Legal · Last updated 7 October 2026
Privacy policy
What Brandstillery collects, why, who else receives it, how long we keep it, and how to have it erased.
The short version
- We keep your account, your answers, and every strategy, deck and set of ideas Brandstillery writes for you. We don’t sell data or show ads.
- Your answers are sent to Anthropic, the AI provider that writes your strategy. Nothing is sent to any other AI provider.
- Brandstillery runs on Iridiom, a platform Probalia Ventures LLC operates for us. Your email and password are kept there, and work on the other products that run on it if you choose to use them.
- www.brandstillery.co sets no cookies. It counts visits with Vercel Web Analytics, which doesn’t use them.
- To have data erased, email webmaster@brandstillery.co. Deleting a brand in the app doesn’t erase its data.
Who we are
Brandstillery is run by Spotstillery LLC, 240 Harriman Road, Irvington, NY 10533, USA (“we”, “us”). We decide how the data on this page is used, which makes us its controller. Email us at webmaster@brandstillery.co.
This policy covers www.brandstillery.co and the Brandstillery app at app.brandstillery.co.
The app runs on Iridiom, a software platform operated for us by Probalia Ventures LLC, 240 Harriman Road, Irvington, NY 10533, USA. It processes the data on this page on our behalf, and some screens and emails at app.brandstillery.co may use the Iridiom name.
Your sign-in. Your email address and password, or your Google or Microsoft sign-in, are kept once, on Iridiom, for every product that runs on it. Signing up here doesn’t set you up anywhere else: nothing exists for you in another product until you go there and sign in, with the same email address and password. What you do in one product isn’t shared with another, and each has its own privacy policy.
What we collect about you
Everything below comes from you, or from Stripe and your sign-in provider. We don’t buy data about you.
Your account
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Account details | Your name, email address and password, which we store only as a one-way hash. If you sign in with Google or Microsoft instead, the name, email address and profile picture they share with us. Also the workspace your Brandstillery projects live in, and who belongs to it. Used to sign you in and run your account. | Until you ask us to delete your account. |
| Sign-in and security records | Each sign-in, failed attempt and password-reset request, with the email address used, the IP address and browser details. Used to keep accounts secure and to limit repeated attempts. | 90 days, then deleted by a weekly clean-up. A count of failed attempts is kept on your account until you next sign in or change your password, and the time of the last failed attempt until your account is deleted. Counters that limit repeated attempts last at most an hour. |
| Purchases | What you bought, when, and how much you paid, plus the customer record Stripe keeps for Brandstillery: your email address and our internal account IDs. You type your card and billing details into Stripe’s own form, and they never reach us. Used to take payment, give you what you bought, and keep accounting records. | Kept as accounting records. We don’t delete them on request while tax or accounting law requires us to keep them. |
| What you agreed to | Which version of the terms of service and privacy policy you accepted, and when: when you sign up, when we ask you to accept a new version, and when you pay. Used to show what you agreed to. | As long as you have an account, and afterwards for as long as we may need to show what you agreed to. |
| Product news, if you ask for it | Only if you tick the box when you sign up or buy, or turn on Product news in Settings: your email address, the words you agreed to and when, and each time you unsubscribe. Used to send you occasional emails about Brandstillery: new features and offers. | Until you unsubscribe. After that, the record of what you agreed to and when you unsubscribed, for as long as we may need to show it. |
Your brands
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Your answers | Everything you write in a brand’s questionnaire: about the business, its customers (answered as the customer), its market and its competitors. Used to write the brand’s strategy, deck and post ideas. While a deck or a set of post ideas is being made, a copy of what it’s made from is held with it, and deleted as soon as it’s done, however it ends. | Until you ask us to erase them. Deleting a brand in the app doesn’t erase them. |
| Where to tell you | The email address on your account and a link to the brand, noted when you generate a deck. Used to email you when the deck is ready, or if it didn’t finish. | The address until we’ve emailed you how the deck ended, and never past the end of that deck. The link stays with the deck’s record. |
| Strategies, decks and post ideas | Each strategy and deck Brandstillery writes for a brand, and each set of post ideas, with the brand’s name and category. Every version is kept, so you can go back to it and we can see what you received if you ask for help or a refund. | Until you ask us to erase them. “Start over” and deleting a brand don’t remove earlier versions. |
| Writing-helper conversations | What you and the writing helper say to each other on each question, and a count of how often it was used that day. Used to continue the conversation and to apply the daily limit. | Until you ask us to erase them. |
| Strategy summary | The core of each brand’s strategy (its voice, purpose, audiences and positioning), stored where other tools in the same workspace could use it. None does today. | Replaced on each new deck. Otherwise until you ask us to erase it. |
Records of use
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Records of use | A record of each request Brandstillery makes to our platform (your account, what was asked for and how long it took), and for each AI request, your email address, the model used, its size and its cost, never what was asked or answered. Used to run the service, control costs and investigate faults. | Kept as business records. If you ask us to delete your account, we remove your details from them. |
| Screening of AI requests | Requests to the AI and its answers are screened automatically for attempts to misuse it. When something is flagged, we keep which check matched and where in the text it was, never the text itself. Used to stop abuse. | 90 days, then deleted by the weekly clean-up. |
| Logs and error reports | Technical records of requests and errors. Some errors go to Sentry, our error-monitoring service. On app.brandstillery.co’s own pages (sign-in, checkout and the frame around the app), Sentry may also record a small share of visits as a replay of clicks and page changes, with all text and anything typed hidden. It doesn’t record inside the Brandstillery app itself. | Deleted by a weekly clean-up once they’re old enough: app logs after 7 days, error records after 90 days, audit records after 1 year. Error records we flag for an investigation are kept until we unflag them. What Vercel and Sentry keep follows their own retention. |
| Emails to us | Anything you send to webmaster@brandstillery.co. Used to answer you and handle your requests. | As long as we need it to answer you or to show we handled your request. |
| Messages through the contact form | Your name, email address, company, subject and message, sent to us as an email. Used to answer you. | The site stores nothing. The email is kept as long as we need it to answer you. |
To have an account, you need to give us your name, email address and a password, or sign in with Google or Microsoft. To buy something, you give your payment details to Stripe. Without these we can’t provide Brandstillery. Everything else is up to you.
People named in your answers
The questionnaire asks about a business’s competitors, partners, past clients and customers, so a customer’s answers can name or describe other people and businesses. Those answers are kept with the brand and sent to our AI provider to write the strategy. Brandstillery doesn’t look anyone up or collect anything about them from anywhere else.
If you think you’re named in a Brandstillery brand and want it removed, email webmaster@brandstillery.co. You don’t need an account or a reason.
What we use it for
- Writing your strategy. Your answers are sent to our AI provider, which writes the strategy, the deck’s text and your post ideas. This happens on our servers, so you can close the page while it runs.
- Telling you it’s done. When you generate a deck, we note your account’s email address and email you once when it’s ready, or if it didn’t finish. The email carries your brand’s name and a link to it, never your answers or your strategy.
- Helping you answer. When you use the writing helper, the question, a summary of your other answers and the conversation so far are sent to the AI provider.
- Keeping what you received. Every version is kept, so you can go back to it and so we can see what you received when you ask for help or a refund.
- Running the service. Signing you in, taking payment, counting what your purchases have used, stopping abuse and fixing faults.
- Answering you. Support and privacy requests.
We don’t sell personal data, share it with advertisers, or show ads. We don’t use your data to train AI models. What our AI provider may do with what it receives is set by its commercial terms, linked under Who else receives it.
Brandstillery makes no decision about anyone that has legal or similarly significant effects.
Legal bases (UK and EU GDPR)
- Contract: running your account and brands, writing your strategy, deck and ideas, telling you when a deck is done, and taking payment.
- Legitimate interests: security and preventing abuse; logs, error monitoring and page analytics; keeping earlier versions of what Brandstillery wrote; keeping what a customer’s answers say about other people and businesses.
- Consent: product news emails, only if you ask for them. You can withdraw it at any time, with the unsubscribe link in any of them or in Settings.
- Legal obligation: keeping purchase records, and answering rights requests.
Who else receives it
These providers process data for us, to run Brandstillery. Each gets what its job needs.
| Who | What they do | What reaches them |
|---|---|---|
| Probalia Ventures LLC (Iridiom) | Operates Iridiom, the platform Brandstillery runs on | Everything described on this page, to run Brandstillery for us, through the providers below. |
| Supabase | Database | Accounts, Brandstillery’s own records of what you put in and what it makes, purchase records and logs. |
| Cloudflare | Runs the Brandstillery app | Every request the app handles, including your name and email address, and what you put in. It also runs the background jobs that write your deck and post ideas, with your answers. |
| Vercel | Hosting for www.brandstillery.co and app.brandstillery.co, and page analytics on both | Standard request data (IP address, browser, the page asked for) for both sites; everything the Brandstillery app sends through our platform, including what goes to the AI provider; page views on both sites, with the links into the app clicked on www.brandstillery.co; and load times on app.brandstillery.co’s own pages. |
| Stripe | Payments | Your email address, our internal account IDs, what you’re buying and the amount, plus the card and billing details you type into Stripe’s form. |
| Resend | Account emails, such as welcome and password reset; Brandstillery’s emails telling you your deck is ready or didn’t finish; messages sent through the contact form; and product news if you ask for it | Your name, email address and the email’s content, including anything you write in the contact form, and whether you’ve asked for product news. Brandstillery’s deck emails carry your brand’s name and a link to it, never your answers or your strategy. |
| Sentry | Error monitoring | Error details and browser information. From a small share of visits to app.brandstillery.co’s own pages, a replay of clicks and page changes with all text and form fields hidden. |
| Upstash | Limits on repeated requests, and short-lived caching | Your email address or IP address, as a counter that lasts at most an hour, and short-lived copies of some account settings. |
| Google or Microsoft | Sign-in, only if you choose it | Your sign-in with them. They send us your name, email address and profile picture. |
| Google (Fonts) | Serves typefaces on app.brandstillery.co and inside the app | Your IP address and browser details, when a page loads its fonts. |
| Anthropic | The AI that writes your strategy, deck and post ideas, and powers the writing helper | Your answers, your brand’s name and category, the strategy it wrote, your conversations with the writing helper, and your instructions when you refine an idea. |
| MailChannels | Receives email sent to webmaster@brandstillery.co | The emails you send us. |
What Anthropic may do with what it receives is set by its commercial terms.
We’ll also disclose data when the law requires it, to protect our rights or someone’s safety, or to a buyer if the business is sold. In a sale, this policy keeps applying until you’re told otherwise.
How long we keep it
The tables under What we collect about you give the period for each kind of data. In short:
- Brand data (answers, every strategy, deck and set of ideas, and helper conversations) isn’t deleted automatically, and stays when you delete a brand or start over. It’s erased when you ask us.
- A deck or set of ideas being made holds a copy of what it’s made from and, for a deck, your email address, only until it ends, whether or not it finished.
- Logs are deleted by a weekly clean-up, at its first run after they reach their age:
- App logs: 7 days.
- Sign-in and security records: 90 days.
- Error records: 90 days (any we flag for an investigation are kept until we unflag them).
- Audit records: 1 year.
- Purchase records are kept for accounting.
- Backups. Our database provider keeps backups so data can be recovered after a fault. Data you’ve asked us to erase can remain in those backups until they expire.
Cookies and browser storage
www.brandstillery.co sets no cookies. It counts visits with Vercel Web Analytics, without cookies: Vercel records the page, where you came from, your country, device and browser, and which links into the app you click. We don’t send it anything about who you are. It remembers your light or dark choice in your browser (bs-theme), and its typefaces are served from the site itself, not from a font service.
The app at app.brandstillery.co uses the cookies and storage below. None of them is for advertising.
| Name | What it’s for | How long |
|---|---|---|
__Secure-Cookie | Keeps you signed in. | 24 hours. |
next- __Secure-Cookies | Protect the sign-in form, and return you to the page you were on. | Until you close the browser. |
__Secure- __Secure-Cookies | Complete a sign-in with Google or Microsoft safely. | 15 minutes. |
tenant-Cookie | Knows you’re signing in to Brandstillery. | 1 hour. |
marketing-Cookie | Carries your choice about product news through a sign-up with Google or Microsoft. | 15 minutes, or until the sign-up finishes. |
iridiom-Cookie | Remembers whether you chose light or dark. | 1 year. |
theme activeWorkspaceIdLocal storage | Your light or dark choice, and the workspace you last used. | Until you clear it. |
iridiom:Session storage | Which error notices you’ve already seen. | Until you close the tab. |
| Stripe’s own cookiesAt checkout | Set by Stripe to process payment and prevent fraud. | See Stripe’s privacy policy. |
app.brandstillery.co also runs Vercel Web Analytics and Speed Insights, which count page views and measure how fast pages load, and Sentry, described under Records of use. Its pages load fonts from Google Fonts, so Google receives your IP address and browser details.
The Brandstillery app inside app.brandstillery.co stores nothing in your browser. The PDF and PowerPoint files you download are made in your browser and saved on your own machine, not on ours.
Deleting your data
- Start over. Takes a brand back to its questionnaire, with your answers. The current deck and ideas are cleared from the brand, but every version already generated stays in its history.
- A brand. Deleting a brand removes it from your list, but doesn’t erase its data from our systems.
- Everything else. To erase a project’s data, or your whole account, email webmaster@brandstillery.co from the address on your account. If you also use another product that runs on Iridiom, say whether to erase your sign-in as well, which ends it for every product, or only what’s in Brandstillery. We’ll confirm when it’s done.
Your rights
Depending on where you live, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct it;
- erase it;
- limit how we use it;
- give it to you in a machine-readable form to take elsewhere; or
- stop using it where we rely on legitimate interests.
Email webmaster@brandstillery.co. It’s free. We may ask you to confirm who you are first. We answer within one month. If a request is complex, we may take up to two more months, and we’ll tell you why.
If you’re in the UK or EU and not happy with our answer, you can complain to your data protection authority: the ICO in the UK, or the authority where you live in the EU.
US state privacy rights
If you live in a US state with a consumer privacy law, such as California:
- What we collect: identifiers (name, email address, IP address), commercial information (purchases), internet activity (sign-in and usage records, logs), and the content you give us. The sources and purposes are described above.
- Who receives it: only the service providers listed above, for those purposes. We don’t sell personal information, or share it for cross-context behavioral advertising.
- Sensitive information: we collect your Brandstillery sign-in (email address and password), which the law counts as sensitive, and use it only to sign you in and keep your account secure. We don’t use it to infer anything about you.
- Your rights: to know, correct and delete what we hold. Email webmaster@brandstillery.co, yourself or through an authorized agent. We’ll confirm who you are, answer within the time given under Your rights and never later than the law allows, and won’t treat you differently for asking. If we turn a request down, you can appeal by replying to our answer.
Security
Every page and request uses HTTPS. Passwords are stored only as one-way hashes. Card details never reach us.
No system is perfectly secure. If a breach affects your data, we’ll tell you and the relevant authorities as the law requires.
Where data is processed
We’re based in the United States, and our providers process data in the United States and in other countries where they operate. If you’re in the UK or EU, your data is transferred to the United States.
Children
Brandstillery is for people 18 and over. We don’t knowingly collect data from anyone younger. If you think a child has given us data, email webmaster@brandstillery.co and we’ll delete it.
Changes to this policy
If we change what we collect, who receives it or how long we keep it, we’ll update this page and the date at the top, and the next time you use Brandstillery we’ll ask you to accept the new version.
Contact
Spotstillery LLC, trading as Brandstillery
240 Harriman Road, Irvington, NY 10533, USA
webmaster@brandstillery.co
See also the terms of service.