Privacy notice

Reverberate is operated by BRAE Ltd, registered in the United Kingdom. We are the controller for the personal data we collect through this site. Contact: privacy@reverberate.earth.

We collect personal data only when you actively give it to us:

• Email address — when you submit a benchmark request (/api/benchmark-request) or company research request (/api/research-request).
• Request subject + free-text detail — the category or company you asked us to add, and any context you typed into the request form.
• Originating page path — so we know which page you were on when you asked.
• Sign-in identity — if you sign in as an admin, Supabase Auth stores your email + a session cookie pair. There is no public sign-up yet.

We do not use marketing cookies, analytics tags, or third-party trackers. No retargeting pixels. No advertising network.

Under UK GDPR Article 6(1)(b), we process your contact details to fulfil the specific request you sent us — building the benchmark you asked for, or researching the company you nominated, and emailing you when it's ready. We do not use this data for any other purpose without separately asking you.

Request data (email + subject + detail) is retained for 24 months from the date of the request, after which the row is deleted. If we fulfil your request and email you, we retain the record so we can answer follow-up questions.

We use these services to operate Reverberate. Each is GDPR-compliant and bound by appropriate data-processing terms.

• Supabase (hosting our database — EU region) — stores request rows + admin sign-in identity.
• Vercel (hosting the site) — processes HTTP requests; no application-level PII written to logs.
• Resend (transactional email) — used to send fulfilment emails.

Under UK GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct anything that's wrong.
• Erasure — ask us to delete your data.
• Restriction — ask us to limit how we use your data while a query is open.
• Portability — receive your data in a machine-readable format (JSON).
• Object — to any processing you don't consent to.
• Lodge a complaint with the UK Information Commissioner (ico.org.uk).

Email privacy@reverberate.earth for any of the above. We respond within 30 days.

Supabase data lives in EU regions. Vercel and Resend may route traffic via US infrastructure under EU Standard Contractual Clauses + the UK International Data Transfer Addendum.

We will update this notice if the data we collect or the sub-processors we use change. The “last updated” date at the top of this page reflects the most recent change.