How does Brave Tools handle GDPR and SMS consent?

Important: you are responsible for compliance

You, as the sender, are the data controller under GDPR. Brave Tools is a data processor that helps you send SMS, but the legal responsibility for consent, lawful basis, and compliance rests with you.

This article is not legal advice. For specific compliance questions, consult a lawyer familiar with GDPR and ePrivacy regulations in your jurisdiction.

Which plan do I need?

The plan you need depends on who you are sending SMS to.

Professional plan (required for marketing SMS to customers)

If you send SMS to customers, prospects, or any external recipients, you need the Professional plan with Bring Your Own Key (BYOK) using your own 46elks account. Only this setup gives you:

• Automatic unsubscribe link in every SMS
• Opt-out tracking per sender
• Exclusion of unsubscribed contacts from future campaigns

These features are legally required for marketing SMS in most jurisdictions under GDPR and ePrivacy rules.

Standard plan (internal use only)

The Standard plan uses Brave Managed SMS, which does not include unsubscribe functionality. This makes it suitable only for:

• Internal notifications to your own employees
• Transactional messages where recipients have already consented (OTPs, order confirmations, delivery updates)
• One-to-one operational communication

Without unsubscribe handling, you cannot meet the legal requirements for marketing SMS.

Your responsibilities as data controller

1. Collect consent before adding contacts. Use explicit opt-in (checkbox, form submission, verbal confirmation) and document it with a timestamp.
2. Only send to consented contacts. Your HubSpot list should contain only people who gave permission to receive SMS from you.
3. Tell contacts what they are subscribing to. Make your privacy policy clear about SMS usage.
4. Respect unsubscribes immediately. On Professional BYOK this is automatic. On Standard you must handle it manually.
5. Honor data deletion requests (right to be forgotten). Remove contacts from your HubSpot lists when requested.
6. Keep a privacy policy explaining how you use contact data.

What Brave Tools does to help

• Consent confirmation: the campaign wizard requires you to confirm you have permission before sending.
• Automatic opt-out handling (Professional BYOK only): unsubscribed contacts are excluded from future campaigns automatically.
• Per-sender opt-out tracking: each sender has its own opt-out list, synced to HubSpot contact properties.
• Data minimization: we only store phone number, message content, and delivery status.
• EU data storage: SMS campaign data is stored in our EU datacenters with industry-standard encryption.

Our recommendation

If you are sending SMS to customers, prospects, or any external audience, use the Professional plan with BYOK. This is the only configuration that supports the unsubscribe handling required for lawful marketing SMS.

If you only need internal notifications or transactional messages to consenting recipients, the Standard plan may be sufficient. But as soon as you start marketing to customers, you need a Professional plan.

Disclaimer

Brave Tools provides the tools to help you comply, but compliance itself is your responsibility. We do not guarantee that using Brave Tools alone makes your SMS campaigns GDPR compliant. You must ensure you have proper consent, a valid, lawful basis, and respect for recipient rights in every campaign you send.