Privacy notice · version 2026-10-19
Your information, explained.
Operated by operating as Degab, Paris, France.
Accounts and content
All brands remain available on the overview canvas as you explore. Opening a profile does not create a private viewed history or remove the brand from the overview.
We use your email, authentication details, display name, saved brands, suggestions, and claim evidence to provide your account and review ownership. Authentication and private records are hosted with Supabase. The website and its server endpoints run on Cloudflare. Payment processing, when enabled, uses Stripe; card details are entered with Stripe rather than stored by burando. When brand-approval emails are enabled, we use Resend for those transactional messages, using your verified account email, accepted brand name, selected plan and a personal Stripe payment link. Choosing a plan or submitting a registration does not collect payment.
Public and private information
Published brand information, verification badges, plan-based logo sizes, and published brand updates are public. Your saved brands, submission evidence, claim contact details, and account notifications are private to you and authorized staff. Collection sharing is off by default. If you enable your public canvas, anyone with its link can browse the collections you choose to show, along with the page title and any previously saved public bio. New links use your account display name or “My collection”. You choose whether visitors can see items bought. Only entries and fields allowed by your saved sharing settings are returned; hidden details are removed by the database before public data reaches the browser. Turning sharing off makes the link unavailable. A suggested brand is not public until an editorial publication step.
Your brand experiences
Receipt photos are processed on your device and discarded after scanning. The photo and full extracted receipt text are never uploaded or saved by burando. When you add a scanned receipt, we save its brand, detected merchant name, country, optional printed city and store location, and up to 50 readable product names when available. New scans do not save prices, totals, purchase dates or times, payment details or receipt numbers, and do not create a receipt hash or perform duplicate checking. If no published brand matches, you can choose to keep its merchant, location and any readable product names privately in Waiting for a brand. We recheck these details when you open your collection; an unambiguous published brand match links the existing record to your collection. Results cannot be edited; an unreadable merchant or country requires another photo. Earlier purchases retain their previously saved details. Receipt hashes from earlier versions remain stored privately but are no longer used for duplicate checking. Your collection stays private until you enable public sharing; receipt photos, full receipt text, store addresses, dates and account details are never included in your public canvas. Remove individual entries in your collection or include them in your account export.
Activity and storage
With your consent to usage analytics, brand opens and official website visits contribute to bounded activity counts. Our server temporarily stores a daily rotating keyed hash of the network address to limit repeated events; it does not store the raw address in the activity database. Hosting providers can process network information in their own operational logs. Local storage remembers interface preferences and your sign-in session. The Klaro consent manager stores your choice in this browser for 180 days. Optional brand activity, product usage, and browser error counters stay off until you accept them, and respect Do Not Track and Global Privacy Control. Withdrawing consent stops future counters and removes the local analytics marker. Essential sign-in, security, explicitly saved brands, and interface preferences remain available. We do not use advertising trackers.
Retention
burando’s first-party event rows are removed after 30 days and rate-limit records after two days when scheduled maintenance runs; aggregate counts remain. Declined submission and claim evidence is removed after 90 days. Account information remains until you delete it or request removal. Review audit entries retain limited decision metadata for accountability. Provider backup retention is controlled by the configured service plan; restored data must honor completed deletion requests.
Your choices
Use your account’s Security section to download your data or request account deletion. If you cannot sign in, contact [email protected] for help. Use Cookie preferences on any page to turn optional analytics on or off. Contact [email protected] for access, correction, deletion, or a privacy concern. We do not sell account or claim evidence.
Payments
Where paid subscriptions are enabled, payment records may need to be retained for billing and applicable accounting obligations. Cancel the subscription before deleting the account so future billing stops.
Changes and contact
Material policy changes will be reflected here with a new version. Questions: [email protected].
Business applications without an account
You can register or claim a brand without creating an account. We store your brand details, uploaded logos, contact name, work email, role and supporting evidence privately for review. Resend delivers an email-confirmation link and transactional review/payment correspondence. Confirmation establishes control of the contact email only; an admin decides whether you are authorized to represent the brand. We record the policy versions accepted with the application and server timestamps. Unconfirmed applications expire after 24 hours and are removed by maintenance. The staging copy is cleared after confirmation; the reviewed request and its verified contact remain together. Limited network and recipient rate counters use keyed hashes and expire after two days; the application database does not store the raw network address. For guest subscription management, we email a single-use billing link valid for 15 minutes to your verified application address. Only a hash of the link is stored; maintenance removes used and expired links. Contact [email protected] for access, correction, withdrawal or deletion of an account-free application. We verify your identity before providing private records.
Optional brand newsletters
When you open a brand’s Subscribe panel while signed in, burando fills in your account email for convenience. You can edit it. Opening the panel does not subscribe you or disclose your address to the brand. After you click Subscribe, Resend sends a confirmation email to the address you selected. Only after you confirm can the verified brand owner access that address for the brand’s stated newsletter and email offers. This use and disclosure rely on your specific consent and are separate from account registration and analytics preferences. The brand’s legal name and privacy notice appear before you subscribe.
We record the selected address, brand, consent wording version, privacy notice, request time, confirmation time and any withdrawal. Unsubscribe through the brand’s Subscribe panel or the link provided with the subscription. Brand owners must honor withdrawals in their email services, including previously exported lists. Pending requests expire after 24 hours; maintenance removes them and canceled unconfirmed requests. Confirmed withdrawals are retained for up to 180 days as restricted suppression records, excluded from active subscribers. Confirmation rate-limit records expire after two days. Account deletion removes the newsletter records held by burando; a brand’s separate records are governed by its privacy notice. Your burando data export includes your subscription records.
Why we process information
- Providing the service: account access, saved brands, receipt collections, suggestions and ownership requests are processed as necessary to perform our contract with you or take steps at your request before entering that relationship.
- Security and integrity: abuse prevention, limited decision records and security logs support our legitimate interests in protecting accounts and the directory. You may object to processing based on legitimate interests.
- Optional measurement: usage analytics uses your consent. You can refuse or withdraw it through Cookie preferences without losing the discovery service.
- Legal obligations: where payments are enabled, records required for applicable accounting, tax or legal obligations may be retained for those purposes.
We record the Terms and Privacy notice versions presented when you explicitly accept the Terms, together with a server timestamp. This is separate from optional analytics consent and is included in account exports.
Service providers and international processing
Cloudflare hosts the website and APIs and provides the Turnstile security check. Supabase provides authentication and private account data. Optional Google or GitHub sign-in shares information with the provider you select. Stripe processes payments only when paid services are enabled. Confirmation and recovery emails use the configured authentication email provider. When enabled, transactional brand-approval emails use Resend and contain the reviewed plan and a personal Stripe payment link.
Cloudflare provides website hosting, server endpoints and Turnstile through its international network. Supabase provides authentication and private account data; the current primary project region is Ireland (eu-west-1). Resend is the selected provider for authentication and application emails; its customer email data is stored in the United States. Provider data-processing terms describe international transfers and applicable safeguards, including EU Standard Contractual Clauses where applicable. Email setup and the applicable provider agreements still require verification. Contact: [email protected].
Backups
The current Supabase Free plan does not include customer-accessible scheduled daily database backups. No manual or offsite application database backups are configured. An application backup retention period and tested restoration procedure have not yet been established. Email-service backups are managed by Resend under its published retention policy.
Additional privacy rights
Depending on the applicable law, you can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Contact [email protected]. We verify identity where needed and ordinarily respond to applicable GDPR requests within one month; we will explain any lawful extension. You may also complain to your competent data protection authority. Find an EU/EEA supervisory authority ↗. burando does not use solely automated decisions with legal or similarly significant effects to decide account or ownership reviews.