Privacy Policy — BrandForge OS

1. The short version

Desktop campaigns, client profiles and memory are stored locally. Cloud is a separate hosted product that stores account and workspace data on servers. Neither product sells your campaign content. Connected features and hosting are described below; local-first is not a blanket no-network claim.

2. What happens when you connect an AI provider

Connected providers receive prompts and selected brand context or relevant memory, not necessarily only your latest sentence. Optional search, image generation, remote model endpoints and consented update checks may also make network requests. The Desktop dashboard tracks requests-library calls only; other transports, browser traffic, dependency setup and other processes are not included. A zero count is not proof of zero network activity. After explicit setup, Offline templates can run with networking disabled. Provider retention and processing depend on the provider you select.

2b. Cloud accounts

Cloud stores your authentication/profile information, optional encrypted provider keys, campaign briefs/content/assets, brand profiles, text revisions, usage and any optional feedback or delivery details. Authentication is handled by Supabase; plaintext passwords are not stored by the app. Sessions use browser-held bearer tokens. The Billing page offers paged account export and deletion. Deletion first reconciles and cancels recurring Cloud subscriptions immediately; if cancellation cannot be confirmed, it retains the identity and reports an error so you can retry or contact support. Campaign/key data is separate from minimal financial records required for billing, fulfillment, disputes or law. Deleting content does not refund completed compute usage.

3. Payments

Paddle processes payments; the app does not handle raw card details. We keep transaction/customer references, order email, purchased edition, delivery status and adjustment/subscription records for fulfillment, recovery, reconciliation and legally necessary retention. Desktop orders do not require a Cloud account. Download and portal tokens must not be shared publicly. A signed download can expire or be disabled after a refund/dispute, but cannot erase a file already downloaded.

3b. Waitlist

If you join the pre-launch waitlist, the email address and selected tier you submit are sent to our own waitlist endpoint (/api/waitlist) and stored directly in our Supabase database so we can contact you about launch availability and related product updates. We do not forward this through a third-party form-relay service. Do not submit sensitive information in the form. To opt out or request deletion, email support@brandforge-os.com.

4. Analytics

The app does not include advertising pixels. When optional first-party usage counts are offered, they remain off until you opt in. They send only defined feature-event names, a random browser identifier and random event IDs. The server stores a daily rotating keyed pseudonym, event name and timestamp, not the raw identifier, campaign content, name, email or provider key. No cross-domain/account linkage is performed. Unchecking stops future events and removes the browser preference/identifier; it does not retract prior aggregates. Event rows are scheduled for deletion after 30 days, subject to successful maintenance; operational logs and backups follow their separate retention. Client-reported payment/export events are not proof of settlement or usable output. Hosting and service providers may retain operational or security logs. The free text checker processes your draft in your browser; loading the website still uses the network. We will update this policy and seek consent where required if data processing changes.

5. Your rights

For Desktop, you control the locally stored files and can export or delete them — the output/, memory/ and agency_clients/ folders are plain files. For order-related data we hold, email support@brandforge-os.com to request access, correction, export or deletion. Cloud accounts can self-serve: the Billing page provides paged account export and account deletion (which first cancels verified recurring subscriptions).

5b. Regional rights (GDPR / UK GDPR / CCPA-style)

Where applicable law grants them, you may request: access to your personal data, rectification, erasure, restriction of processing, data portability (the Cloud account export is designed for this), objection to processing, and the right to lodge a complaint with your local supervisory authority. We process account and workspace data on the basis of contract performance (providing the service you signed up for), consent (optional analytics counts, optional image-provider sharing — each with an explicit opt-in), and legitimate interests (security, fraud prevention, service operation). California-style requests (know, delete, opt out of sale/sharing) are handled the same way: email us. We do not sell personal data, and we do not share it for cross-context behavioral advertising. Requests are answered within 30 days; identity verification may be required. No automated decision-making with legal or similarly significant effects is performed.

5c. Sub-processors and service providers

Cloud and website operations use the following providers. Desktop in offline mode contacts none of them.

• Supabase — accounts, database and file storage (Cloud).
• Vercel — hosting of this website and the Cloud API; operational logs.
• Groq and Google (Gemini) — text generation when a connected provider is selected; they receive your brief text. Google (Gemini imagery), OpenAI or xAI — image generation only when AI artwork is operator-enabled and you explicitly opt in per brief, including consent to share a supplied photo/logo.
• Paddle — merchant of record for payments (card details never touch our servers); retains transaction data as legally required.
• Resend — transactional email (order delivery, account messages).
• Cloudflare Turnstile — optional signup bot protection (only when operator-enabled).
• Twilio or 360dialog — optional WhatsApp delivery reminders (only when operator-enabled and you request a send).
• Upstash — optional rate-limit storage (hashed keys only, no raw IPs or emails).

Provider retention of prompts/images depends on the selected provider's own terms. This list is updated as processors change.

5d. Retention

Cloud workspace data is retained while your account exists and removed on account deletion, except: (a) minimal billing/transaction records kept as long as tax and commercial law requires (typically up to 10 years, via Paddle and our order tables); (b) security/abuse records such as hashed rate-limit counters (short-lived, days) and webhook idempotency records; (c) optional usage-metric rows (deleted after 30 days). Orphaned private asset bundles are cleaned up by scheduled maintenance. Waitlist entries are kept until you opt out or the launch communication completes; email support@brandforge-os.com for deletion.

5e. Age

The products are intended for business users aged 18 or older (or the age of digital consent in your country, where higher for contracts). We do not knowingly collect data from children; if you believe a child provided data, contact us for deletion.

6. Contact and controller

Data controller and operator: BrandForge OS, operated by Nabeel Ali (Karachi, Pakistan) — support@brandforge-os.com. For EU/UK data-subject requests, use the same address; include enough detail to locate your account (email used at signup) but never API keys or passwords.