Ibrave

    Privacy Policy

    Last updated: October 20, 2026

    Ibrave Technologies ("we", "us", "our") respects your privacy and takes the protection of your personal data seriously. This Privacy Policy explains, in plain language, what information we collect when you use https://ibrave.co, why we collect it, how we use it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws including the UK GDPR.

    1. Data controller

    The data controller is Ibrave Software Engineering, the registered entity that trades as Ibrave Technologies, at Zewdu Gessesse Building, Qelebet Menged, Bole Sub-City W-03 K-03 H-2414, Addis Ababa, Ethiopia. You can reach us about any privacy matter, including to exercise your rights, at hello@ibrave.co.

    2. Information we collect

    2.1 Information you give us

    • Contact form submissions: name, email, optional company and phone, the service you are interested in, and the contents of your message. We do not store these in a database: each submission is delivered to our team by email through a transactional email provider. To keep the form from being abused, the endpoint screens each submission with a hidden field that only automated clients fill in, and counts recent submissions against a one-way hash of the sending IP address, which is held in memory for ten minutes and never written to disk.

    2.2 Information collected automatically

    • Technical data: IP address, browser type, device type, referring page, and pages viewed. Our hosting provider writes this to server logs so the site stays available, secure, and fast. It is not used to build behavioural profiles, and we do not combine it with anything you send us through the contact form.
    • Approximate location: when you open the site at its root address, our hosting provider's edge network reads the country your request comes from, derived from your IP address, so we can show you the site in a matching language. We use the country and nothing more precise, and the only thing we keep is the language preference described in section 5.
    • Cookies and local storage: see section 5 below, which lists every item we store on your device. Nothing we store is used for analytics, advertising, or tracking.

    3. Why we use your information (purposes & legal bases)

    Under the GDPR, every use of personal data needs a legal basis. The bases we rely on are:

    • Performance of a contract (Art. 6(1)(b)): when you are a client and we need your data to deliver work.
    • Legitimate interests (Art. 6(1)(f)): to respond to enquiries you send us, to operate, maintain, and secure the site, and to prevent fraud or abuse. We balance these interests against your rights and freedoms; you can object at any time (see section 7).
    • Consent (Art. 6(1)(a)): for any analytics or marketing technology, none of which we currently use. Consent is freely given, specific, informed, and can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
    • Legal obligation (Art. 6(1)(c)): when we have to retain or disclose information to comply with the law.

    4. Sharing your information

    We do not sell your personal information and we do not share it for cross-context behavioural advertising. We share it only with:

    • Service providers (processors) who help us run the site. These are Vercel Inc. (United States), which hosts the site and runs the endpoint behind our contact form, and Resend (United States), which delivers contact form submissions to our inbox. We also use Cloudflare (United States) to serve the public case study content on our portfolio pages, which involves no personal data. Each processor is bound by a written contract that requires them to process your data only on our documented instructions and to keep it confidential and secure. For client engagements involving personal data, we offer an Article 28 GDPR Data Processing Agreement on request.
    • Authorities, when we are legally required to disclose information (for example to comply with a valid court order).
    • Successors, in the event of a merger, acquisition, or sale of assets, in which case we will give you notice before your information becomes subject to a different policy.

    5. Cookies and local storage

    We store very little on your device, and the list below is complete. We group these technologies into three categories:

    • Essential technologies are required for the site to work, so the ePrivacy Directive does not require consent for them. We use exactly two: a cookie named ibrave.locale, which remembers which language you are reading the site in and expires after 12 months, and an entry named ibrave.cookieConsent.v1 in your browser's local storage, which remembers your answer to the cookie banner so that we do not ask again on every page.
    • Analytics technologies would show us how the site is used so we could improve it. They are not set unless you explicitly opt in.
    • Marketing technologies would measure campaigns. They are not set unless you explicitly opt in.

    To be precise about what that means today: we run no analytics and no marketing technology at all. There is no Google Analytics, no advertising or remarketing pixel, no session recording, and no third-party embed anywhere on this site. The two categories above exist so that if we ever add such a tool, it stays switched off until you turn it on.

    You can change or withdraw your consent at any time by clicking or using the link of the same name in the footer. Refusing or withdrawing consent does not restrict any part of this site. Your choice is recorded in your own browser, so clearing your browser storage resets it.

    6. International transfers

    We operate from a single office in Addis Ababa, Ethiopia, and we use cloud providers that may store and process data outside the European Economic Area (EEA) or the United Kingdom. When personal data is transferred outside the EEA/UK to a country that has not received an adequacy decision, we rely on appropriate safeguards, primarily the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with additional technical and organisational measures where required. A copy of the relevant safeguards is available on request from hello@ibrave.co.

    7. Your rights

    If you are in the European Economic Area, the United Kingdom, Switzerland, or a country with similar laws, you have the right to:

    • access the personal data we hold about you;
    • have inaccurate data corrected;
    • have your data erased ("the right to be forgotten");
    • restrict or object to our processing;
    • receive your data in a portable format;
    • withdraw consent at any time, where we rely on consent (this does not affect the lawfulness of prior processing); and
    • lodge a complaint with your local data protection authority. If you are in the EU you can find your authority here.

    To exercise any of these rights, email hello@ibrave.co. We will respond within one month, as required by the GDPR (this period may be extended by up to two further months for complex requests, in which case we will inform you).

    8. Data retention

    We keep personal data only for as long as we need it for the purpose it was collected:

    • Contact form submissions: we do not store these in a database. Each submission is validated and delivered straight to our inbox, so what is retained is the email itself: typically up to 24 months from the last interaction, then deleted.
    • Technical logs: held by our hosting provider for a short period, typically 30 to 90 days, for security and debugging.
    • Your cookie choice: stored in your own browser rather than on our servers. It stays until you change it or clear your browser storage.

    9. Security

    We use industry-standard technical and organisational measures, including encrypted transport (HTTPS/TLS), access controls, principle of least privilege, audit logging, and managed cloud infrastructure, to protect your information. No system is perfectly secure; if we ever become aware of a personal data breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours, and notify you without undue delay where required by law.

    10. Automated decision-making

    We do not use your personal data to make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

    11. Children

    The site is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

    12. Links to other websites

    This site links out to a small number of third-party platforms, including our LinkedIn and GitHub profiles. We do not control how those platforms handle your data, and this policy does not apply to them. If you follow one of those links, we encourage you to read that provider's own privacy policy. We do not embed third-party content that would load before you click.

    13. Changes to this policy

    We may update this policy from time to time. Material changes will be highlighted on this page with an updated "Last updated" date. We will not weaken your rights without your explicit consent.

    14. Contact

    Questions about this policy, requests to exercise your rights, or other privacy matters? Email us at hello@ibrave.co or write to Zewdu Gessesse Building, Qelebet Menged, Bole Sub-City W-03 K-03 H-2414, Addis Ababa, Ethiopia.