Privacy Policy

1. Information We Collect

1.1 Information You Provide

Account Information (all users):

• Name and email address (from your Google account)
• Profile picture (from your Google account)
• Account type selection (Brand or Creator)

Brand Profile Information:

• Company name and website URL
• Company logo
• Industry and company size
• Country and city
• Phone number and business contact email
• Preferred currency

Creator Profile Information:

• Bio and content categories
• Social media platform usernames and URLs (Instagram, TikTok, YouTube, Twitter, Facebook)
• Follower tier and audience metrics
• Location (country, cities)
• Phone number and business contact email
• Preferred currency
• Rate card (pricing for deliverables)
• Availability status
• Portfolio of completed work

Collaboration Data:

• Campaign details, deliverable descriptions, and compensation terms
• Applications and invitation responses
• Messages exchanged between brands and creators through the Platform
• Deal stages and status history

Contact Information (Brand CRM):

Brands may store creator contact information (names, emails, phone numbers, social handles, follower counts, notes) in their Platform contact list. This data is entered and managed by the brand user.

1.2 Information from Third-Party Services

When you connect third-party accounts, we receive information from those services:

• Google (Authentication): Name, email address, and profile picture used to create and authenticate your account.
• Instagram: Public profile information, follower count, following count, and media count, when you choose to connect your Instagram account.
• Gmail: Email metadata (headers and identifiers) for tracking collaboration-related email communications, when you choose to connect Gmail. We do not read or store the full content of your emails.
• Google Calendar: We create, update, and delete calendar events for campaigns and deals you are involved in, when you choose to connect Google Calendar. We do not read your existing calendar events.

1.3 Information Collected Automatically

• Session Data: IP address, user agent (browser and device information), login timestamps, and session activity timestamps. This is collected for security and authentication purposes.
• Server Logs: HTTP request logs including request paths, response status codes, and timing data. These logs are used for operational monitoring and debugging.

1.4 Information We Do NOT Collect

• We do not use cookies for advertising or behavioral tracking. The only cookie we set is a session authentication cookie required for the Platform to function.
• We do not use third-party analytics or tracking tools (no Google Analytics, no advertising pixels, no behavioral tracking SDKs).
• We do not collect payment or financial account information. All payments between brands and creators are handled outside the Platform.

2. How We Use Your Information

We use the information we collect to:

• Provide the Platform — create and maintain your account, display your profile, enable campaign management, facilitate messaging and collaborations between brands and creators.
• Operate Integrations — sync your Instagram metrics, manage Gmail-based collaboration tracking, and create Google Calendar events, when you opt in to these features.
• Send Communications — send transactional emails related to your Platform activity, including campaign invitations, collaboration updates, and account notifications. We send emails from noreply@brandbridge.pro via Amazon SES.
• Ensure Security — detect and prevent unauthorized access, fraud, and abuse. We use session data (IP address, user agent) for security monitoring and audit purposes.
• Improve the Platform — analyze aggregated, non-identifying usage patterns to identify bugs, improve features, and optimize performance.
• Provide Support — respond to your inquiries and troubleshoot issues. Authorized administrators may access your account for support purposes.

3. How We Share Your Information

3.1 With Other Users

• Creator profiles are visible to Brand users on the Platform marketplace, subject to the creator's visibility settings.
• Brand campaign details (including company name and campaign descriptions) are visible to creators browsing the marketplace.
• Messages exchanged through the Platform are visible to both parties in the conversation.
• Brand CRM data entered by a brand user about creators is only visible to that brand user and is not shared with the creator or other users.

3.2 With Service Providers

We share information with third-party service providers who assist us in operating the Platform:

These providers process data on our behalf and are contractually required to protect your information.

3.3 When Required by Law

We may disclose your information if required by law, legal process, government request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.4 Business Transfers

If BrandBridge is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

3.5 No Sale of Personal Information

We do not sell your personal information to third parties. We do not share your personal information with third parties for their own marketing purposes.

4. Data Retention

• Account data is retained for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except as required by law or legitimate business needs (such as maintaining audit logs).
• Session data (IP address, user agent, timestamps) is retained for security audit purposes and automatically expires after the session's maximum age (7 days for active sessions).
• Server logs are retained for operational monitoring and are periodically purged.
• Messages and collaboration data are retained for as long as the associated accounts are active.

5. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS) and at rest.
• Session tokens encrypted using AES before database storage.
• HTTP-only, secure session cookies to prevent client-side access.
• Role-based access controls limiting data access to authorized users.
• Concurrent session limits (maximum 10 sessions per account).
• Structured logging with sensitive data masking.

No method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Access and Portability

You can access and review your personal information through your Platform profile and settings at any time.

6.2 Correction

You can update your profile information, contact details, and account settings at any time through the Platform.

6.3 Deletion

You may request deletion of your account and personal data by contacting us at brandbridge.ceo@gmail.com. We will process deletion requests within 30 days.

6.4 Third-Party Integrations

You can disconnect Instagram, Gmail, and Google Calendar integrations at any time through your account settings. Disconnecting an integration will stop further data collection from that service.

6.5 Communications

Transactional emails related to your Platform activity (such as campaign invitations) are part of the Platform's functionality. You can stop receiving them by deactivating the relevant features or deleting your account.

7. International Users

BrandBridge is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States. By using the Platform, you consent to this transfer.

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws, you may have additional rights under applicable law, including the right to lodge a complaint with your local data protection authority. Contact us at brandbridge.ceo@gmail.com to exercise any data protection rights.

8. Children's Privacy

BrandBridge is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us at brandbridge.ceo@gmail.com.

9. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• No Sale of Personal Information: We do not sell personal information as defined by the CCPA.

To exercise these rights, contact us at brandbridge.ceo@gmail.com. We will verify your identity before processing your request.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Platform. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Privacy Policy.

The “Last Updated” date at the top of this page indicates when this Privacy Policy was last revised.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

BrandBridge LLC
Email: brandbridge.ceo@gmail.com