Privacy Policy

The controller of your personal data is Benoit Vandevelde, trading as Brownian Bridge, Flat 204 Hampton Apartments, Duke of Wellington Avenue, London SE18 6NX, United Kingdom. You can contact us about anything in this policy at contact@brownian-bridge.com.

This policy explains what personal data we collect when you use www.brownian-bridge.com, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you live in the European Economic Area, the EU GDPR gives you equivalent rights.

Your account

• What: your email address, your password (stored only in hashed form), your handle, your display name if you give one, and when you signed up.
• Why: to create your account, sign you in, send account emails such as email confirmation and password reset, and show your public profile.
• Legal basis: performing our contract with you.

Sign-in and security records

• What:the IP address, browser and time of sign-ins, sign-ups and password changes, recorded by our authentication provider; and our hosting provider’s request logs (IP address, requested address, time).
• Why: to keep accounts secure, detect abuse and fix faults.
• Legal basis: our legitimate interest in keeping the Service secure and working.

Your learning activity

• What: modules you mark complete, lesson videos you watch to the end, quiz attempts (score, number of questions and time), XP you earn, and your Quant Readiness Diagnostic sittings (your answers, score, level and timing).
• Why: to save your progress, grade quizzes and the diagnostic, calculate XP, levels and streaks, and show your history.
• Legal basis: performing our contract with you.
• If you sit the diagnostic without signing in, the sitting is stored without being linked to any account.

Your public profile and the leaderboard

• What is public: your handle, your display name if you set one, your level, total XP, number of modules completed, number of quizzes taken, and the month you joined.
• Why: public profiles and the leaderboard are part of the Service.
• Legal basis: our legitimate interest in running a public leaderboard. You can object; see section 8.
• When you sign up you get a random handle, such as quant-3f9a1c2b, which you can change under Dashboard → Profile. Accounts created before 17 September 2026 may have a handle based on their email address, which can be changed in the same place.

Payments

• What: your Stripe customer and subscription identifiers, plan, subscription status, renewal date and cancellation date. Stripe collects your card and billing details directly. We never receive or store your full card number.
• Why: to take payment, give you Premium access, and let you manage or cancel your subscription.
• Legal basis: performing our contract with you, and our legal obligation to keep accounting and tax records.

Complimentary access

• What: the start and end dates of any complimentary Premium access, and a short internal note on why it was given.
• Why and legal basis: to give and end that access, in our legitimate interests.

When you contact us

• What: your email address and what you write to us.
• Why and legal basis: to reply and resolve your request, in our legitimate interests.

Site analytics

• What: pages viewed, referring site, country and region, device type, operating system and browser. This is collected by Vercel Web Analytics without cookies. Visitors are counted using a hash of the request that is discarded after 24 hours, and the data is used only in aggregate.
• Why and legal basis: to understand which parts of the site are used and improve them, in our legitimate interests.

Quizzes and the diagnostic are graded automatically, but the results are for your own information. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We do not send marketing emails. If we start, we will ask for your consent first.

We use only what the Service needs to work and to remember your display preference. Lessons that include a video use YouTube’s privacy-enhanced mode.

Vercel Web Analytics does not use cookies. Checkout takes place on Stripe’s own site, checkout.stripe.com, where Stripe sets its own cookies for payment and fraud prevention under its own privacy policy.

You can block or delete cookies in your browser settings. Blocking the sb-… cookies will stop you from signing in.

We do not sell your personal data, and we do not share it with advertisers, employers or recruiters. If we ever offer employers a way to see candidates’ work, it will be strictly opt-in. We share personal data only with:

• Supabase, for authentication and database hosting. Our database is in Frankfurt, Germany.
• Vercel, for website hosting, request logs and web analytics.
• Stripe, for payment processing. Stripe also acts as an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations.
• Resend, which delivers account emails such as sign-up confirmation and password reset.
• Google (YouTube), on lessons that include a video. Your browser connects to YouTube to load the player, so YouTube receives your IP address and which video is embedded, as described in section 3.
• Professional advisers, such as accountants and lawyers, who are bound by confidentiality; and public authorities, where the law requires it.
• Anyone who takes over the Service, in which case this policy continues to apply to your data.

Supabase, Vercel and Resend process your data only on our instructions, under data processing agreements. You can read the privacy policies of Supabase, Vercel, Stripe, Resend and Google.

Our database is hosted in the European Union, which the UK recognises as providing adequate protection for personal data. Some of our providers, including Vercel, Stripe, Resend and Google, are based in or may process data in the United States or other countries. Those transfers are protected either by UK adequacy regulations, such as the UK Extension to the EU–US Data Privacy Framework for certified companies, or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Account, profile, learning and subscription data:for as long as your account exists. When you ask us to delete your account, we delete this data within 30 days. Copies in our provider’s routine backups are overwritten on its normal backup cycle.
• Payment records held by Stripe: for as long as UK tax and accounting law requires, currently at least 5 years after the 31 January filing deadline for the relevant tax year, even if you close your account.
• Diagnostic sittings taken without signing in: kept so the result stays available at its link. They are not linked to any account.
• Sign-in, security and hosting logs: for the limited periods set by Supabase and Vercel.
• Emails you send us: for up to 2 years after the matter is resolved.

Row-level security in our database means each signed-in user can read only their own private records. Passwords are stored only in hashed form, all traffic is encrypted with HTTPS, and card details never reach our servers. No system is completely secure. If a breach is likely to put your rights at high risk, we will tell you without undue delay.

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected (you can change your handle and display name yourself under Dashboard → Profile);
• have your data deleted;
• restrict how we use your data;
• receive your data in a portable, machine-readable format;
• object to processing based on our legitimate interests, including your public profile and leaderboard entry;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email contact@brownian-bridge.com from the address on your account. It is free. We may need to confirm your identity. We will respond within one month; for complex requests this can be extended by up to two further months, and we will tell you if it is.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint, 0303 123 1113) or, if you live in the European Economic Area, to the data protection authority in your country.

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from them. If you believe someone under 16 has created an account, contact us and we will delete it.

If we change this policy materially, we will update the date at the top of this page and, where appropriate, email you before the change takes effect.

Benoit Vandevelde, trading as Brownian Bridge
Flat 204 Hampton Apartments, Duke of Wellington Avenue, London SE18 6NX, United Kingdom

Email: contact@brownian-bridge.com