legal
Privacy policy
- Who we are
- What we process, and why
- Who we share data with
- How long we keep it
- Your rights
- Changes to this policy
- Contact
Who we are
brandmarkdown (brandmarkdown.com) is operated by r352, run by Przemysław Reszka, Santa Catalina, Mallorca (Balearic Islands), Spain. We are the data controller for the personal data described here. For anything about your data, write to hello@r352.com.
Because we operate from Spain, the GDPR and the Spanish LOPDGDD apply.
What we process, and why
This is everything the site does with data today. If it is not listed, we do not do it.
Hosting and server logs
The site is hosted by Vercel Inc. (United States). Like any host, Vercel keeps technical request logs (for example IP address, time, address requested) for security and operation. Basis: our legitimate interest in keeping the site available and safe (Art. 6(1)(f) GDPR).
Aggregated analytics without cookies
We use Vercel Web Analytics and Vercel Speed Insights (scripts loaded from /_vercel/insights and /_vercel/speed-insights). They set no cookies and give us aggregated numbers: pages viewed, page speed, country level location and device type. We also record a few events that contain no personal data: which button or link was clicked and in which section of the page, whether an address was typed into a form (not the address itself), how far a page was scrolled, which sections were seen, and when a website import failed. Basis: our legitimate interest in understanding which pages and tools help (Art. 6(1)(f) GDPR).
Pilot programme
If you open brandmarkdown with a pilot link (for example /brand/?pilot=p003), the short pilot code is kept in your browser (localStorage key bmd.pilot). The code stands for the test link, not for a person; only we know which company got which code. While the code is set, the brand tool records a few extra events in Vercel Web Analytics, each with the pilot code and at most one more value from a fixed list: the pilot link was opened, a brand file was built, the file was downloaded (zip or md) or copied (whole file or short version), a guide for ChatGPT or Claude was opened, and the line about automatic updates was clicked. These events contain no brand name, file content, website address or other personal data.
After about a week we may send you a link to a survey with five questions (/pilot/ankieta/). The form does not ask for your name or email. When you press send, your browser sends only the multiple-choice answers and the pilot code to our server function /api/pilot, which writes them as one line to its log, without your IP address; your free-text answers are not sent there. Then your own mail app opens a ready email to hello@r352.com with all the answers. If you send it, we receive it like any email, with your email address. We use the answers and that email only to evaluate the pilot and to reply to you. Basis: our legitimate interest in testing whether the tool helps (Art. 6(1)(f) GDPR); you can object at any time by writing to hello@r352.com.
Google Analytics, only with your consent
On our marketing pages (home, /for/, /guides/, /examples/) we ask first. Nothing from Google loads and no cookie is set until you press OK. Google Analytics (measurement ID G-75RR53D9MF) then reports which pages are visited, with anonymised IP addresses. Your choice is kept in your browser (localStorage key bmd.consent) so we do not ask again; you can clear it in your browser settings. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Early access and waiting lists
If you join a list (early access, or a waiting list for a planned plan), we store your email address and a label of which list you joined, in Resend, the email service we use. We send you one email when the list opens or at launch. Every email has an unsubscribe link that works in one click. Basis: your consent (Art. 6(1)(a) GDPR).
The brand tool (/brand/)
The brand you build is saved only in your browser (localStorage). It is not sent to our servers and we cannot see it. It stays until you clear it, with the Reset button in the tool or in your browser settings.
Importing a website
When you type a website address to import, that address is sent to our server functions (/api/scan and /api/img). They fetch only the public page, its stylesheets and its images from that address, return colors, fonts and images to your browser. Nothing they keep is linked to you; the limits and the short cache are described below. Requests to public addresses only are allowed. The site you scan sees a request from our server, identified as brandmarkdown. Vercel's request logs may contain the address you entered, see the hosting section above.
To prevent abuse, /api/scan counts requests per IP address (an IPv6 address by its /64 network): at most 3 in 10 seconds and 10 in 10 minutes. The survey function /api/pilot allows 5 sends per IP address in 10 minutes. For these limits the address is held only in the memory of the function, never in a database or a file, and is removed at the first clean-up 10 minutes after your last request (the clean-up runs with incoming requests, at most once a minute) or when the function instance stops. A successful scan of a public page (the colors, fonts, images and texts read from it) may be kept in the memory of the function for 10 minutes and in Vercel's CDN cache for 24 hours; after that the CDN may still serve it for up to 7 more days while it refreshes in the background. It is stored by page address and browser language and contains no personal data about you.
Your own AI key (optional)
Some tools can use an AI model if you add your own key. The key is kept in your browser (localStorage) and is sent from your browser directly to the provider you pick (Anthropic, OpenAI, OpenRouter or an address you enter). It does not pass through our servers. The text you send is handled under that provider's terms and privacy policy.
Payments
Payments are switched off during the free beta, and we process no payment data. If we turn payments on, they will be handled by Stripe, and we will update this policy before that happens.
Who we share data with
We do not sell your data and we do not share it with advertising networks.
- Vercel Inc. (United States): hosting, request logs, Web Analytics and Speed Insights. Transfers to the United States rely on Standard Contractual Clauses.
- Resend: email delivery and the list of addresses, only if you join a list.
- Google Ireland Ltd. and Google LLC: Google Analytics, only if you accept the cookie banner.
- The AI provider you choose, only if you add your own key.
- Stripe: only once payments are switched on.
How long we keep it
- Email on a list: until you unsubscribe or ask us to delete it.
- Your brand and your cookie choice: in your browser, until you clear them. We do not hold them.
- Server logs and Vercel analytics data: according to Vercel's own retention policy.
- Google Analytics data: according to the retention setting in our Google Analytics account.
- Website addresses you import: not linked to you. The scan result of a public page: up to 10 minutes in function memory and 24 hours in the CDN cache, which may serve it for up to 7 more days while it refreshes.
- Your IP address for the limits of /api/scan and /api/pilot: only in function memory, removed at the first clean-up 10 minutes after your last request.
- Pilot code: in your browser, until you clear it. Pilot events: like the other Vercel analytics data above. Survey answers and survey emails: until the pilot is evaluated, at most 12 months.
Your rights
Under the GDPR and the Spanish LOPDGDD you can ask us for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing or withdraw consent at any time (without affecting what was lawful before). Write to hello@r352.com, ideally with the subject "brandmarkdown - privacy request", and we will answer within 30 days.
You can also complain to the Spanish supervisory authority, AEPD (Agencia Española de Protección de Datos): www.aepd.es.
Changes to this policy
We update this policy when the site or its tools change. The date at the top shows the latest revision. We will say so on the site before a material change, such as turning on payments, takes effect.
Contact
Email: hello@r352.com. More on Legal & contact.