Privacy policy

brandflare measures how AI assistants describe brands. This page explains what we collect, why we hold it, who handles it for us, and how to get it removed. If anything here is unclear, use our contact form or email hello@brandflare.io.

Who we are

brandflare is operated by NONE OF THE ABOVE L.L.C-FZ, a company licensed by Meydan Free Zone under licence number 253577901, with its registered office at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. We are the data controller for the information described here.

What we collect

• Account details. Your name and email address, handled by our authentication provider (Clerk) when you sign up or sign in. If you sign in with Google, Google passes us your name, email address and profile photo, and nothing else from your Google account; we never see your Google password. If you invite teammates, we hold their email addresses too.
• Billing details. Your plan, subscription status, and customer record. Card numbers go directly to Stripe and never reach our servers.
• Brand data you enter. The brands, questions, and facts you ask us to track, the country you want questions asked from, and any documents and web pages you add to a brand's knowledge base.
• Measurement data we generate. The answers AI engines return for your questions, the pages they cite, and the scores and recommendations we derive from them.
• Crawler logs you send us. If you connect your site's logs, we keep the user agent, page path, and time of visits from AI crawlers. Visits from anything else are discarded, and we do not store visitor IP addresses.
• Google Analytics figures you connect. If you connect a brand to your Google Analytics, we ask Google for permission to read it and nothing more. We read and keep daily counts of visits to your website: all visits, and visits that came from AI assistants, by assistant and by the page they arrived on. These are totals, not records of individual visitors. We also keep the email address of the Google login that connected it. Disconnecting deletes the figures and the access.
• Messages. Support conversations you open with us, and your email address if you subscribe to the newsletter.
• Basic usage data. Anonymous, aggregated page views and a handful of product events, so we know which parts of the product are used. No advertising trackers, no cross-site profiles, no selling data to anyone.

Why we use it

• To provide the service you signed up for: running checks, showing results, producing reports, taking payment, and answering support requests.
• To send you email: the alerts and digests you asked for, and an occasional note about what is new on the service. You can turn each off in your profile or from the unsubscribe link in it. And the newsletter, if you subscribed to it.
• To run the business responsibly: preventing abuse, understanding which features are used, and keeping the records tax and company law require.

Where UK or EU law applies, those purposes rest on our contract with you, your consent (for the newsletter), and our legitimate interest in running and securing the service.

Where your questions go

To measure what AI assistants say, we ask them your tracked questions. Those questions are written to sound like an ordinary consumer question and do not include your account details. Each engine receives them in one of three ways:

• Through their developer services: OpenAI, Google, Perplexity, and Anthropic, routed through Vercel's AI Gateway.
• Through DeepSeek's own service, for the daily visibility check. DeepSeek is based in China.
• Through the apps themselves: to see the answers people really get in ChatGPT, Gemini, Google's AI Mode and AI Overviews, and Microsoft Copilot, Bright Data asks the questions in those apps for us and returns the answers.

Engines asked through their apps or through DeepSeek may keep the questions under their own terms, as they would any member of the public's. A workspace admin can limit a workspace to the developer services alone, under Settings, and nothing is then asked in the apps or sent to DeepSeek.

Everything else we send to AI models, which is the answers that come back, the facts you give us, and the documents and pages you add to a brand's knowledge base, goes only to Anthropic and OpenAI, through their developer services, whose terms forbid them to train their models on it. Those calls are made under the zero data retention agreements Vercel's AI Gateway holds with them, so the request and its result are not kept once the call is done, beyond what a provider must hold to check for misuse. We do not train AI models, and we do not use your data to train anyone else's.

What we do with Google Analytics data

The figures we read from your Google Analytics are used for one thing: showing them to you and your workspace in brandflare. We do not use them for advertising, do not sell or share them, do not use them to train AI models, and nobody at brandflare reads them except to answer a support request you raise or to fix a fault. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can take the access away at any time, from the brand's AI Traffic page or from your Google account.

Who handles data for us

We use a small number of providers to run brandflare. Each one only receives what it needs for its job.

• Clerk: sign-in and account security.
• Stripe: payments and invoices.
• Vercel: hosting, cookie-free analytics, file storage for exported reports, and the gateway to AI providers.
• Neon: our database.
• Resend: sending email.
• Google Analytics: counting visits to our public site.
• Meta: measuring our advertising, through the Meta Pixel on our public site, and by telling Meta when an account is created or a subscription starts, with the email address hashed.
• LinkedIn: measuring our advertising, through the LinkedIn Insight Tag on our public site.
• OpenAI, Google, Perplexity, Anthropic, and DeepSeek: answering tracked questions, and for Anthropic and OpenAI analysing the answers, as described above.
• Bright Data: asking tracked questions in the ChatGPT, Gemini, Google, and Microsoft Copilot apps, and returning the answers.
• Context.dev and Unavatar: looking up a brand's public details and logo from its website address, and nothing else.

We do not sell personal data, and we only disclose it otherwise if the law requires us to or if the business is sold, in which case this policy continues to apply to it.

Access by our team

To answer a support request or investigate a fault, authorised brandflare staff can view a workspace in a read-only mode. They cannot change your data that way, and each use is logged.

Where it is stored

Our database and hosting are in the United States, and the providers above operate in the United States and Europe. That means your information is processed outside the United Arab Emirates, and outside the UK and EU if you are based there. We rely on our providers' contractual safeguards, including standard contractual clauses where they apply, for those transfers.

How long we keep it

Measurement history is kept for as long as your account is open, because the trends are the product. The owner of a workspace can delete it from Settings. It closes at once, so checks and emails stop and nobody can sign in to it, and 7 days later it is erased: its brands, questions, answers, measurement history, knowledge base and uploaded documents, reports, team, and the support conversations held from it. Until then the owner can undo it. You can also ask us to erase your data, and we will do it within 30 days of the request.

After an erasure we keep only what the law or fair use needs: billing records, held by Stripe for as long as tax law requires; a note that the account existed, with its company email domain and a fingerprint of the card used for its free trial, so the trial is not given twice; our own log of what our team did to the account; and any request not to be emailed, so that it is still honoured. Your sign-in itself is separate from the workspace and stays until you ask us to delete it.

Security

Data is encrypted in transit and at rest, access to production systems is limited to the people who need it, and you can review and sign out your active sessions from your profile. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authority as the law requires.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email hello@brandflare.io and we will respond within 30 days. These rights apply under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and under the GDPR if you are in the UK or EU. You may also complain to the UAE Data Office, or to your local data protection authority.

Business use only

brandflare is sold to businesses and is not intended for anyone under 18. We do not knowingly collect information from children.

Cookies

We set the cookies needed to keep you signed in and to remember a preference or two. Vercel's analytics are cookie-free. Google Analytics on our public site sets cookies to count visits there. The Meta Pixel and the LinkedIn Insight Tag on our public site set advertising cookies to measure our ads on Facebook, Instagram and LinkedIn. The full list is in the cookie policy.

Changes

If we change this policy we will update the date at the top and, for anything material, tell account holders by email.