Privacy policy
Last updated 24 September 2026
This policy explains what personal data Bramley collects, why, and what you can do about it. Bramley is a trading name of CurroAI Ltd, which is the data controller for the purposes of UK data protection law.
| Controller | CurroAI Ltd, company number 17471073 |
| Registered office | 103 Brook Lane, Alderley Edge, Cheshire, SK9 7RU, United Kingdom |
| Contact | hello@bramleyai.io |
What we collect
If you use the free scorer
Nothing that identifies you. The single-product scorer needs no account, and the nutrition values you enter are processed in your browser to produce a score. We do not store them.
If you create an account
- Your name and email address
- Your company name, if you give it
- An encrypted form of your password, which we cannot read
- Your subscription plan and its status
If you subscribe to a paid plan
Payments are handled by Stripe. We never see or store your card details. Stripe provides us with a customer reference, your plan, and whether payment succeeded. Stripe's own privacy notice governs what they hold.
Product data you upload
If you use portfolio scoring, the product data you paste or upload is processed to produce scores. Where you use AI-assisted ingestion, the document text is sent to our model provider to extract nutrition values, and is not used to train any model.
Why we hold it
| To provide the service | Performance of our contract with you |
| To take payment | Performance of our contract with you |
| To email you about the service | Performance of our contract with you |
| To keep the service secure | Our legitimate interest in preventing misuse |
We do not sell your data, and we do not use it for advertising.
Who else processes it
- Supabase — account records and authentication
- Vercel — hosting
- Stripe — payments
- Anthropic — AI-assisted document extraction, where you use that feature
Each is bound by its own data processing terms. Where data is processed outside the UK, appropriate safeguards are in place.
How long we keep it
Account records are kept while your account is open and for six years after closure, which is the period we must retain financial records. You can ask us to close your account at any time.
Your rights
Under UK GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict processing. Email hello@bramleyai.io and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use a session cookie to keep you signed in. We do not use advertising or tracking cookies.
Changes
If we change this policy we will update the date at the top and, for material changes, email account holders.