Privacy Policy
Brandealr operates a service that manages brand deal correspondence for social media creators. This policy explains what we collect, why, and what you can do about it.
In short: we access a creator's brand-deal email inbox so we can negotiate on their behalf. We only do this with their explicit permission, we never sell data, and a creator can withdraw that permission at any time, by asking us or directly from their Google account.
Who we are
Brandealr is the data controller for the information described here. You can reach us at info@brandealr.com.
What we collect
From creators who work with us
- Name, email address, phone number and messaging handles
- Shipping address, used only when a brand sends product samples
- Social media handles and publicly reported performance figures
- Rates and commercial preferences that you give us
- Payment details needed to pay you, such as a PayPal address
From a connected email account
Where a creator connects an email account, we access that mailbox to read and send brand-deal correspondence on their behalf. This includes message contents, sender and recipient addresses, subjects, timestamps and attachment names. We access it only to operate the service the creator asked us to provide.
From messaging accounts
Where a conversation moves to WhatsApp, we process the messages exchanged on our business number, along with the phone number and profile name of whoever is writing.
From brands
We keep business contact details for brand representatives who correspond with us: name, work email address, company, and notes about the deals discussed.
How we use it
- To read incoming brand enquiries and write replies on a creator's behalf
- To negotiate rates, scope and terms
- To prepare and review contracts
- To arrange and track payments
- To show each creator the status of their own deals
- To keep records of what was agreed
Automated processing
We use automated systems, including large language models, to read correspondence and draft replies. Message content is sent to our AI provider for that purpose and is not used by them to train models. A human reviews and approves messages before they are sent, except where a creator has explicitly asked for messages to send automatically.
Google user data
Where a creator connects a Google account, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We request only the access needed to read and send brand-deal email
- We do not use Gmail data for advertising
- We do not sell Gmail data
- We do not allow humans to read Gmail data except with the creator's explicit permission, to operate the service they asked for, for security purposes, or where required by law
- We do not transfer Gmail data except as needed to provide the service, comply with the law, or as part of a merger or acquisition
Who we share it with
We do not sell personal information. We share it only with service providers who help us run the service, each under contract and only for that purpose:
- Hosting and database providers — to store and run the service
- Our AI provider — to read correspondence and draft replies
- Email and messaging providers — Google and Meta, to send and receive messages on a connected account
- Payment providers — to process and route payments
We may also disclose information where required by law, or to protect our rights or someone's safety.
How long we keep it
We keep deal correspondence and records for as long as a creator works with us, and for up to seven years afterwards where we need it for tax, accounting or legal reasons. Credentials for a connected account are deleted when it is disconnected, or when we find that access to it has been revoked. Anything else is deleted on request.
How we protect it
Credentials for connected accounts are encrypted before they are stored. Access is restricted to staff who need it. Data is held with providers that use encryption in transit and at rest. No system is perfectly secure, and we cannot guarantee absolute security.
Your rights
You can ask us to give you a copy of what we hold, correct it, delete it, or stop processing it. You can withdraw our access to a connected account at any time: ask us through your creator portal or by email and we will disconnect it within two business days, or revoke it yourself from your Google account permissions page, which takes effect immediately. Depending on where you live you may have further rights under the GDPR or CCPA.
How to delete your data
Email info@brandealr.com with the subject "Data deletion". We will confirm within 7 days and complete the deletion within 30, apart from anything we are legally required to keep. A creator can also revoke our access to a connected Google account at any time from their Google account permissions page.
International transfers
We are based in the United States and our providers may process data there and elsewhere. Where information is transferred out of the UK or EEA, we rely on appropriate safeguards such as standard contractual clauses.
Children
The service is not intended for anyone under 18 and we do not knowingly collect information from children.
Changes
If we make a material change to this policy we will update the date above and, where it affects existing creators, tell them directly.
Contact
Questions or requests: info@brandealr.com