1. Data controller

Name: Iker Jurado
Postal address: Carrer Ignasi Mas, s/n, Barcelona
Email: contacto@bryana.es
Contact phone: +34 644 65 41 67 (WhatsApp Business)
Data Protection Officer (DPO): Not applicable. Given the volume of data processed and the nature of the processing, appointing a Data Protection Officer is not mandatory under Article 37 GDPR.

2. Data we collect and purposes

We distinguish two sets of personal data depending on who the data subject is and who acts as controller under the GDPR.

2.1. Tattoo artist or studio data (Bryana's direct customer)

Bryana is the controller of this data.

Identification and account: email address, name, studio name, contact phone number if provided — to create and maintain the account, billing, support, and operational communications related to the service.
Payment data: processed by Stripe Payments Europe, Ltd. as payment processor. Bryana does not store full bank card numbers.
Technical and usage data: IP address, browser type, access logs, aggregated or pseudonymised usage events — for security, abuse prevention, diagnostics, and product improvement.

2.2. End-customer data (people who contact the tattoo artist)

The tattoo artist or subscribing studio is the controller of this data. Bryana processes it as a processor, under the Data Processing Agreement (DPA) — request it by email at contacto@bryana.es — accepted when the studio administrator registers at https://app.bryana.es.

Identification and contact: name, Instagram handle or other public identifiers, phone or email if provided.
Conversations: messages and metadata associated with connected channels (e.g. Instagram/WhatsApp via Zernio).
Voice notes and their transcription: when a client sends a voice note through messaging (for example, Instagram), the assistant may automatically transcribe that audio to text in order to reply. The transcription is carried out by our sub-processor OpenAI, through its transcription API, with the audio processed in memory and without the voice file being retained: only the transcribed text is kept, for the same purpose and the same retention period as any other message in the conversation.
Preferences and operations: tattoo type, body area, appointments, budget, reference photos, or other content the data subject sends to the studio. Reference photos (which may show the data subject's face or body areas) and photos of completed work are stored with restricted access: they are not public and are shown only to the studio's authorised staff through time-limited signed links. These images are deleted when the studio closes its account.
Health data (special category, Art. 9 GDPR): when the studio uses the informed consent module, the end customer may provide health-related data (for example allergies, medication, pregnancy, or conditions relevant to the tattoo), along with an identity document, date of birth, signature, and the consent PDF. Bryana processes this data on behalf of the studio, with reinforced security measures (access control, encryption in transit, and restricted storage), and solely to provide that functionality.

3. Legal basis

Tattoo artist data: performance of the subscription contract or terms of use (Art. 6(1)(b) GDPR); compliance with legal obligations in tax and commercial matters (Art. 6(1)(c)); legitimate interest in security and service improvement (Art. 6(1)(f)), with a balancing of interests assessment; and, where applicable, consent for newsletters or other non-essential commercial communications (Art. 6(1)(a)).
End-customer data: the processing agreement between the studio and Bryana (Art. 28 GDPR) on the basis of the service contract between the tattoo artist and their end customer, and/or consent or another basis as applicable according to the information the studio has provided to its own customers. It is the studio's responsibility to have an adequate legal basis.
Health data (special category): when collected through the consent module, the legal basis is the data subject's explicit consent (Art. 9.2.a GDPR), obtained by the studio as controller; Bryana processes it as a processor solely under the studio's instructions and the DPA.

4. Retention period

Tattoo artist and billing data: for the duration of the account and, after closure, for as long as necessary to handle claims and the statutory retention period for accounting and tax records (approximately up to 4 years or another period required by applicable law).
Conversations and operational end-customer data: by default 24 months from the last interaction recorded on the platform, unless the studio requests earlier deletion when technically feasible and no legal retention obligation applies, or unless a different period is contractually enabled by Bryana.
Informed consents and associated health data: retained for the period configured by the studio (by default 3 years) or until the studio or the data subject requests their deletion, unless a legal retention obligation applies.
Payment data in Stripe: according to Stripe's retention policy. Bryana retains customer/billing identifiers necessary for the contractual relationship.
Technical logs: short periods focused on security and support (e.g. weeks or months, unless incidents require limited extended retention).

5. Processors and sub-processors

Bryana uses providers that process personal data on Bryana's behalf. In each case, contractual measures apply and, where relevant, Standard Contractual Clauses (SCCs) or other Chapter V GDPR safeguards for transfers outside the EEA.

Hetzner Online GmbH (Germany) — server hosting (infrastructure in the European Union). Privacy policy.
Supabase, Inc. (infrastructure in the European Union) — database and authentication. Privacy policy.
Stripe Payments Europe, Ltd. — payments. Privacy policy. May involve processing in third countries with GDPR safeguards.
Zernio — Instagram/WhatsApp integration via the official Meta Graph API (no passwords stored). Privacy policy.
OpenAI, LLC (Delaware, USA) — text processing for AI features and voice-note transcription. Privacy policy. OpenAI processes this data as a processor for Bryana, under its Data Processing Addendum, without using it to train its models, and applying Standard Contractual Clauses for international transfers.
Resend, Inc. (United States) — transactional email delivery. Privacy policy.
Upstash, Inc. (United States) — cache storage / rate limiting. Privacy.
Functional Software, Inc. (Sentry) (United States) — only if the owner enables Sentry or equivalent monitoring. Privacy policy.

6. International transfers

Some of the processors listed above process data in the United States or other third countries. In those cases, Bryana seeks to base the transfer on adequacy decisions, SCCs approved by the European Commission, or supplementary measures where required by case law or guidance from supervisory authorities.

7. Data subject rights

You may exercise the rights of access, rectification, erasure, objection, restriction of processing, portability and, where applicable, not to be subject to decisions based solely on automated processing, when applicable under the GDPR.

To exercise them, write to privacidad@bryana.es stating your request and a reasonable means of verification. End customers of a studio should primarily contact the tattoo artist as controller; Bryana will assist the studio to the extent contractually provided.

8. Complaint to the AEPD

If you believe the processing violates applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.

9. Cookie policy

Detailed information about cookies and similar technologies on the public website is available at /cookies.

10. Changes

We reserve the right to modify this policy. Material changes will be communicated with at least 15 days' notice by email to the main account associated with the service and, where applicable, via notice in the application panel.

11. Last update date and history

Published version: 05/07/2026. Significant previous versions may be retained and made available to the data subject upon reasonable request to privacidad@bryana.es.

12. Security and automated decisions

Appropriate technical and organisational measures are applied (encryption in transit, access controls, backups, etc.). The service may include AI-assisted features; the studio retains final control over its relationship with its customers.

Privacy Policy