Privacy

When an account is created we store your email address, a display name, an optional profile image and your assigned role (standard user or administrator). Authentication is handled by our hosted backend provider; we never store your password.

Access to Brand Asset is limited to approved company email domains. Your email domain is used to decide whether an account can be created and which Brand Guide applies to you. Rejected registration attempts are logged with the email address used, so administrators can review access requests.

Administrators create Brand Guides by uploading or pasting brand material, or by letting the application read a public website that they specify. For website-based drafts we store the pages read, short evidence excerpts, colours, logos and the retrieval time so the draft can be reviewed. Brand Guides are visible to the users of the email domains they are assigned to.

The idea you write, the settings you choose and the optimised Asset Brief produced from them are stored against your account so you can find them again in your history. Any notes, alt text and compliance feedback generated in the process are stored with them.

Images you generate are stored in our private file storage and linked to your account and the prompt that produced them. Administrators can see generated assets for the purpose of approval, publication and administration of the workspace.

Brand Asset uses third-party AI services to optimise prompts and generate images. Information required to perform these functions — such as your idea, relevant Brand Guide instructions, website evidence when creating a guide, and generation settings — may be sent to those services for processing.

These calls are made from our servers, not from your browser. We do not make claims here about how the underlying providers retain data, where they process it, or whether it is used to improve their models; those questions are governed by the providers' own terms. Do not enter personal data or confidential material into prompts unless you are permitted to share it with an external AI service.

When you send a request through our pricing page we store your name, work email, company, company website, optional team size and your message, so we can reply and arrange onboarding. To limit abuse we also store a one-way hash of your network address, never the address itself. Inquiries are only visible to Brand Asset administrators and are emailed to our team inbox.

We log significant events such as sign-ins, prompt and image generation, approval decisions, publication and administrative changes. Logs are used for security, troubleshooting and workspace administration. When an account is deleted, its logs are kept without any link to the deleted user.

We send transactional email only: account verification, password reset, approval requests and decisions, publication notices and administrator alerts about new registrations. The same events also appear as in-app notifications. We do not send marketing email.

Data is stored in a hosted database with row-level access rules, so you can only read your own material and the Brand Guides assigned to your email domain. Generated files are kept in private storage and served through access-checked URLs. Administrative functions verify roles on the server, not in the browser.

Brand Asset relies on the following categories of provider:

• a hosted database, authentication and file storage platform;
• the Lovable AI Gateway, which routes prompt optimisation, compliance checks and Brand Guide extraction to a Google Gemini text model, and image generation to an OpenAI image model;
• an email delivery provider for transactional messages;
• application hosting and content delivery.

Models and providers can change as the product evolves; the categories above describe how your data is used regardless of which specific model is in place.

Account data, prompts, Asset Briefs and generated images are kept for as long as the account exists and the workspace needs them. An administrator can delete an account; this removes the profile and the user's saved prompts and images, and detaches remaining log entries from the person. Ask us at privacy@brandasset.nu if you need something removed sooner.

You can request access to, correction of, or deletion of the personal data we hold about you, and object to or restrict certain processing. Contact us at privacy@brandasset.nu and we will respond within the time limits that apply. If your account was created through your employer's approved email domain, we may need to coordinate with that organisation.