Privacy Policy

Last updated October 12, 2026

This Privacy Notice for Arma Worldwide ("we," "us," or "our") describes how and why we might access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.brevl.co or any website of ours that links to this Privacy Notice.
• Use Brevl, a platform for home bakers: a hosted shop where your customers order and pay, and a workspace to run your orders, payments, and customers.
• Engage with us in other related ways, including sales, marketing, or events.

Questions or concerns? This Privacy Notice helps you understand your privacy rights and choices. We are responsible for decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at privacy@brevl.co.

Summary of key points

What personal information do we process? When you use our Services, we may process personal information depending on how you interact with us. This includes account information, such as your name, email address, and login details.

Do we process sensitive personal information? We do not intentionally process sensitive personal information.

Do we collect information from third parties? We receive data from the payment providers you connect, such as Stripe and Square, and from Google if you choose to sign in with Google.

How do we process your information? To provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.

How do we keep your information safe? We use encryption for data in transit and at rest, and each bakery's data is isolated from other bakeries. No method of transmission or storage is guaranteed to be completely secure.

Do we sell your data? No. We do not sell your personal information.

What are your rights? Depending on where you live, you may have certain rights over your personal information. You can export or delete your data, and you can contact us at privacy@brevl.co.

Table of contents

1. What information do we collect?
2. How do we process your information?
3. What legal bases do we rely on?
4. When and with whom do we share your personal information?
5. Third-party integrations and connected accounts
6. How do we handle your social logins?
7. How long do we keep your information?
8. How do we keep your information safe?
9. Do we collect information from minors?
10. What are your privacy rights?
11. Controls for do-not-track features
12. Do United States residents have specific privacy rights?
13. Do other regions have specific privacy rights?
14. Do we make updates to this notice?
15. How can you contact us about this notice?
16. How can you review, update, or delete the data we collect?

1. What information do we collect?

In short: We collect personal information that you provide to us, and some information is collected automatically.

We collect personal information that you voluntarily provide when you register, express interest in our products, use the Services, or contact us. Depending on how you use the Services, this may include:

• Names
• Email addresses
• Usernames and authentication data
• Contact preferences

Payment data. Payments are handled by our payment providers, Stripe and Square. We do not store your full card number. See https://stripe.com/privacy and https://squareup.com/us/en/legal/general/privacy.

Information collected automatically. When you visit or use the Services, we automatically collect certain information that does not directly reveal your identity, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, and information about how and when you use the Services. We use this to maintain the security and operation of the Services and for internal analytics.

2. How do we process your information?

In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

• To create and manage your account.
• To provide the Services, including your shop, orders, payments, and workspace.
• To process payments through your connected payment provider.
• To respond to your inquiries and offer support.
• To send administrative information, such as changes to our terms and policies.
• To request feedback and contact you about your use of the Services.
• To send marketing communications, in line with your preferences. You can opt out at any time.
• To evaluate and improve our Services.
• To comply with our legal obligations.

3. What legal bases do we rely on?

In short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so, such as your consent, to comply with laws, to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in Canada, this section applies to you. We may process your information if you have given us specific permission (express consent) or where your permission can be inferred (implied consent). You can withdraw your consent at any time.

4. When and with whom do we share your personal information?

In short: We may share information in specific situations and with the following third parties.

• Payment processors. We share payment information with Stripe and Square to process your payments.
• Service providers. We use providers for hosting and infrastructure (Cloudflare), email delivery (Brevo), delivery pricing (LocationIQ), and support chat (tawk.to). They process data only to provide their services to us.
• Analytics. We use privacy-first analytics. Where possible, analytics are cookieless.
• Business transfers. We may share or transfer your information in connection with a merger, sale of assets, financing, or acquisition.

5. Third-party integrations and connected accounts

In short: You can connect third-party accounts, and we access them only to provide the Services you ask for.

The Services let you connect third-party accounts, such as your payment provider (Stripe or Square) or Google for sign-in, through OAuth or similar authorization. When you connect an account, we store encrypted access tokens that let us access that account on your behalf. You can disconnect any connected account at any time in your settings, and we delete the associated tokens.

6. How do we handle your social logins?

In short: If you log in with a third-party account, we may receive certain information about you.

If you register or log in using a third-party account, such as Google, we receive certain profile information from that provider, often including your name, email address, and profile picture. We use it only for the purposes described in this notice. We do not control other uses by the provider, so please review their privacy notice.

7. How long do we keep your information?

In short: We keep your information for as long as necessary to fulfill the purposes in this notice, unless the law requires otherwise.

We keep your personal information only as long as necessary for the purposes set out in this notice, unless a longer period is required or permitted by law. When we no longer have a legitimate business need to process it, we delete or anonymize it. You can delete your data at any time from your settings.

8. How do we keep your information safe?

In short: We protect your information with organizational and technical measures.

• Encryption for data in transit and at rest.
• Isolation of each bakery's data from other bakeries.
• Encrypted storage of access tokens for connected accounts.
• Monitoring and routine backups.

No electronic transmission over the internet or storage technology can be guaranteed to be completely secure. You should only access the Services within a secure environment.

9. Do we collect information from minors?

In short: We do not knowingly collect data from or market to children under 18.

We do not knowingly collect, solicit data from, or market to children under 18. By using the Services, you represent that you are at least 18. If we learn that we have collected personal information from anyone under 18, we will delete it. If you become aware of any such data, contact us at privacy@brevl.co.

10. What are your privacy rights?

In short: Depending on your location, you have rights that allow you greater access to and control over your personal information.

In some regions, you have the right to request access to and a copy of your personal information, to request correction or erasure, to restrict or object to processing, to data portability where applicable, and to withdraw consent. You can make a request by contacting us at privacy@brevl.co. You can also update or delete your account information in your settings.

Opting out of marketing. You can unsubscribe from marketing emails at any time using the unsubscribe link in our emails or by contacting us.

11. Controls for do-not-track features

Most browsers include a Do-Not-Track ("DNT") setting. No uniform standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will update this notice.

12. Do United States residents have specific privacy rights?

In short: If you are a resident of certain US states, you may have the right to request access to and details about the personal information we maintain about you, to correct inaccuracies, to get a copy, or to delete it.

We have collected the following categories of personal information in the past twelve months:

You have rights under certain US state data protection laws, including:

• The right to know whether we are processing your personal data.
• The right to access your personal data.
• The right to correct inaccuracies.
• The right to request deletion of your personal data.
• The right to obtain a copy of the personal data you shared with us.
• The right to non-discrimination for exercising your rights.
• The right to opt out of processing for targeted advertising, sale of personal data, or profiling.

To exercise these rights, email us at privacy@brevl.co. We will honor opt-out preferences if you use a Global Privacy Control (GPC) signal. We have not sold or shared personal information to third parties for a business or commercial purpose in the preceding twelve months, and we will not sell personal information in the future.

13. Do other regions have specific privacy rights?

In short: You may have additional rights based on your country.

Australia and New Zealand. We collect and process personal information under Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You have the right to request access to or correction of your personal information by contacting us. If you believe we are unlawfully processing your personal information, you have the right to complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

14. Do we make updates to this notice?

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by a new "Last updated" date. If we make material changes, we may notify you by posting a notice or by sending you a notification. We encourage you to review this notice frequently.

15. How can you contact us about this notice?

If you have questions or comments about this notice, email us at privacy@brevl.co.

16. How can you review, update, or delete the data we collect?

Based on the laws of your country or state of residence, you may have the right to request access to the personal information we collect, details about how we process it, correction of inaccuracies, or deletion. To make a request, contact us at privacy@brevl.co.