Privacy policy
Draft pending legal review. Bracara Photonics is being incorporated; until then, the person named in the legal notice is responsible for this website and Bracara Studio.
1. Who is responsible
This website and Bracara Studio are run by Bracara Photonics, a spinout of INL (International Iberian Nanotechnology Laboratory), which is being incorporated. Until the company exists, the controller of your personal data is Diogo Aguiam, Avenida Mestre José Veiga s/n, 4715-330 Braga, Portugal. Write to hello@bracara-photonics.com about anything in this policy.
2. This website
- Server logs: our hosting provider, Cloudflare, processes your IP address, the time, the page requested and your browser type to deliver the site and protect it from abuse.
- Analytics: only if you accept, we use Google Analytics to count visits and see which pages are read. It sets cookies and receives your IP address, device and browser details and the pages you visit. If you reject or do not choose, nothing is sent to Google. Details on the cookies page.
- Newsletter: if you subscribe, we receive your email address and your consent through Brevo, which sends a confirmation email first (double opt-in). Every newsletter has an unsubscribe link.
- Email: if you write to us, we receive your email address and what you send, and use it to reply.
3. Bracara Studio
To use Bracara Studio you need an account. We process the data you give us to create and run it, and the data you create in it.
- Account data: name, email address, organization if you give one, your plan, and how you use Bracara Studio (designs created, jobs run, exports, quote requests). Sign-in runs through Zitadel, in its EU region.
- Design data: your designs are stored on servers in Europe. User names and design file names are encrypted. Design contents are stored without encryption at rest.
- Product news: we add Bracara Studio users to our product newsletter, managed in Brevo together with your plan and sign-up date. You can opt out when you sign up, at any time in Bracara Studio, or through the link in every email. We only send news about Bracara Studio and our fabrication services.
- Payments: when paid plans or orders are paid online, Stripe processes the payment. We do not see or store full card details.
- Orders: if you order a device, we process the details needed to quote, fabricate, invoice and deliver it, and pass the technical details of the design to our fabrication partners. No client information is shared with them without your explicit request or consent.
4. AI design assistant
An assistant that sets up designs from a plain-language description is planned. Once it exists, the prompts you write will be sent to an outside AI provider to produce the answer. We will name the provider here before the assistant is switched on.
5. Why we process data, and on what basis
- To provide Bracara Studio and handle your orders: performance of a contract, or steps you ask for before one.
- To keep the website and Bracara Studio secure and working, and to count sign-ups and use: our legitimate interest.
- Website analytics and the website newsletter: your consent, which you can withdraw at any time.
- Product news to Bracara Studio users: the rule for existing customers in the ePrivacy Directive (article 13(2)) and Portuguese law (Lei 41/2004, article 13-A), with a way to refuse at sign-up and in every email.
6. Who receives your data
- Cloudflare: hosting and security of this website.
- Google: website analytics, only with your consent.
- Brevo (France): newsletter and contact management.
- Zitadel: sign-in to Bracara Studio, EU region.
- A European hosting provider that runs the Bracara Studio servers.
- Stripe: payments, once online payment is switched on.
- Our fabrication partners: the technical details of ordered devices only; client information only with your explicit request or consent.
- The AI provider named in section 4, once the assistant exists.
We do not sell personal data. Cloudflare, Google and Stripe may process data outside the European Economic Area; where they do, the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. How long we keep it
- Analytics data: 2 months in Google Analytics; analytics cookies expire after 13 months at most.
- Newsletter: until you unsubscribe.
- Account and design data: while your account is open; deleted after you close it, except what the law requires us to keep, such as invoices.
- Emails: as long as needed to handle your request.
8. Your rights
You can ask us for access to your data, to correct it, delete it, restrict or object to its use, or send it to you in a portable format, by writing to hello@bracara-photonics.com. You can withdraw consent at any time, including through Cookie settings at the bottom of any page. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).
9. Security
Access to Bracara Studio requires an account, designs are stored on servers in Europe, and names are encrypted as described above. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.
10. Changes
We will post changes here and, for material changes, tell Bracara Studio users by email.
Last updated: 30 October 2026 (draft).