Privacy Policy

Effective date: 8 November 2026 · Operated by iBtech ("the Company") · brandwyn.in · info@brandwyn.in

1. Who this policy covers
2. What we collect
3. How we use it
4. How AI processing works
5. Who we share data with
6. Connected platforms: Google and Meta requirements
7. Cookies
8. Security
9. Retention
10. Deletion and data requests
11. Your rights
12. International transfers
13. Children
14. Changes to this policy
15. Contact

1. Who this policy covers

This policy explains how iBtech ("the Company", "we", "us"), the operator of Brandwyn at brandwyn.in, handles personal data. It covers visitors to this website, people who register for or use Brandwyn (agencies, freelancers and the users they invite), and people whose data our customers put into Brandwyn (for example a client's customers who appear in analytics or outreach lists). For data our customers put into Brandwyn about their own clients and their clients' audiences, the customer is the controller and we process it on their instructions under our Terms and Conditions.

2. What we collect

Account data

When you register we collect your name, email address, password (stored as a salted hash, never in plain text), agency or company name, optional phone number, your role in the workspace, the time you accepted the Terms, email-verification and password-reset tokens, and login activity such as IP address, browser and time of sign-in.

Billing data

Payments are processed by Razorpay. We receive and keep the payment identifier, amount, currency, tax, status, the package or credit pack bought and the billing name and contact details needed for your invoice. We do not receive or store your card number, UPI PIN, bank credentials or other payment instrument details; those are handled by Razorpay under its own privacy policy.

Connected platform tokens

When you connect a Facebook Page, Instagram account, Threads account, LinkedIn page or profile, X account, Bluesky account, YouTube channel, TikTok account, Pinterest account, Google Ads account or Google Analytics property, the platform issues an access token (and where applicable a refresh token) that lets Brandwyn act on that account. We store these tokens encrypted at rest and use them only to perform the actions you configure: publishing and scheduling posts, reading post performance, reading and changing Google Ads campaigns within your settings, and reading Google Analytics results. We also store the account identifiers and display names needed to show which accounts are connected, and token expiry dates so we can warn you before access lapses.

Content

Posts, captions, images, videos, link-in-bio pages, client profiles (voice, audience, pillars, offers, rules), backlink target lists, outreach email drafts, Google Ads campaign settings and change history, approval decisions, and the AI marketer's drafts, reasons and session summaries.

Analytics and performance data

Metrics returned by the connected platforms (reach, engagement, clicks, impressions, spend, conversions), Google Analytics events for the properties you connect (visits, leads, calls, sign-ups, payments and the sources that drove them), and click data on tracked links and link-in-bio pages (time, referrer, approximate location from IP, device type).

Usage and technical data

Server logs, error reports, feature usage, AI credit usage per run, and enquiry form submissions (name, email, phone, company, message) from this website.

3. How we use it

• To provide the service: authenticate you, publish and schedule content, run Google Ads changes you approve or allow, show results and send alerts.
• To run the AI marketer on your behalf, as described in section 4.
• To bill you, issue invoices and comply with tax and accounting law.
• To send service emails: verification, password reset, review-queue notifications, token-expiry alerts, subscription and credit alerts, and important notices about the service or these policies.
• To respond to enquiries and demo requests you send us.
• To keep the service secure, prevent abuse, enforce our Terms and the policies of connected platforms.
• To improve the product using aggregated or de-identified usage statistics.

We do not sell personal data and we do not use your content or your clients' data for advertising to third parties. We send marketing email only where you have agreed to it, and every such email has an unsubscribe link.

4. How AI processing works

If an agency switches on comment replies for a client, public comments on that client's posts, with the commenter's public name, are read from the network, stored, and sent to our AI provider to draft a reply. A person at the agency approves every reply before it is sent. Handled comments are deleted after 90 days.

Brandwyn's built-in AI marketer runs on large language models from one AI provider at a time, either Anthropic (Claude) or OpenAI, through that provider's API and the Company's platform account. We choose the provider; the one in use at any time receives the data described here. When the AI drafts posts, proposes or applies Google Ads changes, drafts outreach emails or summarises results, we send it the information needed for that task: the relevant client profile, recent posts and their performance, campaign and keyword data, search terms, analytics results, and any instructions you give. This may include personal data where it appears in that content (for example a name in a testimonial you asked it to reuse).

This processing happens under the Company's commercial agreement with that provider. Under those agreements, data sent to the API is not used to train the provider's models. The provider may retain API inputs and outputs for a limited period for abuse and safety monitoring in line with its commercial terms. We do not send your payment details or platform access tokens to the AI provider.

If you connect Brandwyn to Claude Desktop or claude.ai through our MCP server, the data those tools request from Brandwyn is handled under your own agreement with Anthropic for that product, not under ours.

AI output is a draft. It can be inaccurate. We keep AI drafts, reasons and summaries as part of your workspace content so that you and your team can review and audit them.

5. Who we share data with

• Connected platforms (Meta, LinkedIn, X, Bluesky, Google, TikTok, Pinterest): we send them the content you publish and the ad changes you approve, and we read the data they return. Their handling of that data is governed by their own policies.
• Anthropic and OpenAI: AI processing as described in section 4, by whichever of them is in use.
• Razorpay: payment processing.
• Hosting and infrastructure providers that run our servers, databases, file storage and backups, and email delivery providers that send our service emails. They process data only on our instructions.
• Your own workspace users and connected AI clients, according to the roles your administrator sets.
• Authorities and advisers where required by law, to protect our rights or in connection with a sale or restructuring of our business (in which case this policy continues to apply).

6. Connected platforms: Google and Meta requirements

Google API Services: Limited Use

Brandwyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data obtained through Google Ads, Google Analytics and YouTube APIs is used only to provide and improve the user-facing features of Brandwyn that you have enabled; it is not sold, is not used for advertising by us or third parties, and is not read by humans except with your consent, for security purposes, to comply with law, or in aggregated and anonymised form. You can revoke Brandwyn's access at any time from your Google account permissions page or by disconnecting the account in Brandwyn.

Meta platforms

Our access to Facebook Pages, Instagram and Threads is governed by the Meta Platform Terms and Developer Policies. We request only the permissions needed for publishing and reading performance of the pages and accounts you choose to connect. You can remove Brandwyn from your Facebook or Instagram settings at any time, which invalidates the stored tokens. On request we will delete all data obtained through Meta's APIs for your account; see section 10.

Other platforms

Access to LinkedIn, X, Bluesky, TikTok and Pinterest is similarly limited to the permissions needed for the features you use and can be revoked from each platform or by disconnecting the account in Brandwyn.

7. Cookies

This public website sets no cookies and loads no third-party trackers or scripts. The Brandwyn application sets a strictly necessary session cookie when you sign in so that you stay signed in; it is HTTP-only and, in production, sent only over HTTPS. We do not use advertising cookies. Tracked links and link-in-bio pages record a click (time, referrer, approximate location derived from IP, device type) without setting a cookie on the visitor's device.

8. Security

We protect data with encryption in transit (HTTPS), encryption at rest for platform tokens, salted password hashing, role-based access within workspaces, rate limiting, a strict content security policy on the application, and access controls and logging on our infrastructure. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify affected customers and authorities as required by law.

9. Retention

• Account and workspace data: for as long as your workspace exists. After a trial or subscription ends we keep the workspace so you can renew; if it stays expired and inactive for 12 months we may delete it after notice to the administrator's email.
• Platform tokens: until you disconnect the account, revoke access on the platform, or the workspace is deleted, whichever comes first.
• Content and analytics data: for the life of the workspace, then deleted with it.
• Billing records and invoices: for the period required by Indian tax and accounting law (generally 8 years), even after the workspace is deleted.
• Server logs: typically 30 to 90 days.
• Enquiry form submissions: up to 24 months unless you become a customer.
• Backups: deleted data may persist in encrypted backups for up to 30 days before being overwritten.

10. Deletion and data requests

To delete your workspace, a connected account's data, or your personal data, email info@brandwyn.in from the email address on your account (for a whole workspace, from the administrator's address) with the subject "Data deletion request". We will confirm your identity, carry out the deletion within 30 days and confirm when it is done, keeping only what the law requires us to retain (such as invoices). Disconnecting a platform in Brandwyn deletes its tokens immediately; removing Brandwyn from your Facebook, Instagram, Google or other platform settings has the same effect and you may additionally request deletion of the data we obtained from that platform. You can also ask for a copy of the personal data we hold about you at the same address.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority. For users in India, these rights are provided under the Digital Personal Data Protection Act, 2023 and related rules; for users in the EEA or UK, under the GDPR and UK GDPR. To exercise any right, contact info@brandwyn.in. We will respond within the time the applicable law allows and will not discriminate against you for exercising your rights. Where we process data as a processor for one of our customers, we will pass your request to that customer or ask you to contact them directly.

12. International transfers

We are based in India. Our hosting, AI, email and payment providers may process data in other countries, including the United States and the European Union. Where required, we rely on the providers' contractual commitments and standard data-protection clauses to protect transferred data.

13. Children

Brandwyn is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18 as a user. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. The current version with its effective date is always at brandwyn.in/privacy. For material changes we will notify workspace administrators by email or in the app before they take effect. Continued use of Brandwyn after the effective date means you accept the updated policy.

15. Contact

Privacy questions and requests: info@brandwyn.in. Brandwyn by iBtech, brandwyn.in. Registered office address available on request.