Legal — pilot draft

Privacy Policy (draft)

An unapproved pilot draft recording the adopted privacy subject matter. TorosRicos OÜ (Estonian registry code 16767169) is the proposed operator of Bobby Brand, subject to verification; no controller has been determined. No contact address or supervisory-authority route is stated, because no verified values have been configured.

Draft — legal review and Platform Owner approval required

Current pilot data boundary

The platform foundation is active for P2A verification: accounts, profiles, role tables, workspace authority foundations and audit/security records exist. Customer brand generation, checkout, billing, crawling, uploads, AI generation and analytics integrations are not operational.

1. Intended scope

Once operational, Bobby Brand will process account data, workspace and team data, brand-project content, uploaded brand materials, authorised website-analysis results, AI-usage and credit records, billing records and audit history.

2. Brand materials and website analysis

Uploaded logos, documents and analysed public web pages are processed to produce brand analysis and proposals. Only what is needed for analysis, provenance and approved output is retained. Crawl records are stored separately from approved brand rules, with the source of every observation recorded.

3. AI processing

Brand generation uses AI providers. Records of provider, model, operation, usage, cost and result are retained for accounting, audit and reproducibility. Provider configuration and data-use descriptions will be published per integration before that integration is enabled.

4. Access and isolation

Workspace data is isolated from every other workspace. Access is deny-by-default and governed by workspace roles. Customer brand assets are private by default and served only through authorised or signed delivery.

5. Audit records

Sensitive actions are recorded with actor, time and context so that approvals, publications and credit movements can be reconstructed. Secrets are never written to audit payloads or logs.

6. Retention

Retention periods for crawl data, generated proposals, exports and audit history will be defined and published before the corresponding features are enabled. No retention claim is made here.

7. Your rights

Applicable data-protection rights, the controller identity and the contact route for exercising them will be stated once verified operator details are configured and the document has been legally reviewed and approved.