BrandPurl is operated by Yunuo Fang Cultural Creative Limited (予諾舫文創有限公司), a company registered in Hong Kong with its registered address at Room D3, 11/F, Luk Hop Industrial Building, 8 Luk Hop Street, San Po Kong, Kowloon, Hong Kong ("we", "us", "our"). This Privacy Policy explains how we collect, use, and protect information when you use our website, application, and APIs (collectively, the "Service"). By using the Service you agree to this policy.
1. Information we collect
- Account data. When you sign up we receive your email address (and, for SMS login, your phone number) from our identity provider (Supabase).
- Brand data. Anything you create inside BrandPurl — brand profiles, product URLs, generated posts, uploaded images and video.
- AI prompts and output. Text prompts, reference images, and the content, images, and video our AI features generate for you.
- Connected accounts. Upload-Post manages the authorization flow for supported social platforms (including Facebook, Instagram, LinkedIn, Pinterest, Reddit, Threads, TikTok, X, YouTube, and Google Business). BrandPurl receives connection status, platform profile identifiers, and publishing results for the brand workspace. We never receive your social-platform passwords — only OAuth tokens.
- Usage data. Standard request logs (IP, user-agent, timestamps) used for security and abuse prevention; retained no longer than 90 days.
- Payment data. When you purchase credits or a subscription, payment information is processed by Stripe. We never see or store your full card number — only transaction records, order identifiers, and (where Stripe provides it) the card's last 4 digits.
2. How we use information
- To generate and store the social-media content, images, and video you ask us to produce.
- To publish or schedule posts to platforms you have explicitly connected.
- To operate, secure, and improve the Service — including debugging and abuse detection.
- To process payments, manage your credit balance, and send billing receipts.
- To send you transactional emails (sign-in confirmations, billing receipts, security alerts).
We do not sell or rent your data. We do not use your private brand content or AI prompts to train public generative-AI models.
3. Legal bases for processing
Where the Personal Information Protection Law of China (PIPL), Hong Kong's Personal Data (Privacy) Ordinance (PDPO), the EU/UK GDPR, or similar laws apply, we rely on: performance of our contract with you (providing the Service you signed up for); your consent (for example, connecting a social account or agreeing to cross-border transfer as described in Section 6); our legitimate interests (security, fraud prevention, and improving the Service); and compliance with legal obligations (tax and accounting records).
4. Third-party processors
- Supabase — authentication and primary database.
- Cloudflare R2 — image and media storage.
- Upstash — rate limiting / queues.
- MiniMax, OpenAI, Google Gemini, Volcengine (ARK) — generative AI inference for text, image, and video (the specific provider used depends on the feature and model configuration in effect at the time).
- Stripe — payments and billing.
- Upload-Post — connection management and delivery to supported social platforms.
- Firecrawl, Jina — fetching and parsing publicly available web pages you ask us to use as source material.
We do not sell your data to any of these providers, and each processes data only as needed to provide their service to us.
5. How we protect provider credentials
BrandPurl's provider API credentials are stored only on the server and are not sent to the browser. Each brand uses an isolated Upload-Post profile identifier. Platform authorization is managed by Upload-Post and the relevant social platform; you can disconnect a brand connection from the workspace at any time, which deletes the stored token immediately.
6. Cross-border data transfer
Our infrastructure runs across multiple countries and regions — for example, application servers in Tokyo and database infrastructure in the United States, alongside the processors listed in Section 4. Using the Service means your account data, prompts, uploaded media, and generated output may be transferred to and processed in countries outside mainland China or outside Hong Kong, including the United States and Japan.
We apply contractual and technical safeguards appropriate to each transfer (such as encryption in transit and processor agreements). If you are subject to PIPL, this section serves as our separate notice of overseas processing under PIPL Article 39; continuing to use the Service after reading this policy constitutes your consent to that transfer. If you do not consent, please do not use the Service. You may withdraw consent at any time by closing your account, subject to Section 9 (deletion) below. You should not upload state secrets, regulated sensitive personal information, or third-party personal data unless you have a lawful basis and any required consent for that processing.
7. AI-generated content and training
AI features are powered by the providers listed in Section 4. We send your prompts and relevant context to these providers via their API to generate output; we do not use your prompts or output to train our own or any third party's public models, and our provider agreements are structured to prevent your data from being retained by them for that purpose. AI output can be inaccurate, biased, or resemble third-party material — see the AI-generated content section of our Terms of Service for your responsibilities when publishing it.
8. Data retention
Account and content data are retained as long as your account is active. Backups are purged within 30 days of permanent deletion. Request logs are retained for up to 90 days. Payment and invoicing records are kept for as long as required by Hong Kong tax law (currently 7 years).
9. Your rights
- Access & export — request a copy of your data.
- Correction — update inaccurate or incomplete account or brand data yourself in the workspace, or ask us to do it.
- Deletion — request account deletion. We remove personal data within 30 days, except where retention is required by law (for example, tax and payment records).
- Withdraw consent — for anything we process based on your consent, including the cross-border transfer described in Section 6, by closing your account.
- Disconnect — revoke any third-party social connection from your dashboard. This deletes the stored token immediately.
To exercise any of these rights, email privacy@brandpurl.com. We will respond within 15 business days.
10. Data security and breach notification
We use encryption in transit, access controls, and scoped credentials to protect your data. No system is perfectly secure. If a breach occurs that creates a meaningful risk to you, we will notify affected users without undue delay — and in any event within 72 hours of confirming the breach where required by law — describing what happened, the data involved, and the steps we and you can take in response.
11. Children
The Service is not directed at anyone under 18, and we do not knowingly create accounts for minors.
12. Changes to this policy
We may update this policy from time to time. Significant changes will be announced via email and via a notice inside the app at least 14 days before they take effect.
13. Contact
Questions or requests: privacy@brandpurl.com. Our data protection contact is Jonce. Postal correspondence can be sent to Yunuo Fang Cultural Creative Limited, Room D3, 11/F, Luk Hop Industrial Building, 8 Luk Hop Street, San Po Kong, Kowloon, Hong Kong.