Privacy Policy

1. Overview

Brrand, Inc. (“Brrand,” “we,” “us,” or “our”) provides software that turns a product or company link into an editable marketing strategy and then generates social media posts you can schedule and publish to platforms such as Facebook, Instagram, TikTok, and X. This Privacy Policy explains what personal data we collect, how we use and share it, and the rights you have over it. It applies to our website, applications, and related services (collectively, the “Services”).

This policy is written to meet our obligations under the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA), and comparable laws. If you are in the EU/UK, the “controller” of your personal data is Brrand, Inc.

2. Data we collect

Information you provide

• Account details — your name, email address, and the authentication identifier we receive when you sign in with Google.
• Brand and product information — the website links you submit and the content and imagery we retrieve from those pages, plus any brand names, descriptions, colors, logos, and settings you add.
• Campaign content — the strategies, prompts, captions, schedules, and generated images and videos created in your account.
• Social account connections — when you connect Facebook, Instagram, TikTok, or X, we store the OAuth access tokens and basic profile information (such as account name, ID, and avatar) needed to publish on your behalf.
• Billing information — payments are processed by our payment partner (PayPal). We receive limited transaction details (such as confirmation and amount); we do not receive or store full payment card numbers.
• Support communications — messages you send us and the contents of the in-app assistant.

Information collected automatically

• Usage and device data — IP address, browser and device type, pages viewed, and actions taken, collected through server logs.
• Cookies and local storage — a strictly necessary session cookie and a session token kept in your browser's local storage to keep you signed in. See our Cookie Policy for details.

3. How we use data

• Provide, operate, and secure the Services and your account.
• Generate marketing strategies, captions, images, and video. To do this we send the relevant content (your links, brand details, and prompts) to AI providers, including Google's Vertex AI (Gemini, Imagen, and Veo models), for processing.
• Schedule and publish content to the social platforms you connect.
• Process payments and manage credits and subscriptions.
• Provide support and respond to your requests.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.

4. Legal bases (EU/UK)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Services you sign up for.
• Consent — to connect your social accounts and publish on your behalf, and where otherwise required. You may withdraw consent at any time.
• Legitimate interests — to secure, improve, and support the Services, balanced against your rights.
• Legal obligation — to meet accounting, tax, and other legal duties.

5. How we share data

We do not sell your personal data. We share it only as described here:

• Social platforms you connect — Facebook/Instagram (Meta), TikTok, and X receive the content you choose to publish and the data needed to publish it. Their own privacy policies govern that data once it reaches them.
• Service providers (sub-processors) — including Google Cloud (hosting, storage, task queues, and Vertex AI generation), our payment processor (PayPal), and a logo/brand-asset lookup provider. They process data only on our instructions.
• Legal and safety — when required by law, to enforce our terms, or to protect the rights, property, or safety of users and the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. International transfers

We may process and store data in the United States and other countries. Where we transfer personal data out of the EU/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Data retention

We keep personal data for as long as your account is active and as needed to provide the Services, then delete or anonymize it within a reasonable period unless a longer retention is required for legal, tax, or security reasons. You can delete your content or your account at any time — see Data Deletion.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data; to restrict or object to certain processing; to withdraw consent; and to opt out of the “sale” or “sharing” of personal data. We do not sell or share personal data for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.

To exercise any right, email malachi@madgic.ai or use the tools in your account settings. To delete your data, see Data Deletion. EU/UK users may also lodge a complaint with their local data protection authority.

9. Security

We use technical and organizational measures — including encryption in transit, access controls, and expiring signed URLs for stored media — to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and regulators of breaches where required.

10. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

11. Changes

We may update this policy from time to time. We will post the new version here and update the “Last updated” date, and provide additional notice for material changes.

12. Contact

Questions about this policy or your data? Email malachi@madgic.ai.