Privacy notice

1. What we store

• Account data: your email address, display name, and an Argon2id password hash. We never store your password itself.
• Workspace data: organization name, members and their roles, and the business and campaign profiles you create — industry, segments, geography, budget range, AOV, contribution margin, social links, and NAP details. Completed campaigns may also include a team-entered outcome note; it is not independently verified and is visible to active members of that workspace, including those with the viewer role.
• Engine output: scans, reports, scores, matches, ROI scenarios, opportunity candidates, action plans, and notifications you generate.
• Technical records: session records (hashed token, IP address, user-agent), an append-only audit log of actions taken in the workspace, and the email outbox holding messages queued to you.

2. Why we process it

To operate the product you asked for: authenticating you, running the engines you request, storing the results, sending you the service emails you trigger, and keeping a security audit trail. We do not sell personal data, and this deployment runs no third-party analytics, advertising, or tracking scripts.

3. Scanned sites and third parties

When you run a visibility scan, the application fetches the page you name. It identifies itself as BrandGrowthBot/0.1, respects robots.txt, and refuses private, loopback, and cloud-metadata addresses. What it observed is stored against your workspace as USER SUBMITTED data. If an operator configures a mail server, message contents pass through that provider; until then the outbox prints to the server log and no mail leaves the machine.

4. How long we keep it

• Sessions expire after 30 days by default and are revoked on logout, password reset, or account suspension.
• Email verification tokens expire after 24 hours; workspace invitations after 7 days. Both are stored only as hashes.
• Engine results and profiles, including campaign outcome notes, remain with the workspace; there is no separate per-note expiry. Submission audit entries record the submitting account and limited event metadata, not the note text.
• Deleting a campaign, its linked business profile, or its workspace removes the active campaign note. Deleting an account removes that account's identity but does not remove content from a workspace that remains. Backup copies may retain earlier records until they expire under operator-managed backup retention; campaign-note deletion does not rewrite existing backups.
• Audit entries are retained independently of campaign records; no scheduled audit-log expiry was identified. Deleting the submitting account nulls its user reference, while deleting a workspace nulls its workspace reference; action and campaign identifiers may remain.
• Host backup rotation keeps the newest 14 logical dumps and 6 physical base backups. The separate offsite copy keeps local copies for 30 days. No automatic cleanup of the host WAL archive was identified, so archived log files may remain beyond those windows.

5. Your rights

You can access, correct, and export your data from the settings page. The export includes campaign profiles from workspaces where you are an active member, whatever your role in that workspace; stored outcome_feedback is included as-is. No other workspace's campaign data is included. Current-format outcome notes are identified in the export as team-entered and unverified, and are not used for scoring, ranking, ROI, or learning. Any future use of these notes by engine learning would require separate evidence and verification rules and a separate approval; none is in place. Malformed or unrecognized legacy values are preserved as stored but are not treated as valid notes by campaign views. You can delete your account or, as a workspace owner, delete a workspace from the application; deleting your account alone does not delete shared workspace content. You can also ask to withdraw consent for service-funnel contact — lead records are only created when you explicitly opt in with a recorded consent timestamp, and that consent is never pre-ticked.

6. Security

Passwords are hashed with Argon2id. Session and invitation tokens are stored as SHA-256 hashes, never in plaintext. Every tenant query is scoped by the organization carried in your session — not by anything a request body can set. State-changing API calls are rejected unless they come from the application's own origin. The deployment is single-tenant per workspace and self-hosted, with no partner or agency able to read another workspace's data. Two-factor authentication and single-use recovery codes are available to every account, and rate-limit and lockout counters are enforced server-side.

7. Changes

If this notice changes materially, the updated version appears here with a new effective date. Continued use after a change means the new notice applies. Questions about this notice, or any request about your data, can be sent to the grievance contact above and are answered within 72 hours.