Privacy statement

What we process, and why

• Waitlist. Your email address and, if you fill them in, your name, company, role and what you’d like to use Brandbooks for. We use this to invite you and to ask how things are going. Basis: your request (pre-contract steps) and our legitimate interest in opening Brandbooks in a controlled way.
• Contact form. Your name, email address, optional company, topic and message, so we can answer you. Basis: legitimate interest.
• Account. Name, email address, password (stored hashed), language, the workspaces you belong to and your role there. Basis: performance of the contract.
• What you create. Brands, brandbooks, files, comments and activity in your workspace. We store and show these for you; we don’t look at them unless you ask us to help or the law requires it. Basis: performance of the contract.
• Security. Login sessions, rate limiting and a hashed (unreadable) version of your IP address on our forms to stop spam and abuse. Basis: legitimate interest.
• AI mock-ups. When you generate a mock-up photo, the design you chose and a prompt are sent to the AI model (see “Who helps us”). Only then, and only what’s needed. Basis: performance of the contract.
• Website statistics. Only if you accept analytics cookies: how visitors use brandbooks.app (pages, device type, approximate location), via Google Analytics. Basis: your consent, which you can withdraw at any time via cookie settings.

Brandbooks you publish

Brandbooks can contain personal data that our customers add, such as contact persons in a guide. For that content our customer is the controller and we process it on their behalf. Business customers can contact us about a data processing agreement.

Who helps us

We use a few carefully chosen services. Each only receives what it needs for its task:

• Vercel — hosting of the website and app, and file storage (Vercel Blob), in the Frankfurt (EU) region.
• Neon — the database, in Frankfurt (EU).
• Google (Gemini via Vercel AI Gateway) — generating AI mock-ups, only when you start one. This may be processed outside the EU.
• Google Analytics — website statistics, only with your consent.
• Resend — sending emails such as invitations, once email sending is switched on.

Outside the EU

Our data is stored in the EU. Some of the services above are American companies, and AI generation and analytics may be processed outside the EU. Where that happens, it is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

• Waitlist: until you’ve been invited and created an account, and no longer than two years after you signed up.
• Contact messages: up to two years after we handled them.
• Account and workspace data: as long as your account exists. After you delete your account or workspace, it is removed from our systems; copies in backups disappear when those backups expire.
• Website statistics: according to the retention period set in Google Analytics (at most 14 months).

Your rights

You can ask us to see, correct or delete your data, to restrict processing, to receive your data in a portable format, or object to processing. Where we rely on your consent, you can withdraw it at any time. Email hello@brandbooks.app; we’ll reply within a month.

If you think we handle your data incorrectly, please tell us first. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your country.

Security

Every page, action and download checks on the server who you are and what you may see. Files are stored privately, passwords are hashed and connections are encrypted. Read more on our security page.

Changes

We update this statement when what we do changes. The date at the top shows the latest version.