No separate data processing agreement
This page is descriptive information, not a data processing agreement (DPA) or a commitment to act as a processor under customer instructions. No standalone DPA, international transfer addendum, or enterprise security schedule is currently offered through this page. Contact [email protected] before using BrandLAB for processing that requires a signed DPA or specific contractual controls.
Service processing overview
BrandLAB processes account and profile information, service usage and billing records, prompts and other content submitted to features, and information needed to provide connected provider or integration functionality. Processing supports account operation, AI responses, billing, security, and support. The customer or user remains responsible for ensuring they have authority to submit the information and for providing any required notices to people whose information they submit.
Depending on the feature, BRANDLAB Group may act as a service provider for a customer's request or as an organisation determining how account, security, and billing information is used. The role and legal basis for any particular processing must be determined for the relevant customer and location; this page does not establish a universal controller/processor allocation.
Service providers and international transfers
Infrastructure and service providers currently include Cloudflare (hosting and database), Supabase (customer sign-in), Stripe (payments), and configured OpenAI, Anthropic, or Google APIs (BrandLAB-managed AI features). Optional integrations are involved when you authorize them. Provider locations, retention, and terms can differ and may involve cross-border processing. This page is not a complete subprocessor schedule and does not promise a fixed processing location.
Security, retention, and requests
Previously stored provider keys are encrypted and owner-associated, but no longer run requests; customers can remove them from Models. Other safeguards depend on the service and provider. There is no fixed retention schedule or enterprise incident-response commitment in this page. For a business data request, security question, or DPA requirement, contact [email protected]. Do not submit sensitive or regulated data unless you have independently confirmed that the service and applicable provider terms are suitable.