Privacy Policy

This Privacy Policy (hereinafter referred to as "this Policy") describes how BrandPal (hereinafter referred to as "we", "us", or "our") collects, uses, discloses, and protects your personal data (as defined below) when you use our website and other online products and services (collectively, "our Services"), and how we may change this Privacy Policy from time to time. If we make changes, we will notify you by posting the revised Policy on our website. We encourage you to review this Policy whenever you access our Services or otherwise interact with us to stay informed about our information practices and the choices available to you.

Our Services

We provide e-commerce growth and related services, which can be accessed via https://agents.brandpal.ai. Search and content generation services, as well as the company website, are included in the Services.

Information Collection

Information We Collect Automatically

When you visit our website, certain information may be collected automatically as a result of your use of our Services or from the service infrastructure, including how and when you use our Services, the prompts you enter into our Services, and the generated outputs.

We use tracking technologies (such as Cookies, as defined below) to track activity on our Services and store certain information. This information is used to improve and analyze our Services. A "Cookie" is a small file placed on your device. You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept Cookies, you may not be able to use some parts of our Services. Unless you have adjusted your browser setting so that it will refuse Cookies, our Services may use Cookies.

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on your personal computer or mobile device when you go offline, while Session Cookies are deleted as soon as you close your web browser.

We may use both Session and Persistent Cookies for the purposes set forth below:

• Necessary / Essential Cookies
  • Type: Session Cookies
  • Administered by: BrandPal
  • Purpose: These cookies are essential to provide you with services available through our website and to enable you to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that you have asked for cannot be provided, and we only use these Cookies to provide you with those services.
• Cookie Policy / Notice Acceptance Cookies
  • Type: Persistent Cookies
  • Administered by: Us
  • Purpose: These Cookies identify if users have accepted the use of cookies on our website.
• Functionality Cookies
  • Type: Persistent Cookies
  • Administered by: Us
  • Purpose: These Cookies allow us to remember choices you make when you use our website, such as remembering your login details or language preference. The purpose of these Cookies is to provide you with a more personal experience and to avoid you having to re-enter your preferences every time you use our website.
• Tracking and Performance Cookies
  • Type: Persistent Cookies
  • Administered by: Us / Third Parties
  • Purpose: These Cookies are used to track information about traffic to our website and how the Services are used. We may also use these Cookies to test new pages, features, or new functionality of the website to see how our users react to them.

You can also manage Cookies in your browser (although browsers for mobile devices may not offer this visibility). Some of these technologies can be managed in your device settings or application settings.

Most browsers allow you to manage how cookies are set and used as you browse, and to clear cookies and browsing data. Additionally, your browser may have settings allowing you to manage cookies on a site-by-site basis. For example, Google Chrome's settings at chrome://settings/cookies allow you to delete existing cookies, allow or block all cookies, and set cookie preferences for websites. Google Chrome also features Incognito mode, which deletes your browsing history and clears cookies from incognito windows on your device after you close all incognito windows.

Global Opt-Out Mechanism

You may also choose to install a Global Opt-Out Mechanism on your browser. Global Opt-Out Mechanisms are browser signals indicating a user's intent to opt out of certain uses of their personal data on the websites they visit. If our website recognizes that your browser is expressing a Global Opt-Out Mechanism, we will treat it as a request to opt out of sharing your personal data and to limit the use of your sensitive personal data collected through our Services.

In some cases, we may not be able to link your browser's Global Opt-Out Mechanism with other personal data we have collected from you through other means. To express your intent to opt out of our processing of personal data that may be collected outside of our Services, please refer to the sections below titled "Privacy Rights of Residents of Specific States" and "Privacy Rights of Residents of the EU, UK, Canada, and Other Countries/Regions."

Do Not Track

Please note that we do not alter our Services' data collection and use practices when we see a "Do Not Track" signal from your browser.

Information You Provide Directly To Us

We collect information you provide directly to us, which may include personal data (as defined below). If you create an account, submit content through our Services, request customer support, submit a payment for our paid services, or otherwise communicate with us on our website, we will collect certain information from you, including your username, email address, and any other information you choose to provide.

"Personal Data" means any information relating to an identified or identifiable individual, including, but not limited to, a personal email address.

Information We Do Not Collect

Except for third-party platform data that you explicitly authorize us to access (such as Google account data used to send email on your behalf), we do not collect any of your sensitive personal data, including details about your racial or ethnic origin, political opinions, religious beliefs, or health status.

Email Services

Google/Gmail API User Data Policy (Information Collected via Google OAuth)

When you choose to connect your Google account to our Services via Google OAuth authorization, we access and process a strictly limited set of Google data, based on your explicit authorization. The permissions we request and their specific use are as follows:

• Basic Account Information (openid, .../auth/userinfo.email, .../auth/userinfo.profile): We access your Google account's primary email address and basic public profile solely to create or link your BrandPal account, to provide Google Sign-In, and to identify which of your mailboxes is connected to BrandPal.
• Sending Email on Your Behalf (.../auth/gmail.send): We use this permission solely to send the influencer outreach emails that you have composed and approved within BrandPal, from your own connected Gmail address. Every send is initiated by an outreach campaign that you configured; we do not send anything on your behalf that you have not approved. A per-account daily sending cap applies.
• What we do NOT request: We do not request, and therefore do not hold, any permission to read, modify, label, archive, or delete your Gmail messages, or to read their metadata. BrandPal has no technical ability to access your inbox, your mail settings, your drafts, or any message that was not composed by you inside BrandPal.

How We Protect Your Google User Data

We apply the following technical and organizational measures to Google user data and to the OAuth credentials that grant access to it:

Encryption in transit. All traffic between your browser and our Services, between our own services, and between our services and the Google APIs is encrypted using TLS 1.2 or above. We never transmit OAuth tokens or email content over an unencrypted channel.

Encryption at rest. Your OAuth refresh token and access token are encrypted using AES before being written to our database. They are never written to application logs, error reports, analytics tools, or support tickets. The underlying database volumes are additionally encrypted at rest by our cloud provider.

Key management. Encryption keys and OAuth client secrets are held in a managed secret store with restricted access. They are not committed to source code, not embedded in client-side code, and are rotated when a compromise is suspected.

Access control. Each set of OAuth credentials is bound to the BrandPal account that authorized it. Our API authenticates every request and will only send email using credentials belonging to the authenticated account owner; one account cannot use, view, or act upon another account's connected mailbox.

Least privilege by design. We request only gmail.send, the narrowest Gmail permission that allows sending. Because we hold no read permission of any kind, a compromise of our systems cannot expose your mailbox — there is no read path to expose.

Data minimization. For the outreach feature we store only: your connected Gmail address, the encrypted OAuth tokens, the emails you authored inside BrandPal, and per-recipient send status and timestamps. We do not store, copy, or index any message from your mailbox, because we cannot read your mailbox.

Internal access limits. Access to production systems holding Google user data is limited to a small number of authorized engineers on a need-to-know basis, protected by individual accounts and multi-factor authentication, and is logged.

Monitoring and incident response. Access to production data stores is logged and monitored. If we become aware of a security incident affecting your Google data, we will investigate, take remedial action, and notify affected users and the relevant authorities as required by applicable law.

Abuse controls. A per-account daily sending cap is enforced to limit the impact of any account compromise or misuse.

Your controls. You can disconnect a Gmail account at any time from the BrandPal Plugins page, or revoke BrandPal's access directly from your Google Account permissions page. On disconnection we immediately call Google's token revocation endpoint and delete the stored credentials from our systems.

Use of Information

We may use personal data for the following purposes:

• To provide and maintain our Services, including monitoring the usage of our Services.
• To manage your account as a user of the Services: The personal data you provide enables you to access different functionalities of the Services available to you as a registered user, or is used for verification purposes.
• To contact you: To contact you by email regarding updates or informative communications related to functionalities, products, or contracted services, including security updates, when necessary or reasonable for their implementation.
• To provide you with news and general information about the Services.
• To manage your requests: To attend to and manage your requests to us.
• For business transfers: To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our Services users is among the assets transferred.
• For other purposes: We may use your information for other purposes, such as data analysis, identifying usage trends, and evaluating and improving our Services, products, marketing, and your experience.

Data received from Google APIs is excluded from the general purposes above and is used only as described in the "Google/Gmail API User Data Policy" section.

Sharing of Information

Except as set forth below or otherwise stated in this Policy, we do not sell, trade, or otherwise share personal data with third parties. By using the Services, you consent to the sharing of your personal data as described below:

• With Service Providers: We may share data about your use of the Services, such as online identifiers or your actions on our website, with our IT vendors (e.g., Echotik API, TikTok Shop API) and website hosts to monitor and analyze the use of our Services and maintain website security. For more information about our use of Cookies, please refer to the "Information We Collect Automatically" section above. We may also provide any personal data you choose to include in your prompts as input to our AI-driven features, sharing it with third-party AI service providers (including Anthropic) solely to generate responses to your requests. We do not actively collect or analyze this personal data, nor do we send it to these third parties unless you voluntarily include it in your prompts. (Special Clarification: Any data obtained via the Google/Gmail APIs is strictly excluded from sharing with AI service providers under this clause; please refer to the "Google/Gmail API User Data Policy" section.)
• For Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
• With Your Consent: With your consent, we may disclose your personal data for any other purpose.

We may also disclose personal data if we believe disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements. We will oppose legal requests for personal data of our Services users that we believe are inappropriate. We may also disclose your personal data if we believe in good faith that such action is necessary to:

• Protect and defend the rights or property of the Company.
• Prevent or investigate possible wrongdoing in connection with the Services.
• Protect the personal safety of users of the Services or the public.
• Protect against legal liability or fraud.

Third-Party Services

We may use third-party services to maintain and improve our Services. For example, queries may be transmitted to OpenAI, Anthropic, or Google Gemini to fulfill service requests. We may use Google APIs to provide Google Sign-In and to send email on your behalf.

Our use of raw or derived user data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Any data accessed through Google APIs is used only for the specific purposes outlined in this Privacy Policy. We do not use data received from Google APIs to build, train, test, or enhance any AI or machine learning technology, under any circumstances.

We may use website monitoring tools to collect anonymous usage information. We use this information to improve the quality and relevance of our website for visitors.

AI Processing Services

Our Services utilize third-party AI technologies to provide various functionalities. When you use these features, your inputs may be transmitted to third-party AI service providers for processing. The type of data transmitted depends on the feature you use:

• Text-based Features: Text inputs are transmitted to language model providers.
• Image Features: Your text descriptions and, where applicable, reference images you upload are transmitted to image generation providers.
• Speech and Audio Features: Your voice recordings or text inputs are transmitted to audio processing providers.
• Video Features: Your text descriptions and, where applicable, reference images you upload are transmitted to video generation providers.

Our primary AI service providers include OpenAI, Anthropic, Google, xAI, and ElevenLabs. We may engage other providers who perform the same types of processing described in this section. If we make material changes to the types of data processed or the purposes of processing, we will update this Privacy Policy and notify you accordingly.

For all AI processing mentioned above:

• Only content necessary to provide the requested functionality is transmitted. We do not actively send your personal data to these providers unless you voluntarily include it in your inputs.
• Data received from the Google APIs is never transmitted to any AI service provider.
• These providers process data according to their own privacy policies, which we encourage you to review.
• Some services may be hosted on cloud platforms, such as Microsoft Azure, Amazon Web Services, or Google Cloud Platform.

Links to Other Websites

Our Services may contain links to third-party websites. These links are provided solely for your convenience and do not indicate our endorsement of these websites. We are not responsible for the content of linked third-party websites, nor do we make any representations regarding the privacy practices, content, or accuracy of materials on such third-party websites.

Information Security

The security of your personal data is important to us, but please remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure.

We implement administrative, technical, and physical safeguards designed to protect the personal data we collect from you, including encryption of data in transit and at rest, role-based access control, multi-factor authentication for administrative access, secret management for credentials, and logging and monitoring of access to production data stores. The specific measures applied to data received from the Google APIs are described in the "How We Protect Your Google User Data" section above.

Your data is stored with major cloud infrastructure providers in accordance with their applicable security, data storage, and retention requirements. While we strive to protect personal data, we cannot guarantee its absolute security, and we do not make independent representations or warranties regarding the policies, practices, or procedures of any third party.

Data Retention

We will store personal data associated with your account for as long as your account remains active or as needed to provide you with services. We will store other personal data for as long as necessary to achieve the purposes for which we originally collected the data and for other legitimate business purposes, including fulfilling our legal, regulatory, auditing, fraud prevention, or other compliance obligations.

If you close your account, we will delete your account data from our servers within 30 days. You also have the right to delete or request our assistance in deleting the personal data we have collected about you.

Retention and Deletion of Google User Data

Google user data is subject to the following additional rules:

• On disconnection: When you disconnect a Gmail account in BrandPal, or revoke access from your Google Account permissions page, we immediately call Google's token revocation endpoint and delete the stored OAuth credentials for that mailbox from our systems. No further access to your Google account is possible.
• On account closure: All Google user data collected and stored via the Google APIs is deleted or irreversibly anonymized within thirty (30) days of your account being closed or terminated.
• What is retained: After disconnection we retain only the records you created inside BrandPal — the outreach emails you authored and their send status — because these are your own business records, not data read from your mailbox. You may request their deletion at any time.
• No secondary copies: Google user data is not copied into analytics platforms, data warehouses, or business-intelligence systems, and is not included in long-term backups beyond the retention period stated above.

Contact Us

If you have any questions about this Policy, or wish to exercise any of the rights described above, please contact us at official@brandpal.ai.

© 2026 BrandPal. All rights reserved.