Privacy Policy

Information you provide directly

• Account details such as name, email address, and login credentials.
• Brand and product information, including URLs, product details, descriptions, logos, images, and related assets.
• Support and communication records when you contact us, submit feedback, or respond to outreach.
• Preference data such as language, theme, and in-product settings.

Collected regardless of your cookie choice

• Log data including IP address, access times, referrers, and request metadata, recorded by our servers and hosting providers to deliver and secure the Services.
• Basic device and browser information derived from your request, such as operating system, browser version, and device type.
• On our public website, pages visited and actions taken, sent to our analytics provider without cookies and without any identifier that persists between visits. Inside the BrandyBee application, this is collected only if you accept analytics cookies.
• Security records of sign-ins to the web application, including a one-way hash of your IP address and browser, your approximate city, and a device description, kept so that unauthorized access to your account can be detected.
• Error diagnostics when something goes wrong, including the page involved, a technical trace, and a short record of the actions and requests immediately before the error, used solely to diagnose and fix faults. Performance diagnostics are collected only if you accept analytics cookies.
• If you arrive through a campaign or referral link, the source, medium, and campaign name, recorded once when you create your account.

Collected only if you accept analytics cookies

• Usage patterns, clicked actions, and session activity linked together across your visits.
• Device details such as language and screen size.
• Session recordings and interaction heatmaps, used to diagnose usability problems.

Information from connected services

If you connect third-party services such as Google, Shopify, or WooCommerce, we may receive the information you authorize through those services.

Data we receive from Meta platforms

If you connect a Facebook Page, Instagram Business account, or Meta ad account, we receive only the data you authorize Meta to share with BrandyBee.

We do not receive your Facebook password, private message history, friends list, or content from accounts you have not connected to BrandyBee.

Separately from any account you connect, BrandyBee also retrieves publicly available advertising data from Meta’s public Ad Library (such as ad text, advertiser Page names, run dates, and reach ranges) to provide competitor-advertising insights. This is public archive data about advertisers; it is not personal data about you or your store’s visitors.

• Facebook user ID, name, profile photo, and email address, when you connect your Meta account through Facebook Login for Business or otherwise authorize account access.
• The list of Facebook Pages you manage or have a role on, plus Page access tokens and token expiry data for the permissions you grant.
• Instagram Business Account ID, username, and public profile metadata.
• Content you create, draft, schedule, or publish through BrandyBee, including text, captions, images, videos, and related media.
• Post-level analytics such as impressions, reach, likes, comments, saves, engagement, and similar performance metrics where you authorize access.
• Meta ad account IDs, campaign data, ad performance metrics, and aggregate audience-level data where you connect a Meta ad account.

Data we receive from Google (Search Console, Analytics, Merchant Center)

If you connect your Google account, we receive only the data you authorize on Google’s consent screen, and only for the properties and accounts you explicitly select in BrandyBee.

BrandyBee only reads this data. We never create, modify, or delete your products, settings, or any content in your Google Search Console, Google Analytics, or Google Merchant Center accounts.

BrandyBee’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• Google Search Console: search queries, impressions, clicks, and positions for the verified property you select.
• Google Analytics: aggregated traffic and behavior metrics (sessions, engagement, conversions, e-commerce revenue) for the GA4 property you select. We do not receive personal profiles of your visitors.
• Google Merchant Center: your product feed’s statuses and data-quality issues (approvals, disapprovals, item-level issues) and account-level issues for the account you select.
• We use this data solely to provide BrandyBee features to you: grounding your product scores, reporting your search and traffic performance, and diagnosing your Shopping feed health. We do not use it for advertising, we do not sell it, and no humans read it except with your permission, for security purposes, or as required by law.
• We do not use Google user data to develop or train machine-learning or AI models.
• Your Google OAuth token is stored encrypted and is never exposed to your browser or to other users.
• You can disconnect Google at any time in Settings: disconnecting immediately deletes the stored token and all data BrandyBee synced from Google. Deleting your BrandyBee account has the same effect, and you can additionally revoke BrandyBee’s access at myaccount.google.com/permissions.

Meta integration purposes

• Facebook user ID, name, and email: to authenticate you and connect the correct BrandyBee account.
• Facebook Page lists and Page access tokens: to publish, schedule, and manage content you author in BrandyBee on the Facebook Pages you connect.
• Instagram Business Account information: to enable scheduled or one-click publishing to your connected Instagram account.
• Content you author in BrandyBee: to draft, store, schedule, publish, and show your publishing history back to you.
• Post performance data: to report performance and surface optimization recommendations to you.
• Ad account and campaign data: to help you measure campaign performance and receive recommendations for your connected ad accounts.

Legal bases

Depending on the context, we process personal data to perform our contract with you, to comply with legal obligations, based on our legitimate interests in operating, securing, and improving the Services, or based on your consent where required, such as for optional analytics or certain communications.

Service providers

We work with infrastructure, hosting, analytics, payment, email, security, and AI service providers to operate BrandyBee. These providers process data only within the scope required to support the Services.

The categories below describe the kinds of providers we rely on and are not an exhaustive list of every individual company. Where we name a provider, it is because it handles a significant part of that category; other providers may be used within the same category, and the providers in a category can change over time.

A current list of the sub-processors we use, including their locations, is available on request at support@brandybee.ai.

• Supabase: database, authentication, and edge functions, with EU hosting where configured.
• Amazon Web Services (AWS): backend hosting, storage, content delivery, and automated image moderation, including EU regions and other regions where required to provide the Services.
• Cloud hosting and workflow-automation providers: development, automation, and internal infrastructure where used.
• OpenAI, Google, Microsoft Azure, and similar AI model providers: AI-assisted text, image, caption, and recommendation generation.
• Google: where you connect a Google account, we use Google sign-in, Search Console, Analytics, and Merchant Center to read the data you authorize; we also use Google services for web fonts, analytics measurement, and domain checks.
• Stripe: payment processing and billing administration.
• Email delivery providers: transactional, account, and permitted marketing email.
• Sentry, Microsoft Clarity, and product-analytics providers: diagnostics, error reporting, and usage analytics, with optional analytics loaded only where consent is required and obtained.
• Advertising platforms (including Meta): measuring how our ads perform and reaching relevant audiences. These load only after you opt in to advertising cookies, and never on the essential-only setting.
• Search, keyword, and market-data providers: keyword volume, ranking, and competitor visibility data used to score and optimize your pages.
• Web content extraction providers: retrieving publicly available web page content for brand, product, and competitor analysis.
• Product-review platforms: where you connect one, we read your existing customer reviews so your pages can display real reviews rather than invented ones.
• Security and anti-abuse providers: bot protection, and checks on whether an email domain is disposable, to protect signup and account deletion.
• Messaging and operational-alerting providers: internal notifications about support requests and system events.

Connected platforms

If you choose to connect third-party platforms, data may be exchanged with those platforms only to enable the requested functionality.

Legal and business reasons

We may disclose information where required by law, to protect rights and security, or in connection with a merger, acquisition, or business transfer.

Requests from governments and law enforcement

When a government body, court, or law enforcement agency asks us to disclose user data, we follow a written internal policy. We verify the identity and authority of the requester, review the legal basis and validity of the request, and object to or seek to narrow requests that are overbroad or legally deficient. Where we do disclose, we disclose only the specific records covered by a valid request — never wholesale exports, and never credentials or access tokens.

Unless we are legally barred from doing so or there is a genuine emergency involving risk to life, we notify the affected user before disclosure and give them an opportunity to object. We keep a record of every request we receive and how we handled it, including requests we refused. Where a request concerns data we received from a connected platform such as Meta, we also consider whether the requester should be directed to that platform instead.