Privacy Policy.
This policy explains the processing of personal data when you use the BroCracy website and its contact forms. Last updated: November 2, 2026. The separate training application is covered by our App Privacy Policy.
1. Data controller
Dr. Eduard Anton
Georg-Schmitt-Weg 20
96106 Ebern
Germany
Email: hellobro@brocracy.com
For privacy questions or requests, you can contact us using the email address above.
2. Purpose and scope of the website
This website introduces BroCracy, the training app, the planned trainer dashboard, Bro HQ departments and independent partners. It also provides dedicated Training Support and Academic Coaching forms, along with a general Special Requests inquiry form, also used for coach-dashboard interest and custom-analytics feature requests. It does not offer public account registration, newsletter subscriptions, on-site payments or online bookings. These three first-party inquiry forms use the same server-side email interface. Product-preview statistics are illustrative sample values, not real user records.
3. Accessing and hosting the website
To serve the website, technically necessary information may be processed by the hosting provider, such as IP address, time of access, requested URL, HTTP status, browser and device characteristics. Server and security logs may be used to provide the site, diagnose errors and prevent abuse. The legal basis is Article 6(1)(f) GDPR (legitimate interest in providing a functional and secure website).
The website is hosted by Vercel (Vercel Inc., United States, potentially affiliated companies and subprocessors). Vercel's Privacy Notice and Data Processing Addendum describe the service and applicable data-processing terms.
4. Recipients and international transfers
Vercel and its service providers may process technical information outside the European Economic Area, including in the United States. Vercel publishes a Data Processing Addendum including provisions for cross-border transfers.
Resend processes submission contents and transactional delivery information. Resend states that stored email data is held in the United States, with contractual safeguards described in its DPA and GDPR information. The incoming mailbox is hosted by Zoho Mail, using an EU account; access by affiliates or subprocessors outside the EEA may occur. Processing is not restricted exclusively to the European Union. Further information about safeguards is available through the providers' linked privacy documents or by contacting us.
5. Cookies and local device storage
This website does not use advertising or analytics cookies, retargeting pixels or third-party marketing scripts. Illustrative graphics, fonts, styles and JavaScript are served from the website itself. The website does not set non-essential cookies or use browser storage for analytics or marketing. We therefore do not display an advertising-cookie consent banner.
6. Contact and inquiry forms
The Training Support, Academic Coaching and Special Requests inquiry forms ask for a name, reply email address and message. Each form also supplies an inquiry category. On submission, those details are sent to our website's server-side mail endpoint. The endpoint sends the message via Resend to our contact inbox at hellobro@brocracy.com through Resend (transactional email service), including the sender's address for replying. If the sending service reports an error, the form displays an error rather than claiming that the message was sent. We do not operate a separate database of form submissions.
We process messages to respond to requests or discuss possible services. Depending on the nature of the inquiry, the legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract) or Article 6(1)(f) GDPR (legitimate interest in responding to general inquiries). Please do not include sensitive medical or health information in the form. The endpoint applies content limits, a hidden honeypot field and a Vercel firewall rate limit on contact submissions. These safeguards process request metadata such as IP addresses for abuse prevention. Vercel may process technical access and security information in connection with submissions; Resend processes sending metadata and message contents for the delivery service.
Incoming messages are handled through Zoho Mail (an EU account operated by Zoho Corporation B.V. and potentially its affiliates and subprocessors). Email addresses, message contents, attachments and technical delivery/security information may be processed. Zoho may use support staff or subprocessors outside the EEA. See Zoho Privacy Policy and Zoho Privacy FAQ. Visitors may also write directly to hellobro@brocracy.com.
7. Retention and deletion
Form messages are not stored in a separate BroCracy website database. Under Resend's published retention policy, email and log data are retained for 30 days on Free, Pro and Scale plans, with backups retained for seven days. Other arrangements may apply to Enterprise plans. Messages and replies in Zoho Mail are retained for as long as necessary to respond to requests, manage ongoing correspondence, take steps toward a contract or comply with statutory recordkeeping requirements. Information is deleted when it is no longer necessary for those purposes, unless it is required to establish, exercise or defend legal claims. Technical and security logs are retained based on the purpose of the log and the hosting provider's applicable settings.
8. Requirements to provide data and automated decisions
You are not required to send contact details merely to browse the website, although technically necessary connection information is required to load it. Providing a contact email and message is necessary if you want us to reply through the form. The marketing website does not perform automated decision-making with legal or similarly significant effects, or profiling within the meaning of Article 22 GDPR.
9. Your rights
Subject to applicable conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection to processing based on legitimate interests (Article 21). Consent, where given, may be withdrawn for the future (Article 7(3)). Contact us at the email above to exercise your rights.
You may lodge a complaint with a competent supervisory authority under Article 77 GDPR. In Bavaria, depending on jurisdiction, this may include the Bavarian Data Protection Authority for the Private Sector.
10. Changes and separation from the training app
We update this policy if the website's functions, service providers or processing activities change. Registration and personal training data in the separate BroCracy app are discussed in the App Privacy Policy; this website policy does not describe storage of users' workout histories.