Privacy Policy

Effective October 3, 2026

This policy covers MilSpouse Elevate, which connects military spouses with remote-friendly jobs, employers, and mentors. It explains what personal data is collected, why, who it is shared with, how long it is kept, and the rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR), Portugal's data protection and electronic communications laws, and United States federal and state privacy laws.

Who is responsible for your data

MilSpouse Elevate is operated by Erica Thompson (Brave Haven), the controller of your personal data. For anything about your data, email hr@bravehaven.io. No data protection officer has been appointed, because one is not required at this size.

The short version

We collect only what the service needs, and use it only for the purposes below.
We never sell your personal information, and never share it for advertising.
Analytics stays off unless you accept it, sets no cookies, and you can change your mind at any time.

What we collect, why, and for how long

Your member account

What: Email address, hashed password, name, military affiliation, current location, whether you are willing to relocate, and phone number if you add one
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b))
How long we keep it: For as long as you keep your account. Ask us to delete it and it is deleted within 30 days

Saving and tracking jobs

What: The opportunities you save or apply to, and their status
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b))
How long we keep it: For as long as you keep your account. Ask us to delete it and it is deleted within 30 days

Mentoring

What: If you become a mentor: your bio, expertise, and industry background. If you request a mentor: your message, the request's status, and the call time once scheduled
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b))
How long we keep it: For as long as you keep your account. Ask us to delete it and it is deleted within 30 days

Scheduling mentor calls

What: A Zoom meeting is created with a title containing the mentee's and mentor's names; we store its join link
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b))
How long we keep it: For as long as you keep your account. Ask us to delete it and it is deleted within 30 days. Zoom keeps its meeting records under its own policy

Text message reminders

What: Your phone number and a reminder the day before a scheduled call, including the other person's name, the time, and the join link
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b)). Only sent if you added a phone number
How long we keep it: We keep only when the reminder was sent. Telnyx keeps delivery records under its own policy

Employer accounts and job posts

What: Company name, contact email, hashed password, whether the business is veteran- or spouse-owned, the jobs you post, and your plan and Stripe IDs
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b))
How long we keep it: For as long as you keep your account. Ask us to delete it and it is deleted within 30 days

Success stories

What: Name, role, service branch, and a quote, published only with the person's agreement
Why we are allowed to: Consent (GDPR Art. 6(1)(a)). You can withdraw it at any time
How long we keep it: Until the person asks us to remove it

Taking payment

What: Your email, what you bought, amount, and Stripe customer and payment IDs. Card details are handled by Stripe and never reach us
Why we are allowed to: Contract: needed to provide the service you signed up for (GDPR Art. 6(1)(b)), and legal obligation: tax and accounting law (gdpr art. 6(1)(c))
How long we keep it: As long as tax and accounting law requires, up to 10 years

Protecting signup, sign-in, and member forms from bots (Vercel BotID)

What: When you sign up, sign in, or send a form as a member or employer: signals from your browser and request that Vercel BotID uses to tell people from automated bots, such as browser and device characteristics and how the request was made. We receive only a verdict: person or bot
Why we are allowed to: Legitimate interests (GDPR Art. 6(1)(f)): keeping the service usable and protecting it from abuse
How long we keep it: We keep nothing. Vercel processes the signals to return the verdict

Running and securing the site

What: IP address, browser and device type, pages requested, and time of request, in server logs
Why we are allowed to: Legitimate interests (GDPR Art. 6(1)(f)): keeping the site working and protecting it from abuse
How long we keep it: No more than 30 days, then deleted automatically by our host

Understanding how the site is used (only if you accept)

What: When each page was viewed, the page address, the referring site, approximate location (country, region, city), browser, operating system, and device type. No cookies. Visits are told apart by a hash of the request that Vercel discards after 24 hours, so the data is not tied to you
Why we are allowed to: Consent (GDPR Art. 6(1)(a)). You can withdraw it at any time
How long we keep it: Vercel keeps it for our plan's reporting window, and may keep it longer. Withdrawing consent stops any further collection

What is public

Mentor profiles are public: anyone can see a mentor's name, military affiliation, bio, and expertise on the Mentors page. Published job posts and success stories are public too.

Cookies and similar technologies

These are strictly necessary for the site to work, so they do not need your consent:

Sign-in session cookies: Keep you signed in and protect sign-in from forgery. Kept: Until you sign out, or 30 days.
analytics-consent (localStorage): Remembers your analytics choice. Kept: Until you clear it.

Vercel Web Analytics sets no cookies. Its script is loaded only if you choose Accept analytics; until then nothing about your visit is sent to it. You can change your choice at any time with Analytics settings at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not ask.

Who we share it with

We use these service providers (processors). Each may use your data only to provide its service to us, under a data processing agreement:

Vercel: Hosts the site and keeps short-lived server logs. Runs Web Analytics, only if you accept. Checks signup, sign-in, and member forms requests for bots (BotID), returning only a verdict. Location: United States.
Our managed PostgreSQL provider: Stores the account data described above. Location: United States.
Stripe: Takes payments. Card details go to Stripe directly and never reach us. Location: United States.
Zoom: Creates mentor call meetings. Location: United States.
Telnyx: Sends text message reminders. Location: United States.

We do not sell personal information and do not share it for cross-context behavioral advertising. We would disclose data to authorities only where the law requires it.

International transfers

Our providers store or process data in the United States. For transfers of personal data from the European Economic Area, the UK, or Switzerland, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses in the provider's data processing terms.

Your rights

In the European Union, the UK, and Switzerland

Access: get a copy of the personal data we hold about you.
Rectification: have inaccurate data corrected.
Erasure: have your data deleted.
Restriction: ask us to stop using your data while a concern is resolved.
Portability: receive your data in a machine-readable format.
Objection: object to processing based on our legitimate interests.
Withdraw consent at any time, without affecting what was done before.

You can complain to a data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. Elsewhere, contact the authority where you live or work. We would appreciate the chance to put things right first.

In the United States

Depending on your state (including California, Colorado, Connecticut, Virginia, Texas, and others with comprehensive privacy laws), you may have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it, and to opt out of its sale, of targeted advertising, and of profiling. We do none of those three. We will not treat you differently for using any of these rights. You can use an authorized agent, and if we turn down a request you can appeal by replying to our answer.

How to make a request

Email hr@bravehaven.io and say what you would like. To protect your account, we will ask you to confirm the request from the email address on it. We answer within one month (GDPR), or within 45 days for US state privacy law requests, and tell you if a complex request needs longer. Requests are free.

How we protect it

Every connection is encrypted with HTTPS
Every signup, sign-in, and member forms request is checked by Vercel BotID on the server and refused unless confirmed as a person
Passwords are stored only as bcrypt hashes

Children

MilSpouse Elevate is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

Military affiliation is not a special category of data under the GDPR, but we treat it with care: it is shown only where you choose to be visible, as a mentor.

Changes to this policy

When this policy changes, we update this page and its effective date, and email account holders about significant changes.