Privacy Policy

Controller: Conscious Ventures Ltd, operating as Brand Atlas

Company number: 13189124

Registered office: 139 Middle Deal Road, Deal, England, CT14 9RJ

Contact email: hello@brandatlas.ai

For privacy questions or to exercise your rights, email hello@brandatlas.ai with the subject line DATA PROTECTION REQUEST.

This Policy applies when:

• you visit brandatlas.ai or related Brand Atlas sites;
• you sign up, start a trial, book a demo, or contact us;
• you use the Brand Atlas platform (including app.brandatlas.ai and our API/MCP);
• you connect third-party tools (for example ChatGPT, Claude, Cursor, MailerLite, Webflow, or model providers);
• you communicate with us by email or during meetings; or
• we process data for billing, security, support, and legal compliance.

Depending on how you interact with us, we may collect:

3.1 Account and contact data — name, work email, company name, job title, login details, user ID, workspace/organisation ID, team membership and roles. If you use Sign in with Google, this includes the Google account identifiers described in section 5.1.

3.2 Billing and transaction data — billing name and email, billing address, VAT or tax ID where provided, plan, invoices, payment status, extra-usage (overage) charges, and transaction history. We do not store full payment card numbers; Stripe handles card data.

3.3 Platform and usage data — features used, actions in the workspace, technical logs, browser and device information, IP address, timestamps, diagnostics, and session-level analytics on the platform.

3.4 Customer Data — brand book and profile materials (including colours, fonts, tone, logos, photography looks); knowledge (crawled pages, uploaded files, URLs, notes); product catalogue data and packshots; claims libraries, policy packs, and check history; generated and uploaded creative assets; agent/chat threads and tool audit; MCP tokens and integration credentials (encrypted at rest); and any other content you upload, connect, or generate.

Customer Data may include personal data if you choose to submit it.

3.5 Support and communications data — emails, support messages, demo and meeting bookings (including via Calendly), and notes from calls.

3.6 Website and marketing data — cookie identifiers; analytics data; website usage; campaign attribution; newsletter subscription data; marketing preferences. Tools may include Google Analytics, Google Tag Manager, PostHog, Microsoft Clarity, HubSpot, Meta, LinkedIn, TikTok, and Google Ads, as described in the Cookie Policy.

We rely on contract, legitimate interests, consent, and legal obligation, as applicable.

• Website operation — load, secure, and operate the site. Legitimate interests.
• Account and authentication — create and manage accounts, including Sign in with Google where enabled. Contract.
• Providing the Services — operate Brand Atlas, including brand profile, knowledge, products, claims/check/gateway, image generation, Connect/MCP, credits, and related features. Contract.
• Billing — subscriptions, invoices, extra-usage charges, tax. Contract and legal obligation.
• Support, onboarding, demos — service communications and meetings. Contract and legitimate interests.
• Security, debugging, product improvement — logs and usage data to keep the Services safe and working. Legitimate interests.
• Marketing — product updates, educational content, and newsletters. Consent where required; otherwise legitimate interests. You can unsubscribe at any time.
• Cookies and similar technologies — strictly necessary cookies to operate the website and platform. Analytics, performance, advertising, and marketing cookies only where required consent has been obtained. See the Cookie Policy. Website Google Analytics / Tag Manager measure our sites. That is not a connection to your Google Analytics or Search Console properties (we do not offer that integration).

You retain ownership of Customer Data.

We use it only as reasonably necessary to provide, maintain, secure, and support the Services; prevent fraud and abuse; improve performance and functionality of the Services; and comply with law.

We do not use your Customer Data to train our own foundational artificial intelligence models.

To provide the Services we send relevant Customer Data (for example prompts, brand context, images, or copy you submit for a check or generation) to third-party model and infrastructure providers acting as our processors or sub-processors. Those providers process the data to return the requested output. We do not sell Customer Data.

If you submit personal data into the platform, you must have a lawful basis and the rights to do so.

If you store your own API keys (for example OpenAI, Anthropic, or Google Gemini) in Brand Atlas, we encrypt them and use them only to provide the connected feature you requested. That is not Sign in with Google — see section 5.2.

5.1 Sign in with Google (Google Identity / OAuth)

If you choose Sign in with Google or Sign up with Google, we authenticate you through Google’s OAuth consent screen (via Supabase Auth). You can always use email and password instead.

This is Google account login. It is not a connection to Google Analytics, Google Search Console, Gmail, Drive, or other Google product APIs. We do not request those scopes.

Information we access

Depending on what you grant in Google’s consent screen, we may receive:

• your Google account email address;
• your name as held on the Google account;
• a Google user ID;
• a profile image URL, if Google provides one; and
• OAuth tokens required to complete sign-in and keep the session (handled by Supabase Auth).

We request only the identity permissions reasonably necessary to create and authenticate your Brand Atlas account (typically email, profile, and OpenID).

How we use Google Sign-In data

We use this information only to:

• create or link your Brand Atlas account;
• authenticate you on later visits;
• show your name and avatar in the workspace where the product displays account identity; and
• maintain, secure, and troubleshoot sign-in.

We do not use Google Sign-In data for advertising, retargeting, determining creditworthiness, selling information, or building unrelated databases.

We do not use Google Sign-In data, or data derived from it, to train or improve general-purpose or foundational artificial intelligence models.

Storage, sharing, retention, and revocation

Google identity data used for login is stored with your account (via Supabase Auth) with the same safeguards as other account data.

We do not sell Google Sign-In data. We may share it with service providers acting on our behalf only where necessary to operate authentication (in particular Supabase). We do not disclose one customer’s Google Sign-In data to another customer.

You may disconnect Brand Atlas from your Google Account in your Google Account permissions. After that, Sign in with Google will stop working for that account until you reconnect. You can also delete your Brand Atlas account as described in the product and in section 8.

Brand Atlas’s use and transfer of information received from Google APIs for Sign in with Google adheres to the Google API Services User Data Policy, including the Limited Use requirements, for the identity scopes we request.

5.2 Google Gemini and other Google model API keys (not Google login)

Some workspaces can store a Google / Gemini API key (bring-your-own-key) so Brand Atlas can call Google’s model APIs on your behalf for features such as generation or claims checks.

That key is a secret you paste into Brand Atlas. It is not Sign in with Google, and it does not give us access to your Google Account, Gmail, Drive, Analytics, or Search Console.

We encrypt stored keys, use them only to provide the feature you enabled, and do not use that API traffic to train our foundational models. You can remove the key in the product at any time.

We do not sell personal data.

We share it with service providers that help us run Brand Atlas, including:

• cloud hosting and infrastructure (including Google Cloud and Netlify);
• database, auth, and storage (Supabase), including Google as identity provider when you use Sign in with Google;
• payment processing and tax (Stripe);
• AI and model providers (including OpenAI, Anthropic, and Google, depending on the feature);
• scheduling (Calendly, when you book a demo);
• analytics, tag management, and marketing measurement (including Google Analytics, Google Tag Manager, PostHog, Microsoft Clarity, HubSpot, Meta, LinkedIn, TikTok, and Google Ads, depending on consent);
• customer-connected integrations you enable (for example MailerLite or Webflow); and
• professional advisers where needed.

MCP hosts (for example ChatGPT, Claude, or Cursor) receive data you send through those tools under your use of those products; their terms and privacy policies also apply.

We may disclose data if required by law, to protect rights and security, or in a merger, acquisition, or sale of the business.

A current list of material sub-processors is available on request.

Some providers process data outside the UK or EEA. Where required, we use safeguards such as adequacy regulations, the European Commission’s Standard Contractual Clauses, and/or the UK International Data Transfer Addendum.

We keep personal data only as long as needed for the purposes in this Policy, including legal, tax, security, and dispute-resolution requirements.

Typical periods:

• Account and workspace data — for the life of the account, then deletion or anonymisation after closure (workspace deletion in-product removes brands, files, and integrations as described in the product). Google Sign-In identifiers are removed with the account, subject to backups and legal holds.
• Billing records — as required by accounting and tax law.
• Support and demo records — as reasonably needed for follow-up and records.
• Logs — as reasonably needed for security, debugging, and operations.
• Marketing — until you unsubscribe, plus a limited suppression record where needed.
• Customer Data — until you delete it, instruct us to remove it, or we delete it after account closure, subject to backups and legal holds.

Under the UK GDPR and, where applicable, the EU GDPR, you may have the right to be informed, access, rectify, erase, restrict, object, port certain data, withdraw consent, and lodge a complaint with a supervisory authority.

We will respond to valid requests without undue delay and, in most cases, within one month.

Email hello@brandatlas.ai with the subject DATA PROTECTION REQUEST.

If you are not satisfied, you may complain to the UK Information Commissioner’s Office (ICO) or your local EU authority.

See our Cookie Policy for cookies and similar technologies on the website and, where applicable, the platform.

We use technical and organisational measures appropriate to the data, including encryption in transit and at rest for sensitive credentials, access controls, authentication, logging, and vendor review. No system is completely secure.

The Services are not intended for children. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data to us.

We may update this Policy. Material changes will be indicated by an updated “Last updated” date and, where appropriate, other reasonable notice.

Brand Atlas, operated by Conscious Ventures Ltd

Company number 13189124

139 Middle Deal Road, Deal, England, CT14 9RJ

hello@brandatlas.ai