Privacy Policy

1. Overview

This privacy policy explains which personal data we process when you visit our website branddad.io, contact us or use the Brand Dad platform, for which purposes, and which rights you have. Personal data is any data that can be used to identify you personally.

2. Controller

The controller is SVIX Media, owner Konstantin Botschmanowski, Schulstraße 72, 41372 Niederkrüchten, Germany. Email: support@branddad.io. SVIX Media is also the provider and contracting party for the use of Brand Dad.

3. Legal bases

We process personal data under the General Data Protection Regulation (GDPR), in particular:

• Art. 6(1)(a) GDPR – your consent,
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures,
• Art. 6(1)(c) GDPR – legal obligations (e.g. retention under commercial and tax law),
• Art. 6(1)(f) GDPR – legitimate interests, such as the secure and economical operation of the website.

Storing information on your device or accessing it is additionally governed by Section 25 of the German TDDDG.

4. Hosting and server log files

The website, platform, database and the customer websites built with Brand Dad run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany. Encrypted backups are also stored at Hetzner in Germany. We have a data processing agreement with Hetzner.

When you access our pages, the server automatically processes technical data sent by your browser: IP address, date and time, page requested, referrer URL, browser type and version, and operating system. This is required to deliver the website and keep it secure (Art. 6(1)(f) GDPR). We do not combine this data with other data sources.

5. Cookies and local storage

Our website does not set tracking or advertising cookies and does not embed third-party analytics or advertising services. We only use strictly necessary storage (Section 25(2) no. 2 TDDDG):

• bd_lang – stores the language you deliberately chose in the language switcher so that we do not redirect you to another language version on your next visit. Content: only the language code (e.g. "en"). Duration: 1 year. The cookie is only set when you switch the language.
• Login and security cookies – after you log in, a session cookie keeps you signed in and protects forms against misuse. These cookies only exist in the platform.
• Display settings in the platform (e.g. whether the sidebar is collapsed).

You can delete cookies in your browser at any time. Without the login cookies, you cannot log in.

6. Contact form and email

When you write to us via the contact form or by email, we process your name, email address, subject, message and, to prevent misuse, your IP address. The inquiry is stored in our database and forwarded to our inbox by email. We use the data only to answer your inquiry (Art. 6(1)(b) GDPR for contract-related inquiries, otherwise Art. 6(1)(f) GDPR). We store contact inquiries including the IP address for 12 months and delete them afterwards unless statutory retention obligations apply or the inquiry has led to a contract.

7. Customer account and use of the platform

For an account we process your name, email address and password (stored only as a salted hash) or, if you sign in with Google, the basic data provided by Google (name, email address, profile picture). We also store the data you enter or create in Brand Dad, such as business details, website content, keywords, posts, images and settings, as well as usage and billing information (plan, trial, quotas).

The legal basis is Art. 6(1)(b) GDPR. For security, error analysis and abuse prevention, we process technical logs on our own servers based on Art. 6(1)(f) GDPR.

8. Payment processing

Payment is not enabled yet: Brand Dad can only be tried for free, and a chosen plan is merely saved. We therefore do not process payment data at the moment.

Once payment is enabled, the following applies: Brand Dad is offered exclusively to businesses; all prices are subject to statutory VAT. SVIX Media is the provider of the service and the contracting party for the use of Brand Dad. The purchase of the subscription is handled by Paddle as reseller and merchant of record (Paddle.com Market Ltd, Judson House, 5th Floor, 250 City Road, London EC1V 2PU, United Kingdom). Paddle processes your payment and billing data (e.g. credit card, PayPal, billing address) under its own responsibility and issues the invoice. We only receive the information from Paddle that is necessary to handle the contract, such as payment status, subscription status and billing address.

The legal basis is Art. 6(1)(b) and (c) GDPR. An adequacy decision of the EU Commission exists for the United Kingdom. More information: https://www.paddle.com/legal/privacy.

9. AI features – no training with your data

For AI copy, AI images, reply drafts and research, we only send the content required for the respective task (e.g. business details, keywords, drafts, review texts) to AI providers. This happens via the aggregator OpenRouter (OpenRouter, Inc., USA) to models from providers such as OpenAI, Anthropic or Google, and in part directly to OpenAI (OpenAI, L.L.C., USA) and Anthropic (Anthropic PBC, USA). To research sources for articles, we send search queries only to Tavily (AlphaAI Technologies Inc., USA).

Your content is not used to train AI models – neither by us nor for our benefit. When selecting and configuring AI providers, we make sure that inputs are not used for training under their terms. Please do not enter sensitive data of third parties in AI features.

The legal basis is Art. 6(1)(b) GDPR. For transfers to the USA, see section 16.

10. Connected accounts (Google, Meta, TikTok)

You decide which accounts you connect to Brand Dad. We request permissions via OAuth, store the access tokens encrypted and use them only for the features you use.

• Google Business Profile: reading and managing profile data, posts and reviews. Replies to reviews are created as drafts and only published after your approval (or automatically if you explicitly switch this on).
• Google Search Console (optional, scope auth/webmasters): reading search queries with clicks, impressions and position to show rankings and suggest topics; re-submitting sitemaps already registered after a publication; URL inspection to check whether published articles are indexed. We do not change properties, users or settings. Search queries may be passed to the AI providers in section 9 to suggest topics; they are not used for training.
• YouTube API Services: uploading the videos you schedule, reading channel name and avatar and, if you enable it, posting a comment under your own video. The YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy) apply. We do not access data of other YouTube users.
• Meta (Facebook, Instagram): publishing your scheduled posts via the Graph API and retrieving metrics. We do not access private messages.
• TikTok (once approved by TikTok; the app review is pending): publishing your videos via the Content Posting API.

Google API Services User Data Policy: Brand Dad's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not sell this data, do not use it for advertising and only share it with the processors named in this policy that are required for the feature.

Revocation: you can disconnect any connection at any time in the dashboard or in the security settings of the respective service, Google connections also at https://myaccount.google.com/permissions. When you disconnect in Brand Dad, we revoke the token at the provider and delete it from our database. We delete data from Google APIs together with the project or account; encrypted backups are overwritten after 14 days. More under Data deletion.

The legal basis is Art. 6(1)(b) GDPR.

11. Data security

• All connections are encrypted with TLS (HTTPS); HSTS enforces encrypted connections.
• OAuth tokens, API keys and credentials of connected platforms are stored encrypted with AES-256-GCM; the key is kept separately from the database. Passwords are only stored as a salted bcrypt hash.
• Backups are encrypted with AES-256 before they leave the server, stored in Germany and overwritten after 14 days.
• Database and application servers are not directly reachable from the Internet. Every request is authenticated; users only see data of their own projects. Tokens are only decrypted in server memory and never sent to the browser.
• In the event of a personal data breach, we notify the supervisory authority and affected persons in accordance with Art. 33 and 34 GDPR.

12. SEO, map and research services

For keyword research, ranking scans, backlink and SERP analyses we send search terms, locations or coordinates and public URLs to DataForSEO (DataForSEO OÜ, Estonia, EU) and ScrapingRobot. DataForSEO receives keywords, domains, business names and the locations of grid points; no personal data of end customers is intended for this. For website analyses we use Google PageSpeed Insights, for business searches the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). No personal data of our users is transmitted, only business-related search terms and public business data.

Map tiles (OpenStreetMap) are loaded via our own server; your IP address is not passed on to OpenStreetMap.

13. Domains and email

When you order a domain via Brand Dad, we send the holder data required for registration (e.g. name, address, email address, phone number) to our registrar Dynadot (Dynadot Inc., USA) and the responsible registry (e.g. DENIC eG for .de). Depending on the domain extension, registries may publish certain data in lookup services (WHOIS/RDAP) under their policies. The legal basis is Art. 6(1)(b) GDPR.

We send emails (e.g. contact inquiries, notifications, form forwarding) via our own mail server at Hetzner in Germany and, for certain system notifications, via Resend (Resend, Inc., USA).

14. Free Google profile check

On our website we offer a free check of a Google Business Profile and its local visibility on Google Maps ("free check"), usable without an account.

• Purpose: you search for a business, choose a search term and start the check. We show you a profile score with tips, the position of the business in Google Maps at 25 points of a map grid around its address and the three most visible competitors. We also use stored checks to measure the use of the tool, to prevent misuse and to understand whether a check leads to a free trial.
• Data processed: the selected business (Google place ID, name, address, category and the public profile data returned by Google), your search term, the result, the language of the page, time and version of your consent, a hash of your IP address (SHA-256 with a secret salt that changes daily – we never store the IP address itself), a shortened browser identification (max. 160 characters), the referring page without query parameters and, if present, UTM campaign parameters. If you later start a free trial from the result, we link the check to your new account.
• Legal basis: Art. 6(1)(a) GDPR – your consent, given by actively ticking the checkbox before the check starts (not pre-ticked). Protection against misuse and daily limits (rate limits, optional bot protection) are based on our legitimate interest in the secure and cost-controlled operation of the tool (Art. 6(1)(f) GDPR). You can withdraw your consent at any time with effect for the future by email to support@branddad.io; the lawfulness of processing carried out until the withdrawal remains unaffected.
• Recipients: to search for and load the business, your search text and the place ID are sent to Google (Google Places API; Google Ireland Limited and Google LLC, USA – https://policies.google.com/privacy). For the map grid, the search term and the coordinates of the 25 grid points are sent to DataForSEO. We do not pass your IP address on to these providers. If Cloudflare Turnstile is active as bot protection, Cloudflare, Inc. (USA) processes technical browser data to tell humans from bots (https://www.cloudflare.com/privacypolicy/) – also only after you started the form.
• Storage period: IP hash, browser identification, referrer and an optionally provided email address are anonymized after 90 days. Checks including the result are deleted after 12 months unless they have become part of a customer account. Results for the same business and search term are reused for 7 days.
• No automated decisions: the score and tips are generated automatically from public profile data and have no legal effect on you.

15. Data of visitors to customer websites

Websites that our customers build with Brand Dad may contain contact, booking and order forms as well as online payments. For the data collected there (e.g. name, contact details, requested appointment, message, order), the respective customer as the website operator is the controller. Brand Dad only processes this data on the customer's behalf as a processor (Art. 28 GDPR). Information can be found in the privacy policy of the respective website; it is best to exercise your rights directly with the website operator.

Our data processing agreement (DPA) applies to this; it becomes part of the contract with our customers when they accept the Terms of Service.

Special categories of personal data (Art. 9 GDPR), in particular health data, are not intended for these forms. Customers such as medical practices, therapists or care services must not request health data via booking and contact forms unless they have checked and established the legal requirements themselves. We ask visitors of such websites not to enter health information in free text fields.

The built-in visitor statistics of customer websites work without cookies and without storing IP addresses.

16. Recipients, processors and third-country transfers

We only share personal data where this is necessary for the purposes described. We use the following service providers:

• Hetzner Online GmbH, Germany – hosting, database, backups, own mail server
• OpenRouter, Inc., USA, and the AI providers connected through it (e.g. OpenAI, Anthropic, Google); OpenAI, L.L.C., USA; Anthropic PBC, USA – AI features
• Tavily (AlphaAI Technologies Inc.), USA – web research for article sources, receives search queries only
• Paddle.com Market Ltd, United Kingdom – purchase of the subscription as reseller/merchant of record under its own responsibility, once payment is enabled
• Resend, Inc., USA – sending system emails
• DataForSEO OÜ, Estonia (EU), company no. 14502291 – search, ranking and keyword data
• ScrapingRobot – retrieval of public search results and web pages for research
• Google Ireland Limited / Google LLC, USA – Places API and PageSpeed Insights; Business Profile API, Search Console API, YouTube and Sign in with Google only if you connect or use them
• Dynadot Inc., USA – domain registration
• Cloudflare, Inc., USA – bot protection (Turnstile) for the free check, if enabled
• Meta Platforms Ireland Ltd. (Facebook, Instagram) and TikTok (once approved) – only if you connect these accounts and publish content

Where data is transferred to countries outside the EU/EEA, in particular the USA, we base the transfer on an adequacy decision of the EU Commission – for the USA the EU-U.S. Data Privacy Framework, where the recipient is certified – or on the EU standard contractual clauses (Art. 46(2)(c) GDPR), for example for Tavily. You can request a copy of the safeguards.

17. Storage period

We store personal data only as long as necessary for the respective purpose. We delete account data when you delete your account or the contract ends and no retention obligations apply. Invoices and accounting records are retained for up to ten years under commercial and tax law. Specific periods are stated in the individual sections.

18. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR) – you can receive the data you provided to us in a structured, commonly used and machine-readable format or have it transmitted to another controller
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

Right to lodge a complaint (Art. 77 GDPR): you can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

An email to support@branddad.io is enough for all requests.

19. Obligation to provide data and automated decisions

We need the details for an account and a booking to conclude and perform the contract; without them, use is not possible. There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR.

20. Changes

We update this privacy policy when our services or the law change. The version published here applies. Our Terms of Service apply in addition.