta Platforms Ireland Limited (Ireland) / Meta Platforms, Inc. (USA) — Meta Pixel for advertising conversion measurement and audience building. The Meta Pixel is only activated with the user's prior consent. Without consent, no data is transmitted to Meta.

Our AI service providers are contractually restricted from using user data for model training. For details on each provider's data practices, please refer to their respective privacy policies.

4. International Data Transfers

The database (Supabase) operates within the European Union. The AI providers (OpenAI, Anthropic), the email provider (Postmark), Google (Analytics, Ads), Meta (Pixel), and the hosting provider (Vercel) are headquartered in the United States. Google Ireland Limited and Meta Platforms Ireland Limited operate within the EU. EU–US data transfers are carried out on the basis of the EU–U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Data Retention

Personal data is retained for the duration of the user account or until the user requests deletion. Following account deletion, personal data will be permanently deleted within 30 days, unless a longer retention period is required by law.

6. Data Subject Rights

Under the GDPR, you are entitled to the following rights:

• Right of access: you may request information about what personal data we process about you.
• Right to rectification: you may request the correction of inaccurate data.
• Right to erasure ("right to be forgotten"): you may request the deletion of your personal data.
• Right to data portability: you may request your data in a machine-readable format.
• Right to object: you may object to the processing of your personal data.
• Right to withdraw consent: where processing is based on consent, you may withdraw your consent at any time.

To exercise your rights, please write to: info@brth.io

7. Cookies

The Service uses the following cookies:

• Authentication cookies (necessary): cookies required for maintaining the Supabase session (sb-* prefixed cookies). Login does not function without these.
• Language preference cookie (necessary): stores the user's language preference (locale). This ensures the application displays in the chosen language.
• Preloader cookie (functional): a cookie for controlling the loading animation (show-preloader).
• Google Ads cookies (marketing): cookies used for Google Ads conversion measurement (_gcl_aw, _gcl_au). These are only placed with the user's prior consent, in accordance with Article 6(1)(a) of the GDPR.
• Meta Pixel cookies (marketing): cookies used for Meta (Facebook) advertising conversion measurement and audience building (_fbp, _fbc). These are only placed with the user's prior consent, in accordance with Article 6(1)(a) of the GDPR.

Necessary and functional cookies do not require prior consent under the GDPR. Marketing cookies (Google Ads, Meta Pixel) are only activated with the user's consent, which can be given or declined via the cookie banner.

8. Supervisory Authority

If you believe that the processing of your personal data violates the provisions of the GDPR, you may file a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). National Authority for Data Protection and Freedom of Information Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary Website: www.naih.hu Email: ugyfelszolgalat@naih.hu

9. Contact

For questions regarding data protection, the Data Controller can be contacted at: BRTH Kft. (BRTH Ltd.) Szent István út 10/A, 2nd floor, door 210, Győr 9021, Hungary Email: info@brth.io