Privacy notice

Who we are

Brandito is a trading name of VisionaryGrid Studio Limited, a company registered in Jersey, company number 165823, with its registered office at Strathmore, St Ouen, Jersey. We're the data controller for the personal data described in this notice. For anything about your data, email hello@brandito.app.

What we collect and why

• Account details: your email address, password (stored securely hashed, never in plain text), workspace name and team membership. We use these to create your account, sign you in and let you work with your team. Legal basis: performing our contract with you.
• Brand hub content: the files, text and settings you add to hubs. We store and display them to run the service. Legal basis: performing our contract with you.
• Billing details: your plan, subscription status and the customer and subscription references Paddle gives us. We never see or store your full card details. Legal basis: performing our contract with you, and our legal obligations for accounting.
• Service emails: we send sign-in links, password resets, invitations and important account notices. Legal basis: performing our contract with you. We don't send marketing emails unless you've opted in.
• Technical data: IP addresses, browser type and request logs, which our hosting providers process to deliver pages, keep the service secure and prevent abuse. Legal basis: our legitimate interest in running a secure, reliable service.
• Messages you send us: so we can reply and help. Legal basis: our legitimate interest in supporting customers.

Data inside brand hubs

Studios sometimes put personal data into a hub, such as a client contact's name and email in the footer. For that data, the studio is the controller and we act as its processor: we only store and display it to run the hub as the studio sets it up.

Who we share data with

We use a small number of trusted providers to run Brandito. They process data only on our instructions:

• Paddle.com handles checkout, payments, tax and invoices as our reseller and Merchant of Record. For payment details, Paddle acts as an independent controller under its own privacy notice.
• Supabase: our database and sign-in system, hosted in London.
• Cloudflare: website hosting, file storage, security and custom domain connections.
• Resend: delivery of our service emails.
• jsDelivr: a content delivery network that serves part of our app's code to your browser.

If you connect Brandito to an AI assistant such as Claude or ChatGPT, the files and instructions you give that assistant are handled by its provider under your own agreement with them. Brandito only receives what the assistant sends to your hubs.

We may also share data if the law requires it, or with a buyer if Brandito is ever sold, in which case this notice would continue to protect your data. We never sell personal data.

International transfers

Our main database is in the UK. Some providers, such as Cloudflare and Resend, may process data in other countries, including the United States. Where data leaves the UK, Jersey or the European Economic Area, we rely on adequacy decisions or standard contractual clauses (with the UK addendum) to keep it protected.

How long we keep data

• Account details and hub content: while your account is open. When you ask us to delete your account, we delete them within 30 days, and they leave our backups within a further 30 days.
• Billing records: as long as the law requires for tax and accounting, normally six years. Paddle keeps its own records as Merchant of Record.
• Server and security logs: up to 30 days, unless they're needed to investigate abuse.

Cookies and similar technology

We don't use advertising or analytics cookies. The app keeps your sign-in session in your browser's local storage so you stay logged in, and remembers small preferences in the same way. Paddle's checkout uses its own cookies to process payments and prevent fraud. Cloudflare may set strictly necessary security cookies. None of these are used to track you across other websites.

Your rights

Under the Data Protection (Jersey) Law 2018, and the UK and EU GDPR where they apply, you can:

• ask for a copy of your personal data
• ask us to correct it
• ask us to delete it
• ask us to restrict or object to how we use it
• ask for your data in a portable format
• withdraw consent, where we rely on consent

Email hello@brandito.app and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Jersey Office of the Information Commissioner, or to your local data protection authority.

Security

We protect data with encryption in transit and at rest, access controls so each workspace only sees its own data, and providers with strong security records. No system is perfectly secure, but if a breach ever affects your data we'll tell you and the regulator as the law requires.

Children

Brandito is a tool for businesses and isn't intended for anyone under 18.

Changes to this notice

We'll update this notice when how we handle data changes. If the changes are significant, we'll email account owners before they take effect.