Privacy Policy

Brandeet is operated by STRATEGYMELODY - LDA, trading as Brandeet, a company based in Portugal with registered address at Rua Gandra, TecPark, Barco and VAT/tax/company registration number 519377281.

You can contact us about privacy or legal questions at support@brandeet.com.

This Privacy Policy explains how we collect, use, share, and protect personal information when you use Brandeet, including our website builder, AI features, marketing strategy tools, audits, publishing features, contact forms, billing, and newsletter.

For most information described in this Privacy Policy, STRATEGYMELODY - LDA is the controller of your personal data.

Where we process personal data contained in customer content, uploaded content, or published websites solely to provide the service to that customer, we may act as a processor or service provider on the customer's behalf.

We collect the following categories of information depending on how you use Brandeet:

• Account information, such as name, email address, password credentials, Google sign-in details, email verification status, session information, two-factor authentication status, and account settings.
• Business and marketing profile information, such as business name, language, business type, description, target audience, competitors, brand voice, active platforms, team size, marketing goals, budget preferences, email marketing interest, reflections, and additional context you provide.
• Website content, such as prompts, page structure, copy, SEO metadata, custom CSS, uploaded images, favicons, asset metadata, subdomains, custom domains, and published website settings.
• AI, audit, and usage information, such as AI prompts, generated outputs, audit context, audit findings, marketing strategies, tasks, monthly summaries, credits, storage usage, and plan-limit usage.
• Contact and support information, such as name, email address, topic, message, Cloudflare Turnstile token, and related anti-spam technical information submitted through the contact form.
• Billing information processed through Stripe, such as customer identifiers, subscription status, plan, invoice/payment metadata, tax information, and billing events. We do not store full payment card details.
• Technical and security information, such as IP address, user agent, device/browser details, authentication events, request metadata, logs, and similar operational information.

We use information to:

• Provide, maintain, secure, and improve Brandeet.
• Create accounts, authenticate users, verify email addresses, manage sessions, and support two-factor authentication.
• Create, edit, audit, publish, and host websites and related assets.
• Generate AI outputs, website content, SEO metadata, marketing strategies, summaries, and audit findings.
• Process uploads, optimize images, manage storage limits, and connect domains.
• Process subscriptions, payments, invoices, taxes, cancellations, and billing events.
• Respond to support, contact, legal, privacy, and deletion requests.
• Prevent spam, fraud, abuse, security incidents, and violations of our Terms.

When you use AI features, we may send prompts, business profile data, marketing preferences, existing website content, audit context, and related product data to third-party AI model providers so they can generate outputs for you.

We do not use your content to train our own models. Our AI providers process your data only to generate outputs for you, under their API data-protection terms. A current list of providers is available on request at support@brandeet.com.

AI outputs may be inaccurate, incomplete, or unsuitable for your business. You are responsible for reviewing outputs before using, relying on, or publishing them.

When you publish a website, the website content, images, metadata, domain or subdomain, and other public assets become available on the internet.

Public content may be crawled, indexed, cached, copied, or archived by third parties outside our control. Deleting or unpublishing content may not remove copies already held by third parties.

We use a small set of first-party cookies and browser storage to operate the service, plus self-hosted, cookie-free analytics to measure how the service is used in aggregate. On some marketing pages, that analytics tool may also record anonymised heatmaps and session replays with form inputs masked. Advertising cookies are used only with your consent, as described below.

• Authentication session cookies, such as better-auth.session_token, better-auth.convex_jwt or secure-prefixed equivalents, keep you signed in. Strictly necessary. Up to 7 days by default.
• OAuth flow cookies, such as better-auth.state or better-auth.pkce_code_verifier, are set temporarily during Google sign-in to prevent CSRF. During two-step verification, better-auth.two_factor holds your pending sign-in for up to 10 minutes, and better-auth.trust_device, set only if you choose to trust the device, skips the code on it for 30 days. Strictly necessary.
• better-auth.last_used_login_method remembers whether you last used email or Google sign-in. Functional. 30 days.
• NEXT_LOCALE stores your language preference. Functional. 1 year.
• Theme preference is stored under the theme key in your browser's local storage to remember light or dark mode. Functional.
• brandeet.newsletter_popup remembers whether you dismissed or accepted the landing-page newsletter prompt so we do not show it to you again. Functional. Kept until you clear it; after a dismissal the prompt stays hidden for 30 days.
• Cloudflare Turnstile is used on the contact form and on the sign-up, sign-in, and password-reset pages to prevent automated abuse. It is provided by Cloudflare, Inc. and may process your IP address and device signals. See the Cloudflare Turnstile Privacy Addendum for details.
• brandeet_consent stores your choice about advertising cookies (accepted or rejected) so we do not ask again, and is shared between brandeet.com and app.brandeet.com. Strictly necessary. 6 months.
• Meta Pixel (Meta Platforms Ireland Limited) loads only after you accept it in the cookie banner. It sets the _fbp cookie (plus _fbc, which keeps the ad click identifier, when you arrive from a Meta ad) and reports page views and events such as sign-ups, checkouts, and contact requests to Meta so we can measure and improve our advertising on Facebook and Instagram. Advertising. 90 days. You can change your choice at any time via 'Cookie preferences' in the footer. See Meta's Privacy Policy for how Meta uses this data.
• brandeet.editor_panels remembers the widths you set for the editor's side panels. A layout preference only. Functional. Persistent until you clear it.
• brandeet-editor-copied remembers what you last copied in the editor (its name and how many elements) so the Paste menu can name it, also on another page. The copied content itself stays in your device's clipboard. Functional. Session storage, cleared when you close the tab.
• brandeet-editor-style keeps the last style you copied in the editor (the copied element and its styling) so you can paste it onto another element or page. Functional. Session storage, cleared when you close the tab.
• brandeet_ref remembers which partner referred you when you arrive through a partner link, so the referral can be credited when you sign up. It holds only the partner's code, when it was set and a signature. Functional. Up to 60 days; on app.brandeet.com it is removed once the referral has been processed.
• better-auth.message is written to your browser's local storage when your session changes, so your other open tabs sign in or out too. It holds only the kind of change, a random tab identifier and the time. Strictly necessary. Kept until you clear it.

You can clear or block cookies in your browser settings. Disabling strictly necessary cookies will prevent you from signing in or using parts of the service.

If you subscribe to our newsletter, we use a newsletter provider to manage subscriptions and send emails. Newsletter signup uses double opt-in, and every newsletter includes an unsubscribe link.

When you contact us, we use your contact details and message to respond. We use Cloudflare Turnstile to prevent automated submissions and an email delivery provider to deliver contact emails to our team.

• Service, security, billing, account, and support messages may be sent as needed to provide Brandeet.
• Newsletters are sent only where you have explicitly opted in. As an account holder you may also get occasional emails suggesting a paid plan, for example when you reach a plan limit, sometimes with a time-limited discount. You can turn these off in account settings or with the unsubscribe link in each one.

We share information with service providers that help us operate Brandeet, by category: cloud hosting and infrastructure; database, background processing, and authentication; file storage, content delivery, domains, and publishing of websites; AI model providers; payment processing (Stripe); sign-in and fonts (Google); anti-abuse protection (Cloudflare Turnstile); stock images (Pexels); transactional email and newsletter delivery; and, only with your consent, advertising measurement (Meta Platforms Ireland Limited). A current list of our providers is available on request at support@brandeet.com.

We may also disclose information with your consent or direction, to comply with law, to protect rights and safety, to investigate abuse, or as part of a merger, acquisition, financing, reorganization, or sale of assets.

We and our providers may process information in countries outside Portugal and the European Economic Area, including the United States. Where required, we use appropriate safeguards such as adequacy decisions, standard contractual clauses, data processing agreements, or equivalent transfer mechanisms.

We keep account data while your account is active. We keep website and published site data, uploaded assets, business profile, marketing profile, audits, and AI outputs while your account is active or until deleted or requested. Contact and support messages are kept for up to 24 months. Newsletter records are kept until unsubscribe or deletion request, subject to suppression records needed to honor opt-outs. Security, authentication, and session logs are kept for up to 12 months. Billing, invoice, tax, and accounting records are kept as required by Portuguese and EU law. Backups may be retained for up to 90 days before rolling deletion.

When you delete your account, your published websites go offline immediately. By default, your account is kept for 30 days so you can restore it by signing in, unless you explicitly choose immediate permanent deletion. At the end of that period, or when you choose immediate permanent deletion, we permanently delete your account, websites, uploaded files, business and marketing data, AI outputs and audits. Backups may keep copies for up to 90 more days before rolling deletion.

Some records are kept after deletion because the law requires it. Invoices, receipts and the billing records behind them, including those held by Stripe and our certified invoicing software, are kept for the period required by Portuguese tax law, currently 10 years. Partner commission and payout records are kept as accounting records. This retention is based on a legal obligation (GDPR Articles 6(1)(c) and 17(3)(b)). For any other privacy request, contact support@brandeet.com.

Depending on your location, you may have rights to access, correct, delete, export, object to, restrict processing of, or withdraw consent for certain personal data. You may also have the right to lodge a complaint with your local data protection authority.

To make a request, contact support@brandeet.com. We may ask for information to verify your identity and aim to respond within 30 days, unless the request is complex or law permits more time.

We use technical and organizational measures designed to protect personal information, including access controls, authentication, encrypted transport, provider security controls, and operational safeguards. No method of transmission or storage is completely secure.

Brandeet is not directed to children or anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact support@brandeet.com and we will take appropriate steps.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the service, by email, by updating the effective date, or by another reasonable method. Questions about this Privacy Policy can be sent to:

support@brandeet.com