Privacy Notice

BrandPilot is operated by Philip Phillipou (“BrandPilot”, “we”, “us”). We are the data controller for the personal data described in this notice. You can reach us at support@brandpilotstudio.lovable.app.

1. Data we collect and why

• Account and contact data (name, email address) — to create your account, deliver purchased brand kits and reply to support requests. Legal basis: performance of a contract.
• Brand brief content (business descriptions, keywords, style preferences and generated brand kits) — to produce and store your results. Legal basis: performance of a contract.
• Support messages — to answer your questions. Legal basis: legitimate interests in supporting customers.
• Usage and device data (pages viewed, approximate location, IP address, browser and device identifiers, error logs) — for security, fraud prevention and product improvement. Legal basis: legitimate interests.
• Order records (order reference, product, status) — to give you access to what you bought and meet accounting obligations. Legal basis: contract and legal obligation.

Payment card details are handled by Paddle, not by us. We never see or store your full card number.

2. Who we share data with

• Merchant of Record — Paddle.com Market Ltd handles the sale, payment processing, subscription management, invoicing, tax compliance and refunds.
• Service providers / subprocessors — hosting, database, email, analytics and AI model providers that process your brief content solely to generate results for you.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to defend legal claims.

We do not sell your personal data.

3. International transfers

Some of our providers are located outside the UK/EEA. Where data is transferred internationally we rely on adequacy decisions or Standard Contractual Clauses together with appropriate additional safeguards.

4. Retention

Account and brand kit data is kept while your account is active and for up to 24 months after your last activity. Order and tax records are kept for as long as legally required (typically 6–7 years). After that, data is deleted or irreversibly anonymised.

5. Your rights

Depending on where you live you may have the right to access, rectify, erase, restrict or port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Email us and we will respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority.

6. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls, least-privilege database policies and regular review of our providers.

7. Cookies

We use essential cookies and local storage to keep the app working (session, theme preference) and limited analytics to understand aggregate usage. You can clear or block cookies in your browser settings; essential cookies are required for the app to function.

8. Changes

We will update this notice when our practices change and revise the date above.