Privacy Policy

• Account information: name, email address and password (stored hashed by our authentication provider), the workspace and brand you belong to, and your language preference.
• Brand materials you provide: logos, product images, brand guidelines, websites, social media handles, copy and briefs.
• Content created in the Service: ideas, prompts, images, videos and copy, and your approvals and edits.
• Information from connected platforms, only within the permissions you grant (see section 2).
• Usage and technical data: sign-in events, pages visited inside the Service, device and browser type, IP address, and logs needed to operate and secure the Service.
• Billing information: plan and payment status. Card details are handled by our payment processor and are not stored by HEAT.

When you connect a TikTok account through Login Kit, we receive your TikTok open ID, display name and avatar (scope user.info.basic) and permission to publish videos you approve (scope video.publish). Before each post we read the account's posting options (such as the allowed privacy levels and whether comments, duets and stitches are enabled) to show them to you. After publishing we read the post status and public metrics (views, likes, comments and shares) of the videos HEAT published, to report results.

When you connect Instagram or Meta, Google Ads or YouTube, we receive the account identifiers and the permissions shown on that platform's consent screen, and we use them to publish what you approve, to run the campaigns you turn on, and to read the performance of those posts and campaigns.

We do not use data from connected platforms to build advertising profiles of individuals, we do not sell it, and we do not access content you did not publish through HEAT except the public trend signals described below.

HEAT's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

HEAT uses YouTube API Services. When you connect a YouTube channel, HEAT asks only for permission to upload videos (scope youtube.upload) and uses it to upload the videos you approve to that channel, for example as the creative of a Google Ads campaign you turn on. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (https://policies.google.com/privacy) applies to the information Google processes. You can revoke HEAT's access to your Google Account or YouTube channel at any time from Google's security settings, at https://security.google.com/settings/security/permissions.

To detect trends, HEAT reads aggregated public signals (such as trending topics, search interest and public post counts) from sources like X, Google Trends, YouTube, TikTok and Instagram. We use these signals in aggregate to describe what a conversation is about; we do not build profiles of the people who take part in it.

• To provide the Service: generate ideas and pieces, show them to your team, publish what you approve and measure results.
• To operate, secure and improve the Service, prevent abuse and fix problems.
• To communicate with you about your account, security and changes to the Service.
• To comply with legal obligations and enforce our Terms of Service.

We do not use Your Content or data from connected platforms to train our own AI models.

We share information only with providers that help us run the Service, under contracts that limit their use of it, and with the platforms you connect when you ask HEAT to act on them:

• Infrastructure and hosting: Supabase (database, authentication and file storage), Vercel (web application) and Railway (background processing).
• AI model providers that process prompts, brand materials and content to generate ideas and pieces, such as Anthropic, OpenAI, Google and providers reached through OpenRouter.
• Payment processing: Stripe.
• The social media and advertising platforms you connect (TikTok, Meta/Instagram, Google/YouTube), when you ask HEAT to publish or run campaigns.
• Authorities, when required by law, or to protect the rights, property or safety of Brand Heat, our users or others.

If Brand Heat is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this Policy. We do not sell personal information.

The access credentials (OAuth tokens) of each connected account are stored encrypted with AES-256-GCM, in a table that only HEAT's servers can read; the encryption key is kept outside the database, and each credential is bound to its own brand, so it cannot be used for another one. Credentials are never shown in the Service, sent to your browser or written to logs. You can revoke HEAT's access at any time from the “Where they publish” section of the brand settings in HEAT, or from the platform itself — for TikTok, under Settings and privacy → Security → Manage app permissions; for Google Ads and YouTube, at https://security.google.com/settings/security/permissions; for Meta, under Settings → Business integrations.

We keep account and workspace information for as long as the account is active. Content and connection metadata are kept while the workspace exists, and deleted or anonymized within 90 days after the workspace is closed, unless we must keep it longer to comply with law. Logs are kept for a limited period for security purposes.

Disconnecting a platform stops HEAT from accessing it; information about posts already published through HEAT is kept as part of your results until you ask us to delete it. To request deletion of your account or data, write to privacy@brandheat.ai.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, write to privacy@brandheat.ai. If we process your information on behalf of a brand, we will forward your request to that brand. You may also complain to your local data protection authority.

We use technical and organizational measures to protect information, including encryption in transit, access controls that isolate each workspace's data, and the minimum permissions needed on connected platforms. No system is completely secure; if we learn of a breach that affects your information, we will notify you as required by law.

Brand Heat and its providers process information in the United States and other countries. When information is transferred across borders we rely on appropriate safeguards required by applicable law.

The Service is intended for business use by people who are at least 18 years old. We do not knowingly collect information from children.

We may update this Policy. If a change is material, we will notify you through the Service or by email before it takes effect.

Brand Heat Global LLC, 2700 Glades Circle, Suite 155, Weston, FL 33327, United States — privacy@brandheat.ai.