Privacy Policy

1. Introduction

Bravexa Software (“Bravexa Software,” “we,” “us,” or “our”) operates Cottage HQ, a software-as-a-service platform that helps cottage food operators run their online storefront, manage orders, send email, and comply with the labeling requirements of their state’s cottage food law. This Privacy Policy explains how we collect, use, store, and share information when you use Cottage HQ at cottageheadquarters.com.

By using Cottage HQ, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Account Information (operators): When you sign up as a cottage food operator, we collect your name, email address, business name, business address, phone number, and authentication credentials.

Billing Information: Subscription payments are handled by Stripe. We do not store full card numbers on our servers — Stripe returns a token we use to recognize your subscription. We do store your billing email and subscription status.

Customer Data (data operators upload): Operators enter information about their own customers into Cottage HQ — names, email addresses, phone numbers, order history, notes, and newsletter subscription status. For this data, Bravexa Software acts as a data processor on the operator’s behalf; the operator is the data controller and is responsible for the lawful basis of collection.

Storefront Visitor Data: When someone visits an operator’s storefront and places an order, requests a custom order, joins a newsletter, or submits a product review, we collect the information they provide (name, email, shipping address, order contents, review text) on behalf of the operator.

Usage Data: We log IP addresses, browser type, device identifiers, pages visited, and approximate timestamps to operate the service, troubleshoot issues, and prevent abuse.

Content You Create: Recipes, product photos, website copy, label designs, and email templates you author inside Cottage HQ.

3. How We Use Your Information

• To provide, operate, and maintain Cottage HQ
• To process operator subscription payments and send billing receipts
• To send transactional emails to operators — emails essential to running your business (order confirmations, payment receipts, fulfillment updates, refund-failed alerts, customer form-submission alerts, password resets, trial reminders, billing notifications). These are sent regardless of marketing preferences because they are necessary for the service to function and are sent based on a legitimate-interest legal basis.
• To send marketing emails to operators about new features, product updates, and announcements — only when you have explicitly opted in via the marketing-email consent checkbox at signup or in Settings → Notifications. If you have not opted in, we will not send you marketing emails. Every marketing email also contains an unsubscribe link; using it sets your consent flag back to off.
• To deliver, on operators’ behalf, emails to their customers (drop alerts, newsletters, review solicitations) — the operator controls content and audience; we control deliverability. Each operator’s customer list is strictly scoped to that operator’s site — one operator never receives email from another operator’s customers, and a customer never receives email from an operator they did not directly transact with.
• To improve and debug the product through aggregated usage analytics
• To detect, prevent, and respond to fraud, abuse, or security incidents
• To comply with legal obligations and enforce our Terms of Service

4. Data Storage & Security

Your data is stored in encrypted databases hosted by Supabase (Postgres, in the United States) and served through Vercel’s content delivery network. We use industry-standard security measures including TLS encryption in transit, at-rest encryption, and row-level security policies that prevent one operator from accessing another operator’s data.

No internet transmission is perfectly secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@cottageheadquarters.com.

5. Data Sharing & Third-Party Processors

We do not sell your personal information. We share information only with service providers that help us operate Cottage HQ, and only the data required for them to do their job:

• Stripe — Payment processing and subscription billing. Privacy policy
• Supabase — Database hosting and authentication. Privacy policy
• Vercel — Application hosting and content delivery. Privacy policy
• Anthropic — AI-powered content generation (Claude). Privacy policy
• Resend — Transactional and marketing email delivery. Privacy policy

We may also disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of Bravexa Software, our users, or others.

6. AI-Powered Features

Cottage HQ includes AI-powered features (content generation, recipe suggestions, label text suggestions) powered by Anthropic’s Claude. When you use these features, the relevant prompt and context you provide are sent to Anthropic for processing. Anthropic does not train its models on customer data submitted through its API. The generated output is returned to you; we store it only as part of your account (e.g. the draft you asked it to write) and not separately for model training.

7. Cookies & Tracking

We use essential cookies to keep you signed in, remember your cart, and protect against cross-site request forgery. We use privacy-respecting analytics to understand aggregate usage patterns. We do not use third-party advertising trackers.

Operator storefronts may display an integration the operator has enabled (for example, a Meta Pixel they configure themselves). When that happens, the integration is the operator’s choice and is governed by the operator’s own privacy policy and the third party’s terms.

8. Data Retention

We retain your information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymize your personal data within 90 days, except where we’re required to retain it (e.g. tax records, fraud prevention).

Operator storefront customer data is retained while the operator’s account is active. If an operator closes their account, the operator may export their customer list first; we then delete the customer data alongside the operator’s account on the same 90-day window.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Export a copy of your data
• Opt out of marketing emails (every email contains an unsubscribe link)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email us at support@cottageheadquarters.com. We’ll respond within 30 days.

If you’re a customer of one of our operators and want to exercise these rights over data held by that operator, please contact the operator directly — they control that data. We’ll assist them on request.

10. Children’s Privacy

Cottage HQ is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email to operators and via an in-product notice. The “Last Updated” date at the top of this page always reflects the current version. Continued use of Cottage HQ after a change constitutes acceptance of the updated policy.

12. Contact Us

For privacy questions, data requests, or any concern about how we handle your information:

Bravexa Software
Email: support@cottageheadquarters.com