Privacy Policy

1. Introduction

Brandosel ("we," "us," or "our") operates the custom-domain professional email forwarding and alias-management platform available at brandosel.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By accessing or using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect your full name, email address, and password (stored in hashed form). If you sign in via Google OAuth, we receive your name, email address, and profile picture URL from Google.

2.2 Domain and Email Configuration

To provide the Service, we store your custom domain names, DNS configuration records, email alias addresses, forwarding destinations, inbox names, and related routing rules.

2.3 Email Content

We process and store inbound and outbound email messages including subject lines, message bodies (text and HTML), sender and recipient addresses, message IDs, and file attachments. This data is necessary to deliver the core email service.

2.4 Billing Information

Payment processing is handled by our third-party payment provider (Polar). We store your subscription status, plan type, and billing period. We do not store credit card numbers or full payment credentials on our servers.

2.5 Organization and Team Data

If you create or join an organization, we collect organization names, member roles, invitation emails, and alias assignment records.

2.6 Technical and Usage Data

We automatically collect standard technical data including IP addresses, browser type and version, device information, pages visited, and timestamps. We may also collect push notification subscription endpoints if you opt in to browser notifications.

2.7 AI Configuration

If you enable AI features, we store your AI preferences including system prompts, tone settings, model preferences, and auto-triage configuration. AI-generated email summaries, priority classifications, sentiment labels, and draft replies are stored alongside your email threads.

3. How We Use Your Information

• To provide, operate, and maintain the email forwarding and alias management Service
• To process and deliver inbound and outbound email messages
• To authenticate your identity and secure your account
• To manage subscriptions, billing, and payments
• To provide AI-powered email triage, drafting, and classification (when enabled by you)
• To send transactional system emails such as email ownership verification, registration codes, DNS status updates, and account notifications
• To monitor and maintain system security, detect abuse, and prevent unauthorized access
• To respond to support inquiries and provide customer service
• To comply with legal obligations and enforce our Terms of Service

We do not send marketing newsletters or promotional emails. All communications are strictly transactional and service-related.

4. AI Data Processing

When AI features are enabled, email content may be processed by third-party AI model providers to generate summaries, classifications, and draft responses. This processing occurs in isolated, encrypted sessions.

• Your email content is never used to train AI models
• AI processing is performed on-demand only when features are enabled by you
• You can disable all AI features at any time from your account settings
• AI-generated outputs (summaries, labels, drafts) are stored in your account and deleted when you delete the associated thread or account

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only in the following circumstances:

• Service Providers: We use trusted third-party services to operate the platform, including Cloudflare (email routing and DNS), Amazon Web Services (email delivery via SES and file storage via S3), Supabase (authentication and database), Polar (payment processing), and AI model providers (email analysis when enabled). These providers process data only as necessary to perform their designated functions.
• Organization Members: If you belong to an organization on Brandosel, organization administrators may see your name, email address, role, and alias assignments within that organization.
• Legal Compliance: We may disclose information if required by law, subpoena, court order, or governmental request, or to protect our rights, safety, or property.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction. We will notify affected users before their data becomes subject to a different privacy policy.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Email content is stored for the duration of your account unless you manually delete individual threads or emails. When you delete your account, all associated data — including emails, domains, aliases, AI configurations, and organization memberships — is permanently deleted within 30 days. We may retain anonymized, aggregated data for analytical purposes that cannot be used to identify you.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) for all connections
• Passwords stored using secure one-way hashing algorithms
• Database access restricted by row-level security policies
• Infrastructure hosted on reputable cloud providers with SOC 2 and ISO 27001 certifications
• Automatic bounce and complaint management to maintain email sending reputation and prevent abuse
• Regular security reviews and monitoring of access logs

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data and account
• Export: Request your data in a portable, machine-readable format
• Objection: Object to certain types of processing
• Restriction: Request that we limit how we use your data

To exercise any of these rights, contact us at privacy@brandosel.com. We will respond to requests within 30 days.

9. Cookies and Tracking

We use essential cookies strictly necessary to operate the Service, including authentication session cookies and theme preference cookies. We do not use advertising cookies, third-party tracking pixels, or behavioral analytics tools that profile your activity across other websites.

10. International Data Transfers

Your data may be processed and stored in data centers located in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these locations. We ensure that any international transfer of data is subject to appropriate safeguards consistent with applicable data protection laws.

11. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date. For significant changes that affect how we process your data, we will provide notice via email or an in-app notification. Your continued use of the Service after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: