1. Who we are
BrandPilot is an AI-powered marketing service for small and medium businesses across the Arab world. The controller of your data is [● registered entity name and CR number]. For any privacy matter, contact support@brandpilot.app.
2. Data we collect
We collect only what we need to run the service:
- Account data: name, email, password (stored as a one-way hash we cannot read) and preferred language.
- Brand data: brand name, country and category, links you add (your store or social accounts), descriptions, products, colors, logos and images you upload, and the “brand brain” we build from them.
- Generated content: the copy, designs, campaigns and calendar you create in the service.
- Connected accounts: if you connect a social account (such as Instagram or Facebook) we store the access token and post insights needed for publishing and analytics.
- Payment data: on the website payments are processed by Moyasar; we receive the payment status, card brand and last 4 digits only and never see your full card number. In the apps, purchases go through Apple or Google and we receive the subscription status only.
- Usage and device data: device type, app version, push token, IP address, technical logs and general usage events (for example “post created”) to improve and protect the service. We never send your prompt text to analytics tools.
- Support messages: what you send us by email or the contact form.
3. How we use your data
- To provide the service: build your brand brain, generate content and designs, schedule and publish, and show analytics.
- To manage your subscription and billing and enforce plan limits.
- To support you and contact you about your account (for example, renewal reminders).
- For security, and to prevent fraud and abuse.
- To improve the service using aggregated statistics that do not identify you.
- To comply with the law and lawful requests.
We do not sell your data, we do not use it to show third-party ads, and we do not use your brand content to train AI models of our own.
Legal bases: performing our contract with you (providing the service), your consent (such as AI processing and marketing messages), our legitimate interests (security and improving the service) and legal obligations.
4. AI processing
To generate content we send AI providers only what is needed: your brand description and brain, your request, the content of links you ask us to analyse and images you ask us to edit. Our current providers:
- OpenAI (United States) — text and image generation.
- Anthropic (United States) — text generation and analysis.
We use these providers' commercial APIs. Under their published terms, API data is not used to train their models by default; they may retain it for a limited period (typically up to 30 days) for abuse monitoring before deleting it.
We ask for your explicit consent before your first generation, and you can withdraw it at any time (the service cannot generate content without it). If you add your own AI key, your requests go through your own account with that provider under its terms.
Generated content can contain mistakes. Always review it before publishing, and report anything inappropriate from inside the app.
6. Transfers outside your country
Some of our providers are outside your country (including the AI providers in the United States), so some of your data is transferred and processed there. We rely on the safeguards required by applicable law, such as Saudi Arabia's Personal Data Protection Law and its regulation on transfers outside the Kingdom, on contractual terms with providers, and we minimise the data transferred.
7. Retention
- Account, brand and content data: for as long as your account exists.
- After account deletion: permanently deleted within 30 days, and purged from backups within at most 35 further days.
- Payment and invoice records: for the period required by tax and commercial law.
- Security and technical logs: up to 12 months.
- Support messages: up to 24 months after the last contact.
8. Your rights
Under Saudi Arabia's Personal Data Protection Law and similar laws across the Arab world, you have the right to:
- Be informed about how we collect and use your data (this policy is part of that).
- Access your data and receive a copy in a readable format.
- Correct inaccurate data (most of it can be edited in the app).
- Delete your account and data in the app or by request on our “Delete account” page.
- Withdraw consent for consent-based processing at any time.
- Object to marketing and unsubscribe from marketing messages.
- Complain to the competent authority in your country (in Saudi Arabia: the Saudi Data & AI Authority, SDAIA).
To exercise any right, email support@brandpilot.app from your account email. We respond within 30 days and may need to verify your identity.
9. Security
We apply appropriate technical and organisational measures, including encryption in transit (TLS), password hashing, need-to-know access for our team and access logging. If an incident affects your data we notify the competent authorities within the legal deadlines (72 hours in Saudi Arabia) and notify you where required.
10. Children
BrandPilot is a business tool and is not directed at children under 13. We do not knowingly collect their data. If you learn that a child has created an account, contact us and we will delete it.
12. Changes to this policy
We may update this policy. For material changes we notify you in the app or by email before they take effect, and update the “Last updated” date at the top.
13. Contact us
Privacy questions: support@brandpilot.app. Deletion requests: the “Delete account” page on our website.