Privacy Policy

Effective October 3, 2026

This policy covers the Brave Haven website, including Brave Haven Aviation's training pages, the quote request form, booking and payment through Stripe, and the A&P practice questions. It explains what personal data is collected, why, who it is shared with, how long it is kept, and the rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR), Portugal's data protection and electronic communications laws, and United States federal and state privacy laws.

Who is responsible for your data

Brave Haven is operated by Brave Haven, a veteran-owned limited liability company in the United States, the controller of your personal data. For anything about your data, email hr@bravehaven.io. No data protection officer has been appointed, because one is not required at this size.

The short version

There are no accounts. The practice questions run in your browser, and your answers are never sent or saved.
We collect only what the service needs, and use it only for the purposes below.
We never sell your personal information, and never share it for advertising.

What we collect, why, and for how long

Answering quote requests

What: What you enter in the quote form: your name, email address, and message, and if you choose to give them, your organization, phone number, and number of learners. It is emailed to our team and is not stored on the website
Why we are allowed to: Steps you ask for before entering into a contract (GDPR Art. 6(1)(b)), and legitimate interests (gdpr art. 6(1)(f)): answering business enquiries
How long we keep it: As long as needed to answer and follow up on your request, and no more than 2 years after our last exchange, unless it becomes a contract

Protecting the quote form and checkout from bots (Vercel BotID)

What: When you submit the quote form or start a checkout: signals from your browser and request that Vercel BotID uses to tell people from automated bots, such as browser and device characteristics and how the request was made. We receive only a verdict: person or bot
Why we are allowed to: Legitimate interests (GDPR Art. 6(1)(f)): keeping the form and checkout usable and protecting them from abuse
How long we keep it: We keep nothing. Vercel processes the signals to return the verdict

Taking payment for coaching sessions

What: Your name, email address, billing details, what you bought, and the amount. Card details are handled by Stripe and never reach us
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b)), and legal obligation: tax and accounting law (gdpr art. 6(1)(c))
How long we keep it: As long as tax and accounting law requires, up to 10 years

Replying when you email us

What: Whatever you put in your email: usually your name, email address, and message
Why we are allowed to: Legitimate interests (GDPR Art. 6(1)(f)): answering people who write to us
How long we keep it: As long as needed to handle your message, and no more than 2 years after our last exchange

Running and securing the site

What: IP address, browser and device type, pages requested, and time of request, in server logs
Why we are allowed to: Legitimate interests (GDPR Art. 6(1)(f)): keeping the site working and protecting it from abuse
How long we keep it: No more than 30 days, then deleted automatically by our host

Counting visits (Vercel Web Analytics)

What: Only if you accept analytics: the time of each visit, the page viewed, the site you came from, your approximate location (down to city), browser, operating system, and device type. No cookies are set. Visits are grouped using a hash of your request that is discarded after 24 hours, so you cannot be recognized across days and we see only totals
Why we are allowed to: Consent (GDPR Art. 6(1)(a)), given in the analytics banner. You can withdraw it at any time from Analytics settings in the footer
How long we keep it: Aggregated totals only, kept for our Vercel plan's reporting period (up to 12 months)

Cookies and similar technologies

This site sets no cookies. It stores one item in your browser's local storage, analytics-consent, to remember whether you accepted or rejected analytics, so it does not ask again on every page. Remembering your choice is strictly necessary, so it needs no consent of its own.

Visit counts come from Vercel Web Analytics, which sets no cookies and does not identify you. It still records each page view, so it loads only after you accept it in the banner, and a browser sending Global Privacy Control is treated as having said no. Change your choice anytime with Analytics settings in the footer. Bot protection (Vercel BotID) runs from this site and sets no cookies. Stripe's checkout pages are on Stripe's own site and follow Stripe's cookie policy.

Who we share it with

We use these service providers (processors). Each may use your data only to provide its service to us, under a data processing agreement:

Vercel: Hosts the site, keeps short-lived server logs, provides cookieless visit counts if you accept analytics, and checks form submissions and checkouts for bots (BotID). Location: United States.
Resend: Delivers quote requests from the form to our inbox. Location: United States.
Stripe: Takes payments through secure checkout pages. Card details go to Stripe directly. Location: United States.
Our email provider: Receives and stores email you send us and quote requests. Location: United States.

You may also use these services, which are responsible for your data themselves:

@TheVeteranMechanic: William Thompson's personal channels and store are run by him, under the policies of the platforms they are on.

We do not sell personal information and do not share it for cross-context behavioral advertising. We would disclose data to authorities only where the law requires it.

International transfers

Our providers store or process data in the United States. For transfers of personal data from the European Economic Area, the UK, or Switzerland, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses in the provider's data processing terms.

Your rights

In the European Union, the UK, and Switzerland

Access: get a copy of the personal data we hold about you.
Rectification: have inaccurate data corrected.
Erasure: have your data deleted.
Restriction: ask us to stop using your data while a concern is resolved.
Portability: receive your data in a machine-readable format.
Objection: object to processing based on our legitimate interests.
Withdraw consent at any time, without affecting what was done before.

You can complain to a data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. Elsewhere, contact the authority where you live or work. We would appreciate the chance to put things right first.

In the United States

Depending on your state (including California, Colorado, Connecticut, Virginia, Texas, and others with comprehensive privacy laws), you may have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it, and to opt out of its sale, of targeted advertising, and of profiling. We do none of those three. We will not treat you differently for using any of these rights. You can use an authorized agent, and if we turn down a request you can appeal by replying to our answer.

How to make a request

Email hr@bravehaven.io and say what you would like. We answer within one month (GDPR), or within 45 days for US state privacy law requests, and tell you if a complex request needs longer. Requests are free.

How we protect it

Every connection is encrypted with HTTPS
There are no accounts, and quote requests are emailed to our team rather than stored by the website
Every quote request and checkout is checked by Vercel BotID on the server and refused unless confirmed as a person; quote requests are also rate limited
A strict Content Security Policy allows scripts only from this site
Card details never reach us: payment happens on Stripe's checkout pages

Children

Brave Haven is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

Changes to this policy

When this policy changes, we update this page and its effective date.