Privacy policy

1Two roles we play

When your company uses Brand Stori, the documents and content your company uploads, and the personal data inside them (for example, names in a case study), belong to your company. We process them on your company's behalf and on its instructions, as a processor (GDPR) or service provider (CCPA). Your company decides what goes in, and requests about that content should go to your company first.

For the account and usage data we need to run the Services (who signed in, which workspace, billing), we are the controller.

2What we collect

We do not ask for, and ask you not to upload, special categories of data (health, biometrics, government ID) or payment card data inside documents.

3How we use it

• –To provide the Services: building your brain, answering questions, creating pieces, and running your workspace.
• –To keep the Services secure: detecting abuse, protecting accounts, preventing fraud.
• –To support you and fix problems: investigating errors and bad AI results.
• –To bill you and manage your plan.
• –To communicate with you: sign-in codes, service and security notices, and, if you agree, product updates, which you can unsubscribe from at any time.
• –To improve the Services, using usage data and de-identified measurements, never the content of your documents or pieces.
• –To understand our website's visitors and run our ads, on brandstori.ai, unless you decline cookies (in the EEA, the UK and Switzerland, only if you accept): how they use its pages (Microsoft Clarity) and which companies visit (RB2B), so we can improve the site and contact companies that may be interested in Brand Stori; and to measure our LinkedIn ads and show them to people who visited (LinkedIn).

Legal bases (GDPR): performing our contract with you; our legitimate interests in security, support and improving the product; and consent where required (for example, marketing email, and, in the EEA, the UK and Switzerland, the analytics and marketing cookies on brandstori.ai).

4AI processing: zero data retention, by design

Brand Stori uses AI models to read your documents and create pieces. The content needed for a request is sent to an AI model provider only to produce the response you asked for. Three rules apply to every AI provider we use, today and in the future:

• –Zero data retention. Every AI request we make goes through a gateway that allows it to reach only providers that have agreed not to keep your data after responding, and not to train on it. This is enforced for our whole account, not chosen request by request, so a provider without that agreement cannot receive your content. If a model has no such provider, we don't use it.
• –No training, by us or by them. We do not train AI models on your content, and our providers may not.
• –No mixing between customers. Nothing from one customer's brain is used to build, improve or answer for another customer.

The companies that currently serve AI requests are named on our sub-processor list.

5Who can see your content

• –Within your workspace: pieces you create are private to you by default. You choose what to share, and administrators manage the brain and membership.
• –Our staff: only where needed to operate, secure and support the Services, for example when you ask for help or when investigating an error. Access is limited and logged.
• –Nobody else, except the service providers below, or where required by law.

We do not sell personal data for money. On our website, unless you decline cookies (in the EEA, the UK and Switzerland, only if you accept), two tools pass details of your visit to other companies: RB2B identifies the company you visit from and, for visitors in the United States, may match your visit to a professional profile, which we may use to contact companies that may be interested in Brand Stori; and LinkedIn's Insight Tag tells LinkedIn about your visit, so we can measure our LinkedIn ads and show them on LinkedIn to people who visited. Some US state privacy laws, such as California's, may count these as "selling" or "sharing" personal data, including for targeted advertising. You can opt out at any time with "Decline all" on the cookie banner or in Cookie settings, at the bottom of every page, and if your browser sends a Global Privacy Control signal we treat it as an opt-out of both unless you turn them on yourself. In the EEA, the UK and Switzerland, they happen only if you accept. Nothing from the Brand Stori product, its accounts or your content goes to RB2B or LinkedIn.

6Service providers (sub-processors)

We use specialist providers instead of building infrastructure ourselves. Each processes data only on our instructions, to provide the Services, under a written agreement. They fall into these groups:

The current list of companies, what each processes and where, is at brandstori.ai/sub-processors. We update it before a new provider begins processing customer content. To be notified of changes, email hello@brandstori.ai.

7Where data is stored

Your content is stored in the United States. AI requests may be processed in the provider's own region, as shown on the sub-processor list; under zero data retention, nothing is kept there after the response. If you are outside the US, your data is transferred to the US. For transfers from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) with our providers.

8How long we keep it

You can ask us to delete your data at any time at hello@brandstori.ai. We will delete it from live systems, remove backup copies, and delete AI traces.

9Security

We encrypt data in transit and at rest, isolate each workspace's data, keep off-site backups with a separate provider, limit and log staff access, and design the AI so it cannot ask for another customer's material. No system is perfectly secure. If a breach affects your data, we will notify you and, where required, regulators, without undue delay.

10Your rights

Depending on where you live (for example under the GDPR, UK GDPR or US state laws such as the CCPA), you may have the right to access, correct, delete or export your personal data; to object to or restrict some processing; to withdraw consent; and to complain to a data protection authority. We do not discriminate against anyone for exercising these rights.

Email hello@brandstori.ai to make a request. We may need to verify your identity. If your data is in content your company uploaded, we will pass your request to your company and help it respond. We answer within the time the law requires (for example, one month under the GDPR, 45 days under the CCPA).

11Cookies

The Services use essential cookies only, to keep you signed in and secure (set by Clerk, by our bot protection, Cloudflare Turnstile, and by our design workspace to keep you signed in there). On brandstori.ai, we count visits with Vercel Web Analytics, which uses no cookies. Three more tools run from your first visit unless you decline them on the cookie banner (in the EEA, the UK and Switzerland, only if you press Accept): Microsoft Clarity, which records how visitors use the site: clicks, scrolling, the pages visited, and session replays (recordings of a visit), with what you type into forms masked and never recorded; RB2B, which identifies the company a visit comes from and, for visitors in the United States, may match the visit to a professional profile, such as a LinkedIn page; and LinkedIn's Insight Tag, which tells LinkedIn about the visit (the page, the site that sent you, the IP address, browser and device, and the time), so we can measure our LinkedIn ads, see what kinds of professionals visit, and show our ads on LinkedIn to people who visited. Press "Decline all" and they stop (Clarity at once, RB2B and LinkedIn from the next page you open); in the EEA, the UK and Switzerland, if you decline, close or ignore the banner, none of them loads. You can change your choice at any time in Cookie settings, at the bottom of every page. See our Cookie policy.

12Children

The Services are for business use and are not directed to anyone under 18. We do not knowingly collect children's data.

13Changes

We will post changes here and update the date above. For material changes, we will also notify account holders by email or in the Services before they take effect.

14Contact