1. Information we collect
- Account information such as name, email address, login provider, workspace role, invited status, and authentication audit events.
- Workspace information such as tenant, brand profiles, content pillars, prompts, drafts, feedback, approvals, scheduling data, comments, analytics snapshots, usage events, and audit logs.
- Connected account information such as provider, platform, handle, provider account IDs, app-scoped Meta user IDs, granted scopes, token health, and encrypted access tokens when you authorize a connection.
- Billing information synchronized from Stripe, including customer IDs, subscription IDs, plan, billing status, billing email, webhook event IDs, and non-sensitive billing event metadata.
- Technical and security information such as request metadata, rate-limit events, error records, and job status needed to secure and operate the service.
2. How we use information
- To authenticate approved users and enforce workspace roles.
- To create, review, schedule, export, and, when enabled, publish social content at your direction.
- To connect Meta accounts, display eligible Facebook Pages and Instagram Business accounts, maintain token health, and honor granted permissions.
- To apply plan limits, process billing, investigate failed jobs, prevent abuse, and maintain auditability for approvals and publishing decisions.
- To improve reliability, security, and user experience for BrandFlow AI.
3. How we share information
We do not sell personal information. We share information with service providers only as needed to operate BrandFlow AI, including hosting, database, authentication, email or notification delivery, billing, and connected platform APIs.
When you connect a platform such as Meta, we exchange information with that platform only according to the permissions you grant and the actions you take in BrandFlow AI.
4. Meta data
For Meta integrations, BrandFlow AI may store app-scoped Meta identifiers, Facebook Page details, Instagram Business account details, granted scopes, connection metadata, and encrypted access tokens. We use that data to show account choices, attach accounts to a brand, refresh connection health, and support approved workflows.
BrandFlow AI does not use Meta-connected data for unrelated advertising profiles, resale, or unauthorized cross-context tracking.
5. Retention and deletion
We retain workspace records while the workspace is active and as needed for security, auditability, billing, legal compliance, and dispute resolution. Drafts, prompts, approvals, usage events, and audit logs may be retained to preserve content review history.
You may request deletion of account or Meta-connected data by following the Data Deletion instructions. Some records, such as billing, tax, security, and abuse-prevention logs, may be retained where required or permitted by law.
6. Security
BrandFlow AI uses role-based access controls, signed OAuth state, encrypted provider token storage, tenant-scoped records, audit logs, and plan gates to reduce unauthorized access and misuse.
No internet service can guarantee perfect security. Please contact us promptly if you believe a workspace, login, or connected account has been compromised.
7. Your choices
- You can disconnect platform accounts or request that we delete platform-connected data.
- You can request correction or deletion of account information associated with your workspace.
- You can remove BrandFlow AI from your Facebook or Instagram settings to revoke Meta access.
8. Contact
For privacy questions or requests, contact urbanminimal@urbmini.com with the subject line BrandFlow Privacy Request.