Privacy Policy

We are the controller of the personal data described in this policy. Our identity and address for service are given at the foot of this page, and our contact address for privacy matters is the email address above.

We are a small operation and are not required to appoint a Data Protection Officer. Under Brazilian law (ANPD Resolution CD/ANPD no. 2/2022) a small processing agent may provide a contact channel instead of appointing an encarregado; that channel is the email address above, and messages about data protection are handled through it.

Account data: your name, email address and profile picture, supplied by Google when you sign in with Google, or your email address and a password you choose. We record whether your email is verified, and the dates your account was created and last used.

Brand materials: logos, colour palettes, reference images, brand voice notes, business name, business description, and any website, Instagram handle or other links you provide during setup.

Generated content: the prompts you write, the settings you choose, the images and captions produced for you, and the version history of any post you edit.

Transaction data: your credit balance and a ledger of every grant, purchase and spend, including which model was used and its approximate cost. Payment card details are handled entirely by our payment provider and never reach us; we receive only confirmation of a completed purchase and the identifier needed to credit your account.

Technical data: IP address, browser and device information, and error diagnostics. When you delete your account we retain a record of the deletion, including a normalised form of your email address and the IP address the request came from.

Support data: the content of any message you send us.

Acceptance records: which version of the Terms of Service you accepted and the moment you accepted it. We hold this as evidence of the agreement between us, never to contact you, and it is deleted with the rest of your account.

Marketing preferences: whether you asked to receive product news, tips and promotions, when you made or changed that choice, and where you made it.

To provide the service you asked for — creating your account, storing your brand kit, generating and saving posts, and maintaining your credit balance. Legal basis: performance of a contract with you (UK GDPR art. 6(1)(b); LGPD art. 7, I and V).

To take payment and keep accurate financial records. Legal basis: performance of a contract, and compliance with a legal obligation (UK GDPR art. 6(1)(b) and (c); LGPD art. 7, II and V).

To keep the service secure and prevent abuse — rate limiting, App Check, detecting duplicate welcome grants, and investigating fraud. Legal basis: our legitimate interest in protecting the service and other users, and in preventing fraud (UK GDPR art. 6(1)(f); LGPD art. 7, IX).

To answer your messages and provide support. Legal basis: legitimate interest, or performance of a contract.

To let authorised administrators inspect account details, brand information, posts and credit activity when helping you, investigating faults, or auditing suspected fraud or irregular use. Access is limited to those purposes and recorded. Legal basis: performance of a contract and our legitimate interests in support, security and fraud prevention (UK GDPR art. 6(1)(b) and (f); LGPD art. 7, V and IX).

To send product news, tips and promotions by email only when you choose to receive them. Legal basis: your consent (UK GDPR art. 6(1)(a); LGPD art. 7, I). You can withdraw it at any time in Settings.

To comply with the law, including retaining connection records where required. Legal basis: legal obligation (UK GDPR art. 6(1)(c); LGPD art. 7, II).

To show what was agreed and when, if it is ever questioned. Legal basis: our legitimate interest in being able to evidence the contract, and compliance with a legal obligation (UK GDPR art. 6(1)(f) and (c); LGPD art. 7, II and IX).

We do not sell your personal data or profile you to make decisions that produce legal effects. We use your email for our own promotions only when you opt in.

Your prompts, uploaded images and generated posts are sent to Google's Gemini models for the sole purpose of producing your output. We do not use your content to train, fine-tune or improve any AI model, and we do not license it to anyone for that purpose.

Google processes this content as our service provider under its enterprise terms for the paid Gemini API. Content submitted through the paid API is not used by Google to train its general models. Google may retain data briefly for abuse monitoring and service operation under its own terms.

Google (Google Cloud and Firebase, and the Gemini models): authentication, database, file storage, application hosting, and generation. Google acts as our processor.

The merchant of record for all purchases, our payment provider, is an independent controller of the payment data you give it, under its own privacy notice. It tells us that a purchase completed and which account to credit.

Cloudflare: routing for our support email.

We may also disclose data where we are legally required to, where necessary to establish, exercise or defend legal claims, or to a successor if the business is transferred — in which case this policy continues to apply.

We do not sell personal data, and we do not share it with advertisers or data brokers.

Our providers process data in the United States and other countries outside Brazil and the United Kingdom. Transfers rely on the safeguards those providers offer, principally the European Commission's and the UK's standard contractual clauses and, where applicable, adequacy decisions. Under LGPD art. 33 these transfers are made on the basis of contractual guarantees and the necessity of performing our contract with you.

You may ask us for details of the safeguards that apply.

Each generated image and video is kept in active storage for 12 months from the creation of that particular file, then removed automatically. Google Cloud may retain a deleted copy for up to seven additional days in its restricted recovery system before permanent erasure.

Your account data, credits, captions, prompts, post records, logos, profile picture, reference images and other brand materials are kept until you delete them or delete your account.

When you delete your account we remove your profile, brand kit, generated posts, stored files and wallet from active systems. Google Cloud's same restricted recovery window may retain deleted file copies for up to seven days before permanent erasure.

Two things deliberately survive that deletion. We keep a deletion receipt containing a normalised form of your email address, so that a deleted-and-recreated account cannot claim the free welcome credits a second time. We keep the IP address of the deletion request for six months, as required by Marco Civil da Internet art. 15.

We are being explicit about this because it is unusual: the normalised email in a deletion receipt is currently retained indefinitely. It is held only to compare against future sign-ups, it is never used to contact you, and you may ask us to remove it — which we will do unless we have reasonable grounds to suspect fraud.

Financial records connected to a purchase are kept for as long as tax and accounting law requires.

You have the right to know whether we hold data about you and to receive a copy of it; to have inaccurate data corrected; to have data erased; to have unnecessary or excessive data anonymised, blocked or deleted; to receive your data in a portable form; to object to processing based on legitimate interests; to withdraw consent where processing relies on it; and to information about who we share your data with.

These rights come from LGPD art. 18 if you are in Brazil, and from UK GDPR if you are in the United Kingdom. We apply them to everyone regardless of where you live.

To exercise any of them, email support@brandgeniusai.app. We answer within fifteen days as LGPD art. 19 requires, and within one month where UK GDPR applies. We may ask you to confirm your identity first.

You can download a machine-readable copy of your account, brand kit, posts, captions and credit history, with links to stored images, from Settings → Download my data. You can also request a copy by email.

You can delete your account yourself at any time from Settings, without asking us.

If you are unhappy with how we handle your data you may complain to the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, or to the Information Commissioner's Office (ICO) in the United Kingdom. We would appreciate the chance to put things right first.

We do not use advertising or tracking cookies, and there is no third-party analytics on this site.

We store what the service needs to work: your sign-in session, a cookie remembering your chosen language, your theme preference, and tokens used by Google reCAPTCHA Enterprise and Firebase App Check to confirm requests come from the real application rather than an automated script. These are strictly necessary for the service and to protect it from abuse.

reCAPTCHA Enterprise collects device and behavioural signals for that purpose, subject to Google's privacy policy.

Data is encrypted in transit and at rest by our providers. Access to your brand kit and posts is restricted by database rules to your own account, every request that costs money is authenticated and rate limited, and credits are debited on the server rather than in your browser.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant authority as the law requires.

The service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We will update this page when our processing changes, and the date at the top always reflects the current version. Where a change materially affects your rights we will tell you by email or in the app before it takes effect.

Questions about this policy can be sent to support@brandgeniusai.app.