Privacy Policy

1. Overview

This Privacy Policy explains what information BrandFlow (the "Service") collects, how it's used, and the choices you have. It applies to your account information, the workspaces you belong to, and your use of the Service generally.

2. Information We Collect

• Account information — your name, email address, and password (stored hashed, never in plain text).
• Workspace and content data — the posts, media, ideas, and other content you create within the Service, and metadata about your workspaces and team.
• Connected account data — when you connect a social media account, we store the access credentials needed to act on it (encrypted at rest) along with basic profile information (like the account name and avatar) so you can identify it within the Service.
• Usage and activity data — actions taken within the Service (such as logins, invitations sent, or social accounts connected) are recorded in an internal activity log, primarily for account security and support purposes.
• Technical data — IP address, browser/device information, and similar data collected automatically as part of normal web request handling (for example, for security logging).

3. How We Use Information

• To provide and operate the Service — including publishing your scheduled content to the platforms you've connected;
• To authenticate you and secure your account, including detecting suspicious activity;
• To provide customer support and respond to requests you send us;
• To generate the analytics and reporting features within the Service, using your own workspace's data;
• To operate optional features you choose to use, such as AI-assisted content generation or referral tracking.

We do not sell your personal information, and we don't use third-party advertising or analytics trackers on the application itself.

4. How We Share Information

We share information with the third-party social media platforms and AI providers you explicitly connect or configure, solely to perform the actions you request (for example, publishing a post to a connected account, or generating a caption through a configured AI provider). We may also share information where required by law, or with service providers who help us operate the Service (such as hosting or email delivery), under obligations to protect it. We don't share your content or account data with other tenants or workspaces you're not a member of.

5. Cookies

We use a session cookie to keep you signed in, and a small amount of local browser storage for preferences like dark mode. See our Cookie Policy for details.

6. Data Retention

We retain your account and workspace data for as long as your account is active. If you disconnect a social media account, its access credentials are deleted immediately; the historical record that it was once connected may be retained for your own reporting purposes. If you close your account, we'll delete or anonymize personal data within a reasonable period, except where we're required to retain it for legal or legitimate business reasons.

7. Security

We use industry-standard measures to protect your data, including encryption of sensitive credentials (like connected-account access tokens) at rest, hashed passwords, and role-based access controls that keep one workspace's data isolated from another's. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

8. Your Rights

Depending on where you're located, you may have rights to access, correct, export, or delete your personal information. You can update most account information directly from your profile settings, or contact us using the details below for anything you can't do yourself.

9. Children's Privacy

The Service is intended for business use and is not directed at children. We don't knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.