Privacy Policy

Branq is a product of Branq Labs Ltd, a company registered in England and Wales under company number 17449588, based in London, UK.

In this policy, "we", "us" and "our" mean Branq Labs Ltd. We are the data controller for the personal information described in this policy, except where we say otherwise in the section on brand content you put into Branq.

For any privacy question, or to exercise any of your rights, contact us at support@branq.app. We have not appointed a Data Protection Officer, because we are not required to do so, but privacy enquiries are handled by our management team.

This policy covers personal information we handle when you:

• visit the Branq website at branq.app;
• join our waitlist or request early access;
• subscribe to our newsletter;
• contact us by email or through social media;
• take part in our pilot programme, or use the Branq platform under an account.

It does not cover websites we link to. Those services have their own privacy policies and we are not responsible for them.

Waitlist and early access

When you join the waitlist we collect your first name, last name, business email address, your company website if you provide one, and whether you describe yourself as an agency or a brand.

Newsletter

When you subscribe to our newsletter we collect your email address.

Correspondence

If you email us or message us on LinkedIn or Instagram, we hold the content of that correspondence and your contact details.

Account and platform information

If you hold a Branq account we collect your name, work email address, the organisation and workspace you belong to, your role and permissions, authentication information, and records of activity in the product such as approvals, comments and audit history. If you buy a paid plan, our payment provider collects your billing details. We do not receive or store your full card number.

Technical information

Our hosting and error-monitoring providers automatically record technical data such as IP address, browser type, pages requested and timestamps. We use this to keep the service running, to investigate faults and to protect against abuse.

We do not collect special category data, such as health, ethnicity or political opinions, and we ask you not to submit it to us.

Most of the information we hold comes directly from you. We may also receive information:

• from a colleague who invites you into a Branq workspace, or from the organisation that holds the account you use;
• from our service providers, such as technical logs from our hosting provider or delivery information from our email provider;
• from publicly available business sources, such as a company website, where we are assessing whether an organisation is a fit for our pilot programme.

Under UK data protection law we must have a lawful basis for using your personal information. Ours are set out below.

To manage the waitlist and pilot programme

We use your waitlist details to contact you about early access, to assess whether your organisation fits the pilot, and to send you product updates you asked for. Our lawful basis is legitimate interests, namely developing our business and responding to people who have asked to hear from us. We consider this proportionate because you gave us the information for exactly this purpose and you can opt out at any time.

To send our newsletter

Our lawful basis is your consent, which you give by submitting the subscribe form. You can withdraw it at any time.

To provide the Branq platform

We use account information to create and secure your account, deliver the service, provide support and take payment. Our lawful basis is performance of a contract with you, or with the organisation you work for, and legitimate interests in administering that relationship.

To keep the service secure and working

We use technical and activity data to monitor faults, prevent abuse and protect our systems. Our lawful basis is legitimate interests in the security and integrity of our service.

To improve Branq

We use aggregated and de-identified usage information to understand which features work. Our lawful basis is legitimate interests in improving our product. We do not use your brand content to train AI models, as explained below.

To meet our legal obligations

We keep accounting records and respond to lawful requests. Our lawful basis is compliance with a legal obligation.

We send product updates and newsletters only to people who joined the waitlist or subscribed, and to existing customers about services similar to those they already receive.

Every marketing email contains an unsubscribe link. You can also email support@branq.app and ask us to stop. We will action it without undue delay.

If you unsubscribe we keep a minimal record of your email address on a suppression list, so that we do not contact you again by mistake. We will still send you service messages about your account, such as security notices or billing, because these are not marketing.

The Branq marketing website does not use advertising cookies, analytics cookies or tracking pixels, and it does not build a profile of you. Because of that, we do not show a cookie consent banner on this website.

Our hosting provider may set strictly necessary cookies that are required to deliver and secure the site. Strictly necessary cookies do not require your consent under the Privacy and Electronic Communications Regulations.

If you sign in to the Branq platform, we use strictly necessary cookies and similar browser storage to keep you signed in and to protect your session.

If we introduce analytics or any other non-essential cookie in future, we will ask for your consent first and update this policy.

When you use the Branq platform you may upload brand guidelines, assets, campaign material, briefs and other content. That content may contain personal information, for example the name of a colleague or a client contact, or an image of an identifiable person.

For that content, you are the data controller and we are your data processor. We handle it only on your documented instructions, which are the instructions you give through the product and through your contract with us. We do not decide what you put into Branq and we do not use it for our own purposes.

If you are a business customer we will enter into a written data processing agreement with you covering this, as required by Article 28 of the UK GDPR. You can request one from support@branq.app.

If you are an individual whose personal information appears inside a customer's Branq workspace and you want to exercise your rights, please contact that organisation directly, because they control that content. If you contact us, we will pass your request on to them.

Branq uses third party AI models to generate, review and analyse content. When you ask Branq to do something, the relevant content and instructions are sent to one or more of those providers so that the model can produce a result.

Our commitments are:

• We do not use your content to train AI models, whether our own or those of our providers.
• We use these providers under business or enterprise terms that prohibit them from training their models on content we send.
• We send only the content needed to carry out the task you asked for.
• AI output can be inaccurate or unsuitable. Branq is designed so that a person keeps final control over what is approved and published, and you should always review output before you rely on it.

We do not make solely automated decisions that produce legal effects for you or similarly significantly affect you.

We do not sell your personal information and we do not share it with advertisers. We share it with service providers who help us run Branq, each of whom acts on our instructions under a written contract. Our main providers are:

• Vercel Inc. (United States and European Union), website and application hosting.
• Supabase, Inc. (hosting in the European Union), database, authentication and file storage.
• Google Cloud and Google Vertex AI (Google Cloud EMEA Limited, Ireland, and Google LLC, United States), AI model processing including Gemini and Veo.
• Anthropic PBC (United States), AI model processing.
• OpenAI, L.L.C. (United States), AI model processing.
• Runway AI, Inc. and Replicate, Inc. (United States), AI image and video processing.
• Stripe, Inc. and Stripe Payments UK Ltd, payment processing for paid plans.
• Resend (United States), sending transactional and marketing email.
• Functional Software, Inc. trading as Sentry (United States), error monitoring.

We keep an up to date list of these providers and will tell business customers before we add or replace one that processes their content. Request the current list from support@branq.app.

We may also share information:

• with our professional advisers, such as lawyers and accountants, where they need it to advise us;
• with a buyer or investor, if we sell or reorganise our business, in which case we will require them to protect it in the same way;
• where the law requires it, or to establish, exercise or defend legal claims.

Some of our providers are based outside the United Kingdom, mainly in the United States and the European Economic Area. That means your personal information may be transferred outside the UK.

Where we do this, we make sure one of the safeguards allowed by UK data protection law is in place:

• the country is covered by UK adequacy regulations, which is the case for the European Economic Area;
• the provider is certified under the UK Extension to the EU to US Data Privacy Framework, known as the UK to US data bridge; or
• we have an International Data Transfer Agreement, or the UK Addendum to the European Commission standard contractual clauses, in place with the provider, supported by a transfer risk assessment.

You can ask us for a copy of the safeguard that applies to a particular transfer by emailing support@branq.app.

We keep personal information only as long as we need it. Our standard periods are:

• Waitlist entries: up to 24 months from your last interaction with us, then deleted.
• Newsletter subscribers: until you unsubscribe. After that we keep your email address on a suppression list indefinitely, so that we can honour your opt out.
• Correspondence: up to 24 months after the matter is closed.
• Account information: for as long as the account is active, then up to 12 months after it closes.
• Customer brand content: for as long as the customer keeps it in the workspace. When an account closes we delete or return it within 90 days, unless the customer asks for it sooner or the law requires us to keep it.
• Billing and accounting records: six years from the end of the financial year they relate to, as required by UK tax law.
• Technical and security logs: up to 12 months.

Where we need to keep information for longer to establish, exercise or defend a legal claim, we will keep only what is necessary for that purpose.

We take appropriate technical and organisational measures to protect personal information, including:

• encryption of data in transit and at rest;
• access controls, so that each brand and workspace is separated and staff access is limited to what their role requires;
• authentication controls, including multi-factor authentication;
• logging and audit trails of significant actions in the product;
• regular review of our providers and their security posture.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you without undue delay where the law requires us to.

Under UK data protection law you have the right to:

• Be informed about how we use your information, which is the purpose of this policy.
• Access a copy of the personal information we hold about you.
• Rectification, to have inaccurate information corrected or incomplete information completed.
• Erasure of your information in certain circumstances.
• Restrict processing in certain circumstances.
• Data portability, to receive information you gave us in a structured, commonly used, machine readable format.
• Object to processing based on legitimate interests, and to object at any time to direct marketing.
• Withdraw consent at any time, where we rely on consent. This does not affect processing carried out before you withdrew it.

To exercise any right, email support@branq.app. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if we do. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

We may ask you for information to confirm your identity before we act, so that we do not disclose your information to someone else.

If you are unhappy with how we have handled your personal information, you have the right to complain to us directly. Email support@branq.app with the word "complaint" in the subject line. You may complain by any means, and we will accept it however it reaches us.

We will acknowledge your complaint within 30 days of receiving it, investigate it in a way that is reasonable and proportionate to what you have raised, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at any time. We would ask you to raise it with us first so that we have a chance to put things right.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint.

Branq is a business product and is not intended for children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us at support@branq.app and we will delete it.

We may update this policy as our product and our legal obligations change. The date at the top of this page shows when it was last updated. If we make a significant change, such as using your information for a new purpose, we will tell you by email or through the product before the change takes effect.