Privacy policy

Who is responsible

The controller for the data described here is [Company legal name], [Registered address], registration number [Registration number], VAT ID [VAT ID]. Questions about privacy go to [Contact email].

What we collect

• Account data: your name, email address, password hash (or your Google account identifier if you sign in with Google), profile picture and sign-in timestamps.
• Brand content you create in the product: brands, tasks, comments, catalog and listing content, product images, documents, notes, chat and direct messages, and uploaded marketplace performance reports.
• Operational data: notifications, activity records such as who completed a task and when, and technical logs needed to keep the service running and secure.

We do not run advertising or tracking cookies. The only cookies and browser storage we use keep you signed in and remember interface preferences such as light or dark mode.

Why we use it

• To provide the service you signed up for, under our contract with you.
• To send transactional email: sign-in confirmations, password resets, invitations and notifications.
• To keep the service secure, debug faults and prevent abuse, based on our legitimate interest.
• To meet legal and accounting obligations.

We do not sell personal data and we do not use your brand content to train models.

Retention

• Account and brand content stays while your account or the brand exists.
• When you delete your account, we remove your memberships, anonymise your profile and delete your sign-in credentials. Content that belongs to a brand you worked in stays with that brand so the team can keep working.
• When a brand is deleted, its tasks, products, documents, chat and reports are removed.
• Technical logs are kept for a short period and then rotated out.

Where your data is stored

Application data and files are stored with our infrastructure provider in the European Union (Ireland region), and the application is hosted in the EU.

Sub-processors

• Supabase — database, authentication, file storage and transactional email delivery.
• Google — only if you choose Google sign-in, to verify who you are.
• Lovable — application hosting and deployment.

Your rights

You can access, correct, export and delete your data. The Account page lets you edit your profile, download a copy of your data as a JSON file and delete your account. You also have the right to object to processing, to restrict it, and to complain to your local data protection authority. Write to [Contact email] and we will respond within one month.

Contact

[Company legal name], [Registered address]. Email [Contact email]. Governing law and courts: [Governing law and courts].