Last updated: 14 June 2026
1. Who we are
This service, "BrandBrain", is operated by Lambda Labs Ltd, a company registered in England & Wales (company number 08237675). Lambda Labs Ltd is the data controller responsible for your personal data.
For any privacy or data-protection question, or to exercise your rights, contact us at [email protected]. Our postal address is available on request via [email protected].
2. What data we collect
Account information
Your email address, name, and profile image when you create an account or sign in.
Connected account data
When you connect a third-party platform (for example Google, LinkedIn, X, Meta, TikTok, or Bluesky), we receive and store the account data and the access and refresh tokens needed to act on your behalf. We use these only to provide the features you have asked for.
Content you create
The posts, drafts, briefs, media, schedules, and other content you create, upload, or manage through the platform.
Billing data
Subscription and payment details, processed by Stripe. We do not store full card numbers ourselves; Stripe handles card data.
Support communications
Messages you send us and the records of our correspondence.
Technical, usage, and analytics data
Technical data such as IP address, browser and device information, and how you use the service. Analytics data (via PostHog) is collected only after you accept analytics cookies.
Cookies
Strictly necessary cookies for sign-in and your preferences, and (with consent) analytics cookies. See our Cookie Policy for details.
3. How we use your data, and our legal basis
- To provide the service you have signed up for, including account access, content creation, scheduling, and publishing to your connected platforms (legal basis: performance of our contract with you).
- To keep the service secure, prevent abuse, and improve the product (legal basis: our legitimate interests in running and improving a safe service).
- To run analytics and any marketing communications (legal basis: your consent, which you can withdraw at any time).
- To meet our legal and regulatory duties, such as tax and accounting record-keeping (legal basis: compliance with a legal obligation).
4. Cookies and analytics
We set strictly necessary cookies that are required for the site to work, and these need no consent. Analytics cookies (PostHog) are set only after you accept them, and you can change or withdraw your choice at any time using the "Cookie settings" control in the footer. Full details, including the specific cookies used, are in our Cookie Policy.
5. AI processing
We use AI providers to generate and process content within the features you use. We do not use your personal content to train AI models, and we do not share it with other users. Content is sent to AI providers only as needed to deliver the feature you have requested.
6. Sharing and sub-processors
We share personal data with the service providers (sub-processors) below, only as needed to provide the relevant feature. Each is bound by appropriate contractual protections.
| Provider | Purpose |
|---|---|
| PostHog (EU region) | Product analytics, used only after you accept analytics cookies. Hosted in the EU. |
| Stripe | Payment processing and subscription billing. |
| Resend | Sending transactional and account emails. |
| Sign-in (Google OAuth) and, where you connect them, the Google Ads and YouTube APIs. | |
| Hetzner Online GmbH | Servers running the application, the database, and the real-time backend. Germany (Nuremberg, Falkenstein); orchestration in Finland (Helsinki). |
| Cloudflare, Inc. | Content delivery, DNS, and object storage for files and media. Storage region: Asia-Pacific. |
| OpenRouter, OpenAI, Anthropic, Fireworks, xAI | Large language model providers used to generate and process content within the features you use. |
| Fal.ai, ElevenLabs | AI media generation (images, video, and voice) used to deliver content features. |
| Apify, Serper | Research and data-gathering used to power discovery and trend features. |
| Qdrant | Vector search used for retrieval and similarity features. |
| Meta (Instagram, Threads), X (Twitter), LinkedIn, TikTok, Bluesky | Social platforms you choose to connect and publish to. Content is shared only when you authorize and schedule it. |
We may also disclose data where required by law, court order, or to protect our rights, users, or the safety of others.
7. International transfers
Some of our processors are located outside the UK and EEA. Where personal data is transferred internationally, we rely on appropriate safeguards, such as UK adequacy decisions or Standard Contractual Clauses (and the UK International Data Transfer Addendum, the IDTA, where applicable).
8. Data retention
We keep your account data for as long as your account is active and for a reasonable period afterwards. Billing and accounting records are kept for about six years to meet UK tax law. Analytics data is retained according to PostHog's retention settings. When data is no longer needed, we delete or anonymise it.
9. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data deleted (erasure), where applicable;
- restrict how we process your data;
- receive your data in a portable format (data portability);
- object to processing based on legitimate interests;
- withdraw consent at any time, where processing is based on consent (this does not affect processing done before withdrawal).
To exercise any of these rights, email us at [email protected]. We will respond within one month. For complex or numerous requests this may be extended by up to two further months, and we will let you know if that applies. Requests are handled by email; the service does not currently offer self-serve account deletion or data download in the app.
10. Complaints
If you are concerned about how we handle your data, please contact us first at [email protected] so we can help. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.
11. Children
This service is not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us at [email protected] and we will remove it.
12. Changes to this policy
We may update this policy from time to time. We will update the "last updated" date above and, for significant changes, notify you by email or within the service.
13. Contact
Lambda Labs Ltd (company number 08237675), England & Wales. For any privacy question or to exercise your rights, email [email protected]. Our postal address is available on request via [email protected].