Privacy Policy
⚠ Draft v1 — pending legal review. This document reflects the current data flows of BRBS Media Studio and cites the applicable EU norms, but should be reviewed by a qualified lawyer before go-live.
1. Who we are (Data Controller)
The controller of your personal data (GDPR Art. 4(7)) is BRBS Trade AB, SYSTER JENNYS VÄG 10 A LGH 1001, 231 34 Trelleborg, Sweden (org. no. 559529-4686, VAT registration pending). Contact: info@brbsmediastudio.com.
2. What data we process
- Account & identity — name, email and authentication identifiers (via Auth0).
- Workspace content — channels, prompts, generated posts, tasks, schedules and media you upload.
- Connected platform credentials — OAuth tokens for the social platforms you link (stored to publish on your behalf).
- Billing data — subscription and invoice data via Stripe. We do not store full card numbers; card data is handled by Stripe.
- Usage, diagnostics & audit logs — technical logs, model-run/cost records and an audit trail of actions, for security and reliability.
3. Why we process it & legal basis (Art. 6)
- To provide the service — performance of a contract, Art. 6(1)(b).
- Security, fraud prevention, diagnostics, product improvement — legitimate interests, Art. 6(1)(f).
- Tax, accounting and legal compliance — legal obligation, Art. 6(1)(c).
- Optional features & communications where applicable — consent, Art. 6(1)(a), which you may withdraw at any time.
4. AI processing & “bring your own key” (BYOK)
To generate content, the prompts and text you submit are sent to large-language-model providers. When you use your own API key (BYOK), that data is sent directly to the provider you chose, under your agreement with them. Using our managed keys, prompts are processed via the OpenAI and/or Groq APIs (and any other provider you enable). Per those providers’ API terms, your prompts are not used to train their publicly available models. Providers may operate outside the EU/EEA (see §6). You are responsible for reviewing AI-generated output before publishing it (see also our Terms and the EU AI Act transparency duties, Reg. (EU) 2024/1689, Art. 50).
5. Google user data (YouTube)
When you connect a YouTube channel, the Service accesses data through Google APIs. Google requires us to state plainly what we do with it, so:
- What we access — an OAuth access & refresh token for the Google Account you connect, the identity of the YouTube channel you authorise, the ability to upload videos to that channel, and the upload/processing status of videos you uploaded through the Service.
- Why — solely to publish the content you create, to the channel you chose, at the moment you ask us to, and to show you whether that upload succeeded.
- Who we share it with — no third party. Google user data is not sold, not rented, not used for advertising, and not shared with any other company. The only parties that touch it are the infrastructure providers that run the Service on our behalf, under contract and instruction: DigitalOcean (our backend server and database in the EU, where the OAuth tokens are stored encrypted) and Cloudflare (network/CDN in front of it). No human at BRBS reads your Google user data except where strictly necessary to resolve a support request you raised, or where the law requires it.
- Not used for AI — data received from Google APIs is never sent to our AI providers (OpenAI, Groq or any other) and is never used to develop, improve or train AI/ML models, whether ours or anyone else’s.
- Retention & deletion — tokens are kept only while the connection is active. Disconnecting YouTube in the app deletes them immediately; deleting your account removes them within 30 days. You can also revoke our access at any time from your own Google Account at myaccount.google.com/permissions.
Limited Use. BRBS Media Studio’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
By using the YouTube integration you are also bound by the YouTube Terms of Service and the Google Privacy Policy.
6. Sub-processors
We use vetted third parties to operate the service (identity, payments, AI, social platform APIs, hosting). The current list is published in the Sub-processors document. We impose data-protection terms on each per Art. 28.
7. International transfers (Art. 44–49)
Some sub-processors (e.g. OpenAI, Stripe, Auth0) may process data in the United States. Such transfers are safeguarded by the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework where the provider is certified.
8. Retention (Art. 5(1)(e))
We keep data while your workspace is active; backups for up to 30 days; audit logs for up to 12 months; billing records for the period required by tax law. Local app data stored on your device remains until you delete it.
9. Your rights (Art. 15–22)
You have the right to access, rectify, erase (Art. 17), restrict, port (Art. 20) and object to processing, and to withdraw consent. You can export or delete your workspace data from within the app. To exercise other rights, contact info@brbsmediastudio.com. You may also lodge a complaint with your supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY / Integritetsskyddsmyndigheten), Art. 77.
Right to be forgotten: if you are in the EEA you may request permanent deletion of your account and connected social-media tokens via the app or at info@brbsmediastudio.com. Your stored access tokens and content history will be wiped from our active databases within 30 days.
10. US state privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, to request access and deletion, and to opt out of any “sale” or “sharing” of personal information (we do not sell your personal information). Similar rights apply under other US state privacy laws. To exercise them, contact info@brbsmediastudio.com. We will not discriminate against you for exercising these rights.
11. Security (Art. 32)
Encryption in transit (TLS) and at rest, access controls, tenant isolation per workspace, and an audit trail. No method is 100% secure; we notify breaches as required by Art. 33–34.
12. Changes
We will update this policy as our processing changes and revise the “last updated” date. Material changes will be notified in-app.