Privacy policy.

Brandlism is run by Brandlism (operated from New Jersey, United States). For the personal data in this policy about visitors, account holders and the people who work in a workspace, we are the controller.

When an agency adds its clients’ data (contacts, intake notes, voice memos, payments), the agency is the controller and we process that data for it under our Data Processing Addendum. Questions about this policy go to legal@brandlism.com.

• Account data. Your name, email address, password (stored as a hash by our authentication provider), and the Google profile details if you sign in with Google.
• Workspace data. Workspace name and branding, team members and their roles, client brands, and the settings you choose.
• Client data you add. Client contact details, intake notes, voice memos you record and their transcripts, payment records you log, and data from accounts you connect, such as Google Search Console or Google Business Profile.
• Public web data. What our scans read from public sources about a brand: website pages, search results, AI answers, maps listings, public reviews and public forum posts. Some of it names people, such as a reviewer or a staff member on a website.
• Usage and logs. Which pages you visit and what you do in the app, your browser and device type, your IP address, and error reports. We use these to run and secure the service.
• Free tool runs. The domain you entered, the result, your IP address (to enforce the daily limit) and your email address if you gave one to receive the result.
• Payments. Stripe processes card payments. We receive the customer and subscription references, the plan, the amount and the billing status. We never see or store full card numbers.
• Messages. What you send us by email or through the Founding Partner application form.

If you are in the UK or the European Economic Area, these are our legal bases under the GDPR:

• To provide the service you signed up for (contract): running scans, writing findings and reports, hosting client pages, billing and support.
• To keep the service secure and working (legitimate interests): rate limits, abuse prevention, error reports and fixing problems.
• To improve the product (legitimate interests): understanding which features are used, in aggregate.
• For optional analytics and advertising cookies (consent), which you can refuse or withdraw at any time.
• To answer an application or a message (steps before a contract, or legitimate interests).
• To keep tax and accounting records (legal obligation).

We do not sell personal data, and we do not use your workspace data to train AI models.

Brandlism uses AI models from outside providers to do its work. When a feature runs, the content it needs is sent to the provider handling that task. That can include website content and search results about a brand, your Brand Map, intake notes, and voice memos sent for transcription. Personal data inside that content, such as a name in an intake note, goes with it.

We use these providers through their business APIs. Under their API terms, they do not use API data to train their models by default, and they keep it only for a limited period for abuse monitoring. Which provider handles a task, and where it is located, is listed on our subprocessors page.

We share personal data only with the companies that run parts of the service for us (hosting, database, payments, email, search data and AI models), under contracts that limit them to that work. The current list, with what each one receives and where it is located, is on our subprocessors page.

A client page or report you share can be opened by anyone with its link until you revoke it. We may also disclose data if the law requires it, or to a buyer of the business, who would be bound by this policy.

Brandlism is run from the United States, and most of our providers process data there. One AI provider on the subprocessors list processes data in China. Where the GDPR or UK law applies to a transfer, we rely on the European Commission’s Standard Contractual Clauses (with the UK addendum) or on the provider’s certification under the EU-US Data Privacy Framework.

We keep account and workspace data while the account is open. When an account is deleted, we delete its data from our live systems within 30 days, and backups containing it roll off within a further 35 days.

Invoices and payment records are kept for as long as tax law requires, usually seven years. Free tool runs are kept to enforce limits and to reply if you asked for the result by email. We delete them within 30 days if you ask. Aggregated statistics that identify no one may be kept longer.

You can see, correct, export or delete your data. Most of it you can do yourself from Settings → Your data: export downloads a copy of your workspace, and delete removes the account under the retention rule above. For anything else, email legal@brandlism.com from the address on your account. We reply within 30 days.

Depending on where you live you may also object to or restrict some processing, withdraw consent, and complain to your data protection authority. If you are a client of an agency that uses Brandlism, send your request to the agency. We will help it answer.

Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect and why, to delete it, to correct it, and not to be treated differently for using these rights. The categories we collect are the ones listed under “What we collect”, for the purposes listed under “Why we use it”.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Advertising cookies load only after you accept them, and we honour the Global Privacy Control signal as a refusal. To make a request, email legal@brandlism.com. We will verify it against the email address on the account.

Essential. Sign-in cookies keep you logged in, and a stored choice remembers your cookie decision. Vercel Web Analytics and Speed Insights measure page views and page speed without cookies and without identifying you. These run without asking.

Optional. Depending on how this site is configured, it may also use Google Analytics or Google Tag Manager, Hotjar, Crisp chat, and advertising pixels from Meta, LinkedIn and X. None of these load until you choose Accept on the cookie banner. If none is configured, you will not see a banner at all. Plausible (cookieless page counts) and Sentry (error reports) may also run without cookies.

None of the optional tools load inside the signed-in application or on client pages. To change your choice, clear this site’s stored data in your browser and the banner will ask again.

Data is encrypted in transit and at rest by our infrastructure providers. Workspaces are separated by row-level access rules in the database, connected-account tokens are sealed before storage, and staff access is limited to what support requires. No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay. Our security page has more detail. Report a vulnerability to security@brandlism.com.

Brandlism is a business tool for adults. It is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, email legal@brandlism.com and we will delete it.

We will update this policy when what we do with data changes, and change the date at the top. For a material change we will email account owners before it takes effect.