Privacy Policy

Who we are

Brandafai (“Brandafai,” “we,” “us,” or “our”) provides a franchise-management platform. For personal data processed on behalf of a customer organization within the product, that organization is the controller and Brandafai acts as a processor. For our public website and direct communications, Brandafai is the controller. Questions? Email support@brandafai.com.

Information we collect

• Account and organization data — provided by the organization that invites you: your name, work email, role, and the units, franchisees, or territories you’re scoped to.
• Content you enter — records, tasks, issues, comments, audits, agreements, financial figures, and files you or your organization create in the platform.
• Operational and integration data — where your organization connects a system (for example a POS, booking, or DMS provider), the business metrics returned by that connection. We store integration credentials in encrypted form.
• Usage and device data — log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the service.
• Communications — information you submit through our contact/demo-request form or when you email us.

We do not intentionally collect special-category (sensitive) personal data, and we ask that you not enter it into free-text fields.

How we use information

• To provide, maintain, and secure the platform and your account.
• To enforce permissions, produce audit trails, and detect and prevent abuse or fraud.
• To power AI features (“Atlas”) on your live data, within your permissions, and to meter usage. See AI features below.
• To respond to your requests, provide support, and send service-related messages.
• To comply with legal obligations and enforce our agreements.

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the service), legitimate interests (to secure, improve, and operate the service, balanced against your rights), consent (where required, e.g. certain communications), and legal obligation.

AI features (Atlas)

Atlas operates only within the permissions of the signed-in user and is grounded in your organization’s data. To generate answers we send the relevant context to our AI provider through a metered gateway. We do not permit our AI providers to use your data to train their models. Atlas output is decision support, not professional advice; a person should review anything material before acting on it.

How we share information

We do not sell personal information. We share it only:

• With service providers (sub-processors) who host and run the platform on our behalf — for example cloud hosting and database (Supabase), application hosting (Vercel), transactional email (Resend), and our AI provider — under contracts that limit their use of the data.
• Within your organization, according to the roles and permissions your organization configures.
• For legal reasons — to comply with law, enforce our terms, or protect the rights, safety, and security of Brandafai, our customers, or the public.
• In a business transfer — as part of a merger, acquisition, or sale of assets, subject to this policy.

International transfers

We and our service providers may process information in countries other than yours. Where required, we use appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for such transfers.

Data retention

We retain personal data for as long as needed to provide the service and for legitimate business or legal purposes. Certain records — for example the append-only audit trail — are retained for integrity and compliance. When you close an account or your organization ends its use, we delete or de-identify data in line with our retention schedule and applicable law, and we honor deletion instructions from the controlling organization.

Security

We use technical and organizational measures including encryption in transit, row-level tenant isolation in the database, server-enforced multi-factor authentication, least-privilege access, and an append-only audit trail. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify affected parties of incidents as required by law.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. California residents (CCPA/CPRA) have the right to know, delete, and correct personal information, and to opt out of “sale” or “sharing” — which we do not do — without discrimination for exercising these rights.

If your data is held within a customer’s workspace, please direct your request to that organization; we will assist them as their processor. Otherwise, contact support@brandafai.com and we will respond as required by applicable law. You may also have the right to lodge a complaint with your local data-protection authority.

Children’s privacy

Brandafai is a workplace tool intended for business users aged 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 13 (or under 16 where a higher age applies). We do not permit children to create or use accounts. If we learn that we have collected personal information from a child in violation of this policy, we will delete it promptly. If you believe a child has provided us personal information, contact support@brandafai.com.

Cookies

We use strictly necessary cookies to sign you in and keep your session secure. We do not use our public site to build advertising profiles. If we introduce optional analytics or other non-essential cookies, we will ask for consent where required and update this policy.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

Contact us

Questions or requests about this policy or your personal data: support@brandafai.com.