Privacy Policy

1. Information We Collect

We collect the following categories of personal data:

• Account data: name, email address, and password (hashed) when you create an account.
• Workspace and kit content: brand names, logos, colors, fonts, files, and other assets you upload or create inside BrandKity.
• Usage data: pages visited, kit views, downloads, feature interactions, session duration, and device/browser metadata.
• Billing data: payment method details (processed and stored by our third-party billing provider — we do not store full card numbers).
• Communications: messages you send us via support, contact forms, or email.

2. How We Use Your Information

We use your personal data to:

• Create and manage your BrandKity account and workspace.
• Deliver core product features including BrandKit creation, editing, and sharing.
• Process payments and manage your subscription.
• Send transactional messages (account setup, password reset, billing receipts).
• Respond to support requests and enquiries.
• Improve product reliability, performance, and user experience.
• Detect and prevent fraudulent or abusive activity.
• Send product updates and marketing communications where you have consented or where permitted by applicable law. You may opt out at any time.

3. Legal Bases for Processing

Where GDPR or similar legislation applies, we process personal data under the following legal bases:

• Contract performance — to provide the product and services you signed up for.
• Legitimate interests — for product improvement, security, and fraud prevention.
• Consent — for optional marketing communications.
• Legal obligation — where we must comply with applicable laws.

4. Data Storage and Security

Your data is stored using the following sub-processors:

• Supabase — database and authentication.
• Cloudflare R2 — file and asset storage.
• Stripe — payment processing.

We apply role-based access controls, encrypted data transport (HTTPS/TLS), and authentication safeguards throughout the platform. No storage system or transmission method is 100% secure; however, we follow industry best practices to protect your data.

5. Data Sharing

We do not sell or rent personal data. We share data only with:

• Service providers necessary to run the platform (hosting, storage, authentication, billing, and email delivery), bound by data processing agreements.
• Legal authorities if required by law, court order, or to protect rights and prevent fraud.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide services. When you delete your account, personal data is removed within 30 days, except where required to be retained longer for legal or billing obligations.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your personal data (“right to be forgotten”).
• Request a portable copy of your data.
• Object to or restrict certain processing activities.
• Withdraw consent for marketing communications at any time.

To exercise any of these rights, email [email protected].

8. Cookies

BrandKity uses essential cookies required for authentication and session management. We may use analytics cookies to understand usage patterns. You can manage cookie preferences through your browser settings.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the platform. Continued use of BrandKity after changes take effect constitutes acceptance of the updated policy.

10. Contact

For privacy-related queries, contact BrandKity at: