Privacy notice

BrandMind is operated by the BrandMind team ([email protected]). For any privacy question, use that email and reference this notice.

This notice explains what personal data BrandMind collects, how we use it, and what rights you have under the EU General Data Protection Regulation (GDPR) and the EU AI Act (Regulation 2024/1689).

From Google when you sign in: your email address, display name, profile picture, and a stable opaque identifier (the Google “sub” claim). We never see or store your Google password.

What you give us: the URL of the company you ask us to scan, the messages you send to the chat panel, the documents and links you reference via ‘@-mention’, and any drafts you generate.

What we produce for you: AI-generated summaries, competitor analyses, marketing strategies, and channel-specific post drafts. We treat these as your data.

Service usage: request timestamps, feature usage counters, error reports, and AI-call cost + token counts so you can track your spend.

We use your data only to operate BrandMind: run scans, generate drafts, surface insights, bill you, prevent abuse, and respond to support requests. We do not sell your data. We do not show you ads. We do not use your data to train third-party AI models.

Your scan + chat data is sent to our LLM provider (Anthropic, see § 5) only for the purpose of generating output for you. Anthropic processes inputs and outputs per their privacy policy and does not train models on commercial-API traffic.

• Contract: to provide BrandMind after you sign up (Art. 6(1)(b)).
• Legitimate interest: to keep the service secure, debug issues, and prevent fraud (Art. 6(1)(f)).
• Legal obligation: for billing records we have to keep for tax law (Art. 6(1)(c)).

BrandMind uses the following sub-processors. Each has a Data Processing Agreement (DPA) with us; we link the current list:

• Hetzner Online GmbH (Germany, EU) — hosts the entire application and our self-managed PostgreSQL database; this is where your data is stored
• Anthropic (LLM inference)
• Google OAuth (sign-in only)
• Firecrawl (web scraping for scans)
• Mollie (subscription billing)
• Google PageSpeed Insights (SEO audit data)
• Clearbit / HubSpot (company-logo lookup, from your browser)
• Sentry (backend error reporting) — active only when error reporting is enabled; request headers and secrets are scrubbed before transmission

For the current authoritative list with DPA links + data categories, see SUBPROCESSORS.md. We update that file when sub-processors change.

BrandMind uses only essential cookies:

• Session cookie (NextAuth) — keeps you signed in. SameSite=Strict, Secure, HttpOnly.
• CSRF token — prevents cross-site request forgery on sign-in.
• OAuth callback cookies (set temporarily during sign-in only; deleted after the handshake completes).

We do not use analytics cookies, tracking pixels, or advertising cookies. The cookie banner at the bottom of the page reflects this — there is nothing to opt out of beyond signing out.

Operational logs and AI-call records are retained for 90 days, then automatically deleted via a daily sweep (see audit F-119).

Your account data (companies, scans, documents, chat threads) is retained for as long as your account is active. When you delete your account (see § 8), all of it is purged within minutes.

You can, at any time:

• Access + export your data — GET /api/me/export returns a ZIP with every per-tenant table you can see (Art. 15 + 20).
• Delete your account — DELETE /api/me/account hard-deletes your company, all scans, all chats, and cancels your Mollie subscription if active. Mirrored in the settings UI (Art. 17 — right to be forgotten).
• Sign out everywhere — POST /api/me/revoke-all-sessions invalidates every session token currently in the wild for your account.
• Object, restrict, or rectify — email [email protected] and we will respond within 30 days (Art. 21 + 18 + 16).
• Complain to a supervisory authority — you can lodge a complaint with your national data- protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

BrandMind is classified as minimal-risk AI under the EU AI Act (Regulation 2024/1689). The chat panel and channel-agent drafts are AI-generated — every assistant reply is labelled with the persona name, and every draft is shown to you for approval before it can be posted. BrandMind does not post on your behalf without your explicit click.

For our full risk-tier classification + AI-system register seed, see AI_ACT_RISK_TIER.md.

Your data is stored in the EU (Hetzner, Germany — see § 5). Some sub-processors that process data on our behalf are based outside the EU — notably Anthropic (LLM inference), Firecrawl (scraping), and Google (sign-in, PageSpeed). Those transfers rely on the EU Standard Contractual Clauses (SCCs) where applicable.

Operators can set REQUIRED_REGION on a deployment to assert where processing happens. The API refuses to start if any sub-processor in § 5 resolves outside the named region — the database and error reporting, and also the LLM, scraping, SEO and billing vendors (audit F-121 / RA-4).

Vendors like Anthropic and Firecrawl are US companies with no regional endpoint to switch to, so an operator who needs them must acknowledge that transfer explicitly (ALLOW_OUT_OF_REGION_PROCESSORS), and the acknowledgement is logged on every boot. The lawful basis for those transfers is the Standard Contractual Clauses recorded in SUBPROCESSORS.md. For LLM inference specifically, the deployment can instead be pointed at Anthropic’s EU endpoint, which keeps the largest of these flows inside the EU.

When we materially change this notice, we update the ‘Last updated’ date at the top and notify signed-in users in-app on next sign-in. Older versions are kept in our git history (public commit log).

• 2026-07-14 — Corrected the sub-processor list: your data is stored on our self-managed Hetzner server in Germany (EU), not on Neon. Neon was never adopted and never held any customer data. Added Clearbit and Sentry to the list, and clarified in § 10 exactly which endpoints the boot-time region check covers.
• 2026-06-02 — Initial publication. Covers GDPR Art. 13 + 14 + 15–22, sub-processor list, retention, cookie policy, EU AI Act Art. 50 transparency.