Privacy Policy

The controller is brandstash Tecnologia Ltda., based in Salvador, Brazil. For privacy matters and rights requests, contact privacy@brandstash.ai.

When a company or agency adds its own clients’ data to a project, it must have appropriate authority and a legal basis. In that situation, Brandstash may act as a processor following the customer account’s instructions.

• Account and security: authenticate users, prevent abuse, and protect sessions.
• Diagnosis: locate the correct profile, calculate the baseline, and save the requested result.
• Autopilot: plan the calendar, generate posts and images, organize approvals, publish authorized content, and prepare review replies.
• Insights: show performance data and operating history in the project.
• Support and improvement: fix errors, answer requests, and understand aggregate product use.
• Billing and legal duties: process the plan, maintain tax records, and comply with applicable obligations.

Connecting Google Business is optional and requires explicit authorization. We request only permissions needed for the functions shown on the connection screen. Brandstash uses the received data to manage and report on profiles you own or are authorized to manage.

• We do not sell data received from Google APIs.
• We do not use it for personalized advertising, lending, or third-party profiling.
• We do not transfer it to third parties except subprocessors needed to provide or protect the service under confidentiality obligations.
• You can revoke authorization in your Google account and request disconnection inside Brandstash.
• After disconnection, we stop new actions and delete or anonymize data according to your request and applicable retention duties.

Briefings, instructions, and necessary portions of a project may be sent to contracted model providers to produce posts, images, and replies. Brandstash configures these services to fulfill the user request and limits sharing to what is necessary.

We do not independently use project content to train a shared public model. Automated outputs may contain errors; the approval history records decisions made within the product.

Strictly necessary cookies maintain sessions, language, security, and consent preferences. Only after consent, first-party telemetry may record visit source, UTMs, language, browser, an anonymous identifier, and events such as starting or completing the diagnosis. Landing-page visit events are retained for up to 180 days and then deleted automatically.

You can review your choice through Cookie preferences in the footer. Brandstash does not use a third-party pixel for behavioral advertising on this landing page.

• Contract and pre-contract steps: account, requested diagnosis, project, support, and plan delivery.
• Consent: optional telemetry, optional communications, and connections that require user authorization.
• Legitimate interests: security, fraud prevention, and technical improvement, assessed against necessity and data-subject rights.
• Legal obligations: tax and accounting records and valid legal requests.

We share data only with necessary service providers, such as hosting, databases, transactional email, payments, security, maps/Google, and generation models. Each provider receives only what is needed for its role and must meet contractual protection duties.

Some providers may process data outside Brazil. In those cases, we use contractual mechanisms and safeguards compatible with Brazil’s LGPD and other applicable rules.

We retain data while the account or project is active and for as long as needed for security, disputes, legal obligations, or rights enforcement. We then securely delete or anonymize it unless retention is required.

We apply technical and organizational measures proportionate to risk, including access controls, credential protection, and monitoring. No system is infallible; material incidents are handled and reported as required by law.

Under Brazil’s LGPD, data subjects may request confirmation of processing, access, correction, sharing information, portability where applicable, anonymization, blocking or deletion, withdrawal of consent, and review of automated decisions in cases provided by law.

Send a request to privacy@brandstash.ai. We may request reasonable information to verify identity and protect the account. If the issue is not resolved, data subjects may also contact Brazil’s ANPD and consumer-protection bodies.

We update this page when the product scope, providers, or data practices materially change. The date at the top identifies the current version. Material changes may be communicated by email or inside the app.