BrandcastHQ LLC ("BrandcastHQ," "we," "us") is committed to protecting your privacy. This policy explains how we collect, use, and protect your information when you use our marketing automation platform, website builder, and related services.

1. Information We Collect

• Business information: Name, address, contact details, and social media account information provided during onboarding
• Payment information: Billing data processed securely via Helcim — we never store full card numbers
• Usage data: Login times, feature usage, and content performance metrics
• Content data: Photos, brand guidelines, and materials you provide for automated publishing
• Analytics data: Social media performance data pulled from connected platform APIs on your behalf
• Website data: If using BrandcastHQ Website Builder — visitor analytics and form submissions from your site
• EULA signature data: Your typed name, timestamp, browser fingerprint, and IP address recorded at agreement acceptance

2. BrandcastHQ AI & Your Data

Our platform uses BrandcastHQ AI, our proprietary artificial intelligence engine. Key facts:

• Your business data is used only to generate relevant content for your accounts
• Your data is NOT used to train any external AI model or shared with other clients
• BrandcastHQ AI operates under strict data processing agreements with all technology partners
• All content generated by BrandcastHQ AI for your accounts belongs entirely to you
• The underlying technology and data processing methodology of BrandcastHQ AI is confidential

3. How We Use Your Information

• To deliver and improve BrandcastHQ's automation and website services
• To generate content tailored to your business via BrandcastHQ AI
• To publish content to your connected platforms on your behalf
• To send daily reports, content previews, and service communications
• To process payments and send billing communications
• To maintain records of agreement acceptance (EULA compliance)
• To respond to support requests and comply with legal obligations

4. Data Sharing

We do not sell your data. We share data only as required to deliver the Service:

• Technology partners within BrandcastHQ AI (operating under strict processing agreements — no data retained for training)
• Social media platform APIs (Meta, YouTube, TikTok, Reddit, Google) to publish your content
• Helcim — for payment processing
• SendGrid — for email notifications and reports
• Cloudflare R2 — for secure media file storage
• n8n (self-hosted) — our automation orchestration platform, running on Railway

5. Data Retention

We retain your data for the duration of your subscription plus 90 days after cancellation, after which it is permanently deleted. Content logs are retained for 12 months for performance analysis. EULA signature records are retained for 7 years as required by law.

6. Your Rights

You have the right to: access your data, correct inaccurate data, request deletion, export your data in a portable format, and opt out of non-essential communications. Contact privacy@brandcasthq.com to exercise these rights. Requests processed within 30 days.

7. Security

We implement industry-standard security measures including TLS encryption in transit, encrypted API token management, secure credential storage, and role-based access controls. API tokens are encrypted at rest and never exposed in plain text. Social media credentials are stored using AES-256 encryption.

8. Cookies

brandcasthq.com uses essential cookies for session management and analytics cookies to improve our services. You may opt out of analytics cookies via your browser settings. We do not use advertising or tracking cookies.

9. GDPR, CCPA & UAE Compliance

EU clients: We serve as Data Processor under GDPR. Contact legal@brandcasthq.com for Data Processing Agreements (DPA).

California clients: Additional rights apply under CCPA. Contact privacy@brandcasthq.com.

UAE clients: We comply with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.

10. Children's Privacy

BrandcastHQ's services are for businesses and are not directed at individuals under 18. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email 14 days before taking effect. Continued use after the effective date constitutes acceptance.