1. Overview
This Privacy Policy explains how Brands.live, operated by CredApp Software Pvt. Ltd. ("Brands.live", "we", "us" or "our"), collects, uses, discloses and protects personal information when you use our websites, web and mobile applications, AI tools and related services (the "Services") in the United States.
It also explains the choices and rights you have, including rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) and other US state privacy laws.
Quick summary: we use your information to run the design, AI and publishing features you ask for, to process payments, keep the Services secure and improve them, and to measure and personalize our marketing. We do not sell your personal information for money. We do use advertising cookies, which some state laws treat as "sharing" or "targeted advertising", and you can opt out at any time.
2. Information We Collect
Information you provide
- Account details
- Name, email address, mobile number, password or one-time passcode (OTP), and profile photo.
- Business and brand details
- Business name, category, address, website, phone, logo, brand colors, fonts and other details you save in Brand Hub.
- User Content
- Photos, product images, videos, text, prompts, captions, designs, websites and other files you upload or create.
- Payment information
- Billing name, address and transaction history. Card details are collected and stored directly by our payment processors; we receive only limited data such as card type, last four digits and expiry.
- Communications
- Messages you send to our support or live chat, survey answers, feedback and reviews.
Information collected automatically
- Device and log data
- IP address, browser type and settings, operating system, device identifiers, language, referring URL, pages viewed, date and time of access, and crash or error reports.
- Usage data
- Features and templates you use, searches, clicks, downloads, editing activity, session duration and in-app events.
- Approximate location
- City, state and country inferred from your IP address. We do not collect precise GPS location from the web Services.
- Cookies and similar technologies
- Cookies, pixels, local storage and SDKs, described in Section 6.
Information from third parties
- Connected Accounts
- When you connect Instagram, Facebook, Google Business Profile or YouTube, we receive the information you authorize, such as account or page ID, name, profile picture, access tokens, business listing details, published posts and performance insights.
- Sign-in providers
- If you sign in with a third-party account, we receive basic profile information such as name, email and profile picture.
- Payment and app store partners
- Confirmation of payments, subscription status, refunds and fraud signals.
- Advertising and analytics partners
- Information about how you found us and whether you responded to our ads.
3. How We Use Your Information
- Provide the Services: create your account, apply your branding to templates, run AI tools on your inputs, save and export your designs, and build your website.
- Publish and schedule content to your Connected Accounts and show you analytics about it.
- Process payments, manage subscriptions, credits and download limits, and send receipts and renewal reminders.
- Verify your identity with OTPs, detect and prevent fraud, spam, abuse and security incidents, and enforce our Terms.
- Provide customer support and respond to your requests.
- Personalize your experience, such as recommending templates relevant to your industry or upcoming holidays.
- Analyze usage, debug issues and develop new features.
- Send service messages and, where permitted or with your consent, marketing emails, push notifications and texts.
- Measure and improve our advertising, including showing you ads for the Services on other websites and apps.
- Comply with legal obligations and respond to lawful requests from public authorities.
4. AI Features and Your Content
When you use an AI feature, the images, prompts and settings you provide are sent to our servers and, for some features, to third-party AI model providers who process them only to generate your result.
- We do not use your User Content or prompts to train third-party foundation AI models.
- Our AI providers are contractually restricted from using your inputs or outputs for their own purposes, including training their models.
- We may use de-identified, aggregated metrics (for example, generation success rates and processing times) to improve quality and reliability.
- Do not upload images of other people unless you have their permission, and avoid including sensitive personal information in prompts.
7. Google and Meta Platform Data
Google API Services
Brands.live's use and transfer of information received from Google APIs (including the Google Business Profile and YouTube Data APIs) adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to provide the features you enable, such as publishing posts, managing your business listing and showing insights. We do not use it for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or to comply with law.
Our YouTube features use YouTube API Services. Google's Privacy Policy (policies.google.com/privacy) applies to that data. You can revoke our access at any time from your account settings or from Google's security settings page (myaccount.google.com/permissions).
Meta (Facebook and Instagram)
When you connect a Facebook Page or Instagram professional account, we use the permissions you grant only to publish content you schedule, retrieve insights and display account details within the Services. You can remove our access from your account settings or in Facebook Settings under Business Integrations.
To request deletion of data we received from Meta, disconnect the account and email [email protected] with the subject "Data Deletion Request". We will delete associated tokens and data within 30 days, except where retention is required by law.
8. Data Retention
We keep personal information only for as long as needed for the purposes described in this Policy, then delete or de-identify it. Typical retention periods are:
| Data | Retention |
|---|---|
| Account and Brand Hub details | While your account is active, and up to 30 days after you delete it |
| User Content and designs | Until you delete them or your account; residual backup copies are purged within 90 days |
| Connected Account tokens | Until you disconnect the account or delete your Account |
| Payment and transaction records | Up to 7 years to meet tax and accounting obligations |
| Support conversations | Up to 3 years after the last interaction |
| Analytics and log data | Up to 26 months, then aggregated or deleted |
We may keep information longer where required by law, to resolve disputes, or to enforce our agreements.
9. How We Protect Your Information
- Encryption in transit using TLS (HTTPS) for all connections to the Services.
- Encryption at rest for stored files and databases provided by our cloud infrastructure.
- OAuth-based authorization for Connected Accounts, so we never see or store your social media passwords.
- Role-based access controls and least-privilege access for staff, with access logging.
- Payment card data handled by PCI DSS-compliant processors rather than stored on our servers.
No method of transmission or storage is completely secure. If we learn of a security breach affecting your personal information, we will notify you and regulators as required by applicable state breach-notification laws.
10. Your US Privacy Rights
Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws), you may have the following rights:
- Know / Access
- Request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we disclose it to.
- Delete
- Request deletion of personal information we collected from you, subject to legal exceptions.
- Correct
- Request that we correct inaccurate personal information.
- Portability
- Receive a copy of your information in a portable, machine-readable format.
- Opt out
- Opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects.
- Limit sensitive data use
- Limit our use of sensitive personal information. We only use sensitive information, such as account login credentials, to provide the Services.
- Non-discrimination
- Exercise these rights without receiving different prices or quality of service, except as permitted by law.
- Appeal
- If we decline your request, you may appeal by replying to our decision. If your appeal is denied, you may contact your state Attorney General.
How to submit a request
- Email [email protected] with the subject "Privacy Request" and tell us which right you want to exercise and your state of residence.
- Delete your account from your account settings at any time.
- To opt out of sale, sharing or targeted advertising, enable Global Privacy Control in your browser or email us with the subject "Do Not Sell or Share".
We will verify your request by confirming information associated with your account, such as a code sent to your registered email or mobile number. An authorized agent may submit a request on your behalf with signed written permission, and we may ask you to verify your identity directly. We respond within 45 days, and may extend once by another 45 days where permitted, with notice.
11. Additional Disclosures for California Residents
In the last 12 months we collected the following categories of personal information, as defined by the CCPA. We use them for the business purposes described in Section 3 and disclose them to the categories of recipients in Section 5.
| CCPA category | Examples | Sold or shared? |
|---|---|---|
| Identifiers | Name, email, phone number, IP address, account ID, device and cookie identifiers | Shared (cookie and device identifiers only) for targeted advertising |
| Customer records (Cal. Civ. Code § 1798.80) | Name, address, phone, limited payment details | No |
| Commercial information | Plans purchased, transaction history | Shared (conversion events only) for ad measurement |
| Internet or network activity | Pages viewed, clicks, feature usage, ad interactions | Shared for targeted advertising |
| Geolocation data | Approximate location from IP address | No |
| Audio, electronic or visual information | Photos, images and videos you upload | No |
| Professional or business information | Business name, category and Brand Hub details | No |
| Inferences | Template and industry preferences derived from usage | No |
| Sensitive personal information | Account login credentials | No |
California's "Shine the Light" law (Civil Code § 1798.83) lets California residents request information about disclosures to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
12. Children's Privacy
The Services are intended for businesses and users 18 and older and are not directed to children under 13. We do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). If you believe a child has given us personal information, contact us and we will delete it promptly.
13. International Data Transfers
Brands.live is operated from India, and we and our service providers may process and store information in the United States, India and other countries. These countries may have data-protection laws that differ from those in your state. We apply the safeguards described in this Policy wherever your information is processed.
14. Marketing Communications
- Email: click "unsubscribe" in any marketing email. You will still receive transactional messages such as receipts and security alerts.
- SMS: reply STOP to opt out of marketing texts or HELP for help. We will not send marketing texts without your consent, and mobile numbers and SMS consent are never shared with third parties for their marketing.
- Push notifications: turn them off in your device or browser settings.
15. Third-Party Websites and Services
The Services may link to or integrate with websites and services we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last updated" date. If we make material changes, we will notify you by email or in-app message before they take effect. We review this Policy at least once every 12 months.
17. Contact Us
For privacy questions, data requests, appeals or data deletion requests, email [email protected]. Please include your account email and state of residence so we can respond faster.
CredApp Software Pvt. Ltd., operator of Brands.live. See also our Terms & Conditions.
